NSE6_FMG_AD-7.6 Sample Questions Answers

The correct answer is B because FortiManager supports ADOM-level metadata variables in scripts and templates. The study guide explicitly states that meta fields cannot be used as variables in scripts or provisioning templates; instead, you must use ADOM-level metadata variables. It further says these variables can be used in templates, and their values can be mapped depending on the device where the template is applied.

That makes metadata variables the proper method for handling per-device differences such as whether a FortiGate should use a LAN or WAN source interface for FortiAnalyzer communication. A is wrong because per-device dynamic objects apply to objects like addresses and VIPs, not template interface selection. D is wrong because meta fields are comments/attributes, not template variables. C could work operationally, but it is not the FortiManager feature intended for this use case.

=========

The correct conclusion is D. The FortiManager 7.6 Administrator Study Guide defines Never Installed as a state where the policy package was never created and was never imported for a managed device. That means FortiManager may already know the device itself at the device layer, but the firewall policy layer has not yet been built for that device.

The lab guide confirms this behavior directly: when you choose Import Later in the Add Device wizard, the policy package status becomes Never Installed because there is still no policy package created for the added FortiGate devices.

So this is not a revision-history issue, and it does not mean ADOM policy changes are merely waiting for first install. It means the policies still exist only on the managed device side until they are imported into a FortiManager policy package.

=========

In backup mode, FortiManager does not directly manage policy installation via the usual ADOM policy packages; instead, administrators use FortiManager scripts to push configuration changes, including policies, to FortiGate devices.

The global policy package is managed only from the global ADOM by the service provider administrator. Customer administrators with access solely to their ADOM (My_ADOM) cannot edit the global header policy; such changes must be made by the service provider administrator in the global ADOM.

The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.

The correct answer is C. The FortiManager 7.6 Administrator Study Guide states that after adding the root FortiGate of a Security Fabric, all downstream devices in the fabric are automatically added as Unauthorized in the root ADOM. That directly matches option C.

This is important because the administrator created a FortiGate-only ADOM named Training, not a Fabric ADOM. The lab guide explains that a FortiGate ADOM is intended for FortiGate devices, while the Fabric type is the special ADOM type that allows FortiGate and other device types together.

So the downstream members are not automatically authorized, and they do not immediately appear as managed devices inside the Training ADOM. They first appear as unauthorized devices in the root ADOM, where the administrator can review and authorize them.

=========

In a FortiManager HA cluster configured with VRRP failover, the failover process is automatic and transparent to administrators. If the monitored interface on the primary device fails, the secondary device takes over without requiring manual intervention to maintain HA.

The correct answer is D. The exact extract from the study guide says a revert operation “Reverts only the device database to the previous revision” and “Does not revert policies and objects—you must import them.” It further states: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

That exactly matches the CLI output. The device shows the device manager portion as installed and synchronized, while the policy package appears as unknown, which indicates the revert and installation affected the device-level configuration only. It did not reinstall or synchronize the policy package. Therefore B is incorrect. A is unsupported by the source, and C is unrelated because the firmware version is already shown in the device list output. The study guide also states that after revert you must use Import Configuration to synchronize policy information.

FortiManager helps with mass provisioning by using templates that allow administrators to configure the same settings on multiple FortiGate devices simultaneously, streamlining deployment and management.

The correct answer is C. The FortiManager 7.6 Administrator Study Guide explicitly says: “You must explicitly assign global policy packages to specific ADOMs” and “you can even pick specific policy packages in individual ADOMs that you want to apply the global policies to.” The study guide also explains the assignment workflow: “This slide shows the steps to assign a global policy package to an ADOM policy package” and “First, add the required ADOMs as targets. Second, assign the global policy package to the ADOMs.”

Because Remotes is a newly created policy package, it does not inherit the earlier assignment automatically. The administrator must explicitly assign the Training global policy package to the Remotes policy package. Automatic install does not create that assignment, and unassigning all packages is unnecessary.

The correct answer is D. The FortiManager 7.6 Administrator Study Guide states: “You can revert to a previous configuration revision” and “Reverts only the device database to the previous revision”. It also states “Does not revert policies and objects—you must import them” and “You must install reverted changes on FortiGate.”

This exactly means a revert operation changes the device-level database on FortiManager, not the policy layer database. The guide further clarifies: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

So C is incorrect because both layers are not reverted together. A and B are also incorrect because the documented and verified effect is specifically a modification of the device database, followed by install and, if needed, policy re-import for synchronization.

=========

The FortiManager 7.6 Administrator Study Guide is explicit for the scenario where both FortiManager and FortiGate are behind NAT. It states that FortiManager can discover FortiGate through the FortiGate NATed IP address, which makes A correct. It also explains that in this scenario, the FortiManager NATed IP address is not configured on FortiGate by default under central management, which makes B correct.

C is incorrect because FortiGate must use the FortiManager NATed IP address, not the non-NATed IP, if it needs to announce itself or reestablish the FGFM tunnel. D is also incorrect because in this NAT scenario, if the tunnel is torn down, only FortiGate attempts to reestablish the connection; FortiManager does not automatically do so.

=========

Enabling workflow mode along with the ADOM lock feature ensures that all configuration changes go through a centralized review and approval process before installation, allowing controlled and coordinated management of firewall policies by multiple administrators.

The FortiManager 7.6 Administrator Study Guide states that global policies must be explicitly assigned: “You must explicitly assign global policy packages to specific ADOMs,” and FortiManager can also target specific policy packages in individual ADOMs. The lab guide confirms that assignment is performed from the Global Database ADOM: the administrator selects Global Database ADOM, clicks Assignment, adds the ADOM, chooses Specify Policy Packages To Assign, selects the target package, and then clicks Assign.

So creating a new policy package inside ADOM1 does not automatically inherit the existing global package assignment. It also does not automatically install policies. The administrator must go back to the global ADOM and assign the global policy package to that new local policy package.

Right after moving the ISFW device to a new ADOM, the status typically shows the policy package as never-installed, indicating that the device has been assigned to the new ADOM but no policy package has yet been installed in that ADOM.