⚡ FortiManager 7.6 | Exam Prep (Pregunta 31 a pregunta 40)

An administrator created a new global policy package that includes both header policies and footer policies. What two things must the administrator know before deploying the global policy package to ADOM2? Choose two answers. They can promote ADOM2 objects to global objects. They can assign the global policy package to all or selected policy packages within ADOM2. They must install from the ADOM2 layer to FortiGate when using the Automatically install policies to ADOM devices option. They can synchronize policy packages by importing from the ADOM2 policy package into the global ADOM policy package.

A FortiManager administrator has moved a FortiGate device to a new ADOM, but they cannot see the policy or object configurations for that FortiGate. What should the administrator do to see the policy or object configurations?. Use ADOM shared objects to restore all missing data. Reset the device and add it to the new ADOM again. Import the policy package manually using the Import Configuration wizard. Use ADOM sync to restore the missing configurations.

Refer to the exhibit. An administrator added a FortiGate device to FortiManager with the default object settings at the ADOM layer. What can you conclude from the import policy package process of the HQ-NGFW- 1 device?. The administrator must select Per Platform for all interfaces to correctly detect all interfaces from HQ-NGFW-1. The administrator must manually create the port4 interface on the ADOM layer to avoid import policy errors. FortiManager will create LAN, port4, and port6 as normalized interfaces at the ADOM layer. FortiGate may not work as expected when the administrator does not import all objects.

After correcting a policy package configuration issue, you want to prevent administrators from repeating the mistake that caused the issue. Which FortiManager approach best meets this need?. Configure an TCL script to run locally on FortiManager for each FortiGate. Restrict administrators with an administration profile from viewing the revision history to limit who can make changes. Enable the change note to require administrators to add a note whenever they change object configurations. Enable a workflow requiring approval before installing policy packages on any FortiGate.

What are two expected results when both FortiManager and FortiGate are behind network address translation NAT devices? Choose two answers. FortiGate is discovered by FortiManager through the FortiGate NATed IP address. During discovery, the FortiManager NATed IP address is not set by default on FortiGate. FortiGate can announce itself to FortiManager only if the FortiManager non-NATed IP address is configured on FortiGate under central management. If the FortiGate–FortiManager communication protocol FGFM tunnel is torn down, FortiManager will try to reestablish the FGFM tunnel.

An administrator suspects that the Collector Agent is not forwarding login events to FortiGate. What is the most effective troubleshooting step?. Verify if DC agent is enabled on the FortiGate. Restart the domain controller to refresh authentication services. Verify if FortiGate is set to use LDAP authentication instead of FSSO. Check if TCP port 8000 is open between the collector agent and FortiGate.

Refer to the exhibits. An administrator needs to push a FortiToken Mobile to assign it to HR_user in the HQ-NGFW-1. However, when installing the policy package, they receive the following error message: Why is the administrator not able to install the FortiToken on the HQ-NGFW-1 firewall?. The administrator must use a user local meta field to assign FortiToken. The administrator must use a valid FortiToken that exists on HQ-NGFW-1. The administrator must use a metadata variable to assign the same FortiToken to multiple users in FortiManager. The administrator must use per-device mapping to assign the FortiToken to HQ-NGFW-1.

Company policy dictates that any time a change is made to a policy package on FortiManager an ADOM revision is created before the change installed, and that revision is held for a minimum of 90 days. Over the past three months, each installed change has resulted in several unused policies and duplicate objects. The FortiManager administrator plans to upgrade the FortiGate devices and then upgrade the FortiManager ADOM from version 7.4 to 7.6. Which action can the administrator take to avoid slow ADOM upgrades?. Check and repair the global configuration database before upgrading. Export firewall policies to Excel, delete them on the ADOM. then reimport them after upgrading the ADOM. Find unused firmware templates, then delete them before upgrading. Limit ADOM revisions before upgrading.

An administrator has a FortiGate-HQ device with VDOMs—root, HR and Facilities, currently managed under the FortiManager ADOM—Site1. They try to move VDOM HR to the FortiManager ADOM—Site2, but it does not work. Why is the administrator not able to move FortiGate-HQ VDOM HR to FortiManager ADOM—Site2?. The FortiGate-HQ must be managed under the FortiManager ADOM—root to allow moving its VDOMs to different ADOMs. The administrator must have full access in the device layer of FortiGate-HQ VDOM-root before they can VDOMs to different ADOMs. FortiManager must be in ADOM normal mode, which does not allow VDOMs to be managed separately. The administrator must delete the FortiGate-HQ device from FortiManager and add it again using the Add Device wizard before moving the VDOM.

Refer to the exhibit. What can you conclude from the downloaded import report?. FortiManager does not support per-device mapping for firewall addresses. The administrator will see a new policy package named Remote-FortiGate_root in the FortiManager ADOM database. FortiManager will change the configuration of REMOTE_SUBNET to match the interface mapping coming in from Remote-FortiGate. As a result of this policy import process, FortiManager will create a new firewall address called REMOTE_SUBNET in the ADOM database.