Fortinet NSE6_FMG_AD-7.6 Dumps

The correct answer is D. In FortiManager HA manual mode, the study guide explains what happens when members change: if the primary fails, you must manually promote a secondary and repoint the others, but that is not this scenario. For a failed secondary, the relevant exact extract is: “if you remove a secondary member from the HA configuration, the primary FortiManager removes the secondary serial number from the central management configuration of FortiGate, and updates the managed FortiGate devices immediately.”

Operationally, in the HA configuration, removing that failed secondary means deleting its HA peer entry from the primary, which corresponds to removing the failed device’s peer IP. A is false because manual HA is not transparent in this case. B is only a diagnostic detail. C applies when the primary fails, not a secondary.

=========

When FortiManager is behind a NAT device, setting the NATed IP address (100.65.0.120) in the system admin settings causes FortiManager to use that NATed IP address for communication and configuration with FortiGate during discovery and management operations.

Enabling workflow mode along with the ADOM lock feature ensures that all configuration changes go through a centralized review and approval process before installation, allowing controlled and coordinated management of firewall policies by multiple administrators.

The exhibit shows a FortiManager HA cluster with one primary and one secondary member. The FortiManager 7.6 Administrator Study Guide clearly states that if FortiAnalyzer features are enabled, you cannot configure FortiManager HA, so in an HA environment like the one shown, FortiAnalyzer features are not enabled. That makes D the correct answer.

A is incorrect because the study guide explicitly says you do not need to reboot a device when promoting it from secondary to primary.

C is incorrect because the failover mode shown is Manual, not VRRP automatic failover, so failover does not occur automatically based on heartbeat loss.

B is not the best answer here because FortiGuard packages are downloaded separately rather than synchronized as HA data, but the exhibit’s key provable conclusion is the HA restriction on FortiAnalyzer features.

=========

The correct answers are A and C. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “FortiManager creates a configuration revision when: FortiGate is added to FortiManager, Device changes are installed from FortiManager, FortiGate configuration is retrieved from FortiManager, A local change on FortiGate causes an automatic update”.

This exactly proves A, because device changes are installed from FortiManager, and C, because a local change on FortiGate causes an automatic update. The guide also states: “By default, all changes made on a managed FortiGate device are automatically updated on FortiManager and reflected in revision history”.

B and D only modify the FortiManager device-level database status to Modified. They do not, by themselves, create a new revision history until an install, retrieve, or auto-update occurs.

The correct answer is D. The exact extract from the study guide says a revert operation “Reverts only the device database to the previous revision” and “Does not revert policies and objects—you must import them.” It further states: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

That exactly matches the CLI output. The device shows the device manager portion as installed and synchronized, while the policy package appears as unknown, which indicates the revert and installation affected the device-level configuration only. It did not reinstall or synchronize the policy package. Therefore B is incorrect. A is unsupported by the source, and C is unrelated because the firmware version is already shown in the device list output. The study guide also states that after revert you must use Import Configuration to synchronize policy information.

The command set workspace-mode normal enables Workspace (ALL ADOMs). The study guide explicitly states that with this mode, “Workspace (ALL ADOMs): All ADOMs can be locked” and that enabling workspace mode “Disables concurrent read/write access to locked items” with “Read/write access for only one administrator—all others have read-only access.” That directly proves D.

A is also verified by the lab guide, which states: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms that the same administrator can lock more than one ADOM at the same time.

C is incorrect because approval is required only in workflow mode, not in workspace normal.

=========

The correct answer is B. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “Also note when you upgrade the FortiManager firmware version the existing ADOMs are not automatically upgraded.” This directly explains why the administrator saw the FortiManager upgrade complete while the ADOM versions remained unchanged.

The same section also explains that ADOM upgrades are a separate action: “You can upgrade an ADOM in System Settings > ADOMs” and “Can upgrade to one version higher at a time.” In addition, the guide recommends: “upgrade all devices first, and then upgrade the ADOM.”

So the issue is not workspace mode, locked ADOMs, or a stuck task. The ADOMs simply require their own manual upgrade step after the FortiManager firmware upgrade.

The command set workspace-mode normal enables Workspace (ALL ADOMs). The study guide states that in this mode “All ADOMs can be locked” and workspace mode lets administrators lock ADOMs, devices, policy packages, and objects. The lab guide then gives the exact behavior for ungraceful session closure: “If a session is not closed gracefully … FortiManager does not close the administrator session until it times out or the session is deleted. Until this time, the ADOM remains in a locked state.” That directly proves A.

C is also verified by the lab guide statement: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms the same administrator can lock multiple ADOMs at once.

