Free Fortinet NSE6_FMG_AD-7.6 Practice Exam with Questions & Answers

The most strongly supported answer is A. The study guide explicitly states: “In the case of having multiple FortiOS firmware versions on the same ADOM, it is recommended to use separate ADOMs instead.” It also says: “When you organize managed FortiGate devices, it is highly recommended that you group them based on their FortiOS firmware version. This is because valid command syntax varies by firmware version, which affects script compatibility.”

D is the other practical fix supported by FortiManager workflow. The study guide states that FortiManager can run scripts on multiple managed devices at once, and device groups let you run scripts on multiple devices instead of a single device. Combined with the firmware-version compatibility rule above, the correct operational approach is to keep version-specific scripts and apply them only to the matching device sets. B and C are not supported by the uploaded study guide as the recommended fix.

=========

The correct answer is B. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages. To achieve full synchronization, you must run the Import Configuration tool on FortiManager to synchronize the policy package.”

The guide also states: “After every retrieve, auto-update, or revert operation, you must use Import Configuration to ensure the policy information is synchronized.”

In the exhibit, the missing unset comment for policy ID 1 is a policy package issue, not just a device-level revert issue. Reinstalling the existing policy package does not automatically rebuild it from the reverted revision. The administrator must import the firewall policies again so the policy package reflects the reverted policy state. That is why the comment was not removed.

=========

The exhibit shows the default value of the LAN address object as 172.16.5.0/255.255.255.0. It also shows Per-Device Mapping entries only for BR1-FGT-1 [root], HQ-NGFW-1 [root] , and Remote-Firewall [root]. There is no mapping shown for Remote-Firewall [VDOM1] .

The FortiManager 7.6 Administrator Study Guide gives the exact rule: “The devices in the ADOM that do not have a dynamic mapping for LAN have a default value.” It also states that dynamic mappings are configured per device in the Per-Device Mapping section.

Since Remote-Firewall [VDOM1] does not have its own mapping entry, it will use the object’s default value, which is 172.16.5.0/255.255.255.0.

Right after moving the ISFW device to a new ADOM, the status typically shows the policy package as never-installed, indicating that the device has been assigned to the new ADOM but no policy package has yet been installed in that ADOM.

The import report shows that a new policy package named Remote-FortiGate_root will be created in the FortiManager ADOM database, but some firewall addresses and policies failed to import due to interface binding conflicts.

The correct answer is C. The FortiManager 7.6 Administrator Study Guide explicitly says: “You must explicitly assign global policy packages to specific ADOMs” and “you can even pick specific policy packages in individual ADOMs that you want to apply the global policies to.” The study guide also explains the assignment workflow: “This slide shows the steps to assign a global policy package to an ADOM policy package” and “First, add the required ADOMs as targets. Second, assign the global policy package to the ADOMs.”

Because Remotes is a newly created policy package, it does not inherit the earlier assignment automatically. The administrator must explicitly assign the Training global policy package to the Remotes policy package. Automatic install does not create that assignment, and unassigning all packages is unnecessary.

The best conclusion is A. From the exhibit, B is clearly incorrect because policy sequence #1 Ping_Access is targeted to ISFW root and ISFW Student, not to root NAT and Trainer NAT. Also, C is incorrect because FortiManager allows a rule to inherit Installation Targets. The study guide explains that a policy package can target one or more devices or VDOMs, and the Install On column is used only for per-rule exceptions in a shared policy package. A rule does not need explicit devices listed if it is meant to apply to the package’s installation targets.

D is also incorrect because global header policies are created in the Global Database ADOM and placed at the top only when a global package is assigned. The exhibit shows a shared policy package, not a global ADOM header-policy assignment.

=========

The output shows dev-db: not modified; conf: in sync, which means the device-level database is aligned with the latest revision history, so A is false. The study guide explains that “Synchronized / Auto-update: The latest revision history configuration entry … is aligned with the configuration on FortiGate,” and dev-db: not modified indicates the device-level settings are not changed on FortiManager.

For the policy layer, the output shows pkg:[imported]BR1-FGT-1. The study guide states “Imported: indicates that a policy package was successfully imported for a managed device,” so the policy package in FortiManager matches what was imported from the managed device context, making C correct.

D is also correct because the lab guide explicitly says “All Provisioning Templates applied on FortiGate devices have precedence over any configuration you apply on the device layer of the FortiManager.”

The correct answer is B. The FortiManager 7.6 Administrator Study Guide explicitly states: “CLI scripts use the FGFM tunnel and the FGFM tunnel is authenticated using the FortiManager and FortiGate serial numbers.” It also states: “Tcl scripts do not run through the FGFM tunnel like CLI scripts do. Tcl scripts use SSH to tunnel through FGFM and they require SSH authentication to do so.”

This is the exact reason CLI scripts can run without prompting for SSH authentication every time: they use the existing secure FGFM management tunnel, not a separate interactive SSH login. The FGFM section of the study guide also confirms that this is a secure communication tunnel established between FortiManager and managed FortiGate devices.

So the enabler is not legacy login, script location, or the “Remote FortiGate Directly” option by itself. It is the FGFM secure management tunnel.

The import report clearly shows: " firewall profile-protocol-options " , SKIPPED, " (name=default, oid=3491, DUPLICATE) " . In FortiManager import reporting, SKIPPED means the object was not imported or updated, and DUPLICATE means an object with that identity already exists in the ADOM database. So FortiManager did not update its database with the imported value for the object default, which makes C correct.

The lab guide reinforces this behavior in the conflict-handling workflow. It explains that during import, FortiManager checks for duplicate names and conflicts, and for conflicting objects the administrator may need to choose whether to keep the value from FortiGate or FortiManager. For the default Firewall Profile-Protocol-Options object, the guide specifically discusses keeping the existing FortiManager value to avoid unnecessary changes.

=========