D is a workflow mode approval concept, not workspace normal.

The correct answer is D. The FortiManager 7.6 Administrator Study Guide states: “You can revert to a previous configuration revision” and “Reverts only the device database to the previous revision”. It also states “Does not revert policies and objects—you must import them” and “You must install reverted changes on FortiGate.”

This exactly means a revert operation changes the device-level database on FortiManager, not the policy layer database. The guide further clarifies: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

So C is incorrect because both layers are not reverted together. A and B are also incorrect because the documented and verified effect is specifically a modification of the device database, followed by install and, if needed, policy re-import for synchronization.

=========

In backup mode, FortiManager does not directly manage policy installation via the usual ADOM policy packages; instead, administrators use FortiManager scripts to push configuration changes, including policies, to FortiGate devices.

Meta fields in FortiManager can be added to objects as custom attributes, allowing administrators to categorize and add additional information to firewall objects for easier management and identification.

The correct answer is B because FortiManager supports ADOM-level metadata variables in scripts and templates. The study guide explicitly states that meta fields cannot be used as variables in scripts or provisioning templates; instead, you must use ADOM-level metadata variables. It further says these variables can be used in templates, and their values can be mapped depending on the device where the template is applied.

That makes metadata variables the proper method for handling per-device differences such as whether a FortiGate should use a LAN or WAN source interface for FortiAnalyzer communication. A is wrong because per-device dynamic objects apply to objects like addresses and VIPs, not template interface selection. D is wrong because meta fields are comments/attributes, not template variables. C could work operationally, but it is not the FortiManager feature intended for this use case.

=========

The correct answers are A and C. The FortiManager 7.6 Administrator Study Guide states: “An ADOM revision creates a snapshot of all policy and object configurations for the ADOM”. The lab guide says the same thing in practical terms: “An ADOM revision creates a snapshot of the policy and object configuration for the ADOM” and that these revisions are useful for comparing differences and reverting to a previous revision.

Because the revision is a snapshot of the ADOM’s policy-and-object state, it saves the current ADOM policy/object state, which supports A and directly proves C. B is false because the study guide warns: “ADOM revisions can significantly increase the size of the configuration backup files.” D is not supported by the uploaded sources.

=========

The exhibit shows diagnose fmupdate view-serverlist fds with Server Override Mode: Strict and the active entry marked with *0 as 10.0.1.50 on port 8890, with source CLI. In FortiManager, Strict override mode means the system can communicate only with the configured override server list and cannot fall back to public FDS servers. Therefore, FortiManager gets antivirus and IPS updates from 10.0.1.50, making B correct.

The study guide also explains that antivirus and IPS override addresses are specifically used when a downstream FortiManager must download updates from an upstream FortiManager or another designated server.

So even though FDNI and DEFAULT entries are listed, Strict mode prevents fallback, and only the CLI-defined override server is actually used.

=========

In a FortiManager HA cluster configured with VRRP failover, the failover process is automatic and transparent to administrators. If the monitored interface on the primary device fails, the secondary device takes over without requiring manual intervention to maintain HA.

The output shows dev-db: not modified; conf: in sync, which means the device-level database is aligned with the latest revision history, so A is false. The study guide explains that “Synchronized / Auto-update: The latest revision history configuration entry … is aligned with the configuration on FortiGate,” and dev-db: not modified indicates the device-level settings are not changed on FortiManager.

For the policy layer, the output shows pkg:[imported]BR1-FGT-1. The study guide states “Imported: indicates that a policy package was successfully imported for a managed device,” so the policy package in FortiManager matches what was imported from the managed device context, making C correct.

D is also correct because the lab guide explicitly says “All Provisioning Templates applied on FortiGate devices have precedence over any configuration you apply on the device layer of the FortiManager.”

The correct answer is B. The FortiManager 7.6 Administrator Study Guide explicitly states: “CLI scripts use the FGFM tunnel and the FGFM tunnel is authenticated using the FortiManager and FortiGate serial numbers.” It also states: “Tcl scripts do not run through the FGFM tunnel like CLI scripts do. Tcl scripts use SSH to tunnel through FGFM and they require SSH authentication to do so.”

This is the exact reason CLI scripts can run without prompting for SSH authentication every time: they use the existing secure FGFM management tunnel, not a separate interactive SSH login. The FGFM section of the study guide also confirms that this is a secure communication tunnel established between FortiManager and managed FortiGate devices.

So the enabler is not legacy login, script location, or the “Remote FortiGate Directly” option by itself. It is the FGFM secure management tunnel.