Fortinet FCP_FMG_AD-7.6 Practice Test 12
Question 110
During architecture validation following an unexplained device status change, multiple business units share a manager but administrators need isolated policy and device scope. What underlying mechanism matters most?
- ADOMs partition centrally managed devices and databases to separate operating responsibilities.
- ADOM type constrains which managed device categories are eligible.
- ADOM revisions snapshot the central ADOM management database rather than one device's running configuration.
- MSSP tenancy needs management isolation across device inventory, objects and operational permissions.
Explanation
Correct Answer
A:ADOMs partition centrally managed devices and databases to separate operating responsibilities. For this operating condition, the corrective action is to enable ADOM functionality and place each eligible unit's devices and administrators in a scoped ADOM. Verify that a unit operator sees and edits only assigned resources after ADOM segregation is enabled.
Incorrect Answers
B:That explanation applies to adom type match. The distinction in the presented situation is aDOMs partition centrally managed devices and databases to separate operating responsibilities.
C:The concept is relevant to adom revision boundary but would not explain enable adom segmentation. Here, aDOMs partition centrally managed devices and databases to separate operating responsibilities.
D:The stated mechanism covers adom isolation for mssp, a related but different manager task. It does not explain why multiple business units share a manager but administrators need isolated policy and device scope.
Question 111
At Mapleline Cloud, multiple business units share a manager but administrators need isolated policy and device scope. What postchange evidence should the reviewer collect for this specific control?
- A test user receives the mapped ADOM access and cannot elevate into system administration.
- A unit operator sees and edits only assigned resources after ADOM segregation is enabled.
- Restoring or inspecting the ADOM revision shows the relevant policy and shared objects.
- The contractor can work only on approved assets while other devices remain read-only or hidden.
Explanation
Correct Answer
B:This measurement directly checks enable adom segmentation. The proper intervention is to enable ADOM functionality and place each eligible unit's devices and administrators in a scoped ADOM. ADOMs partition centrally managed devices and databases to separate operating responsibilities. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:This would validate external administrator authentication, not enable adom segmentation. For this change the relevant acceptance criterion is that a unit operator sees and edits only assigned resources after ADOM segregation is enabled.
C:The proposed test targets a different area: adom revision boundary. It cannot confirm enable adom segmentation, whose proper evidence is that a unit operator sees and edits only assigned resources after ADOM segregation is enabled.
D:An observation about multi-tenant delegated operator can be true while the original incident remains unresolved. The required evidence must address multiple business units share a manager but administrators need isolated policy and device scope.
Question 112
The central policy owner is challenged after discovering that multiple business units share a manager but administrators need isolated policy and device scope. Which misleading claim creates the greatest risk?
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
- An ADOM label alone overrides all globally assigned administrator privileges.
- Editing a VDOM on one firewall is enough to separate every business unit in FortiManager.
- Using one shared admin login gives better attribution than individually assigned accounts.
Explanation
Correct Answer
C:This is the invalid assumption for enable adom segmentation. ADOMs partition centrally managed devices and databases to separate operating responsibilities. It creates a risk because the proper action is to enable ADOM functionality and place each eligible unit's devices and administrators in a scoped ADOM.
Incorrect Answers
A:That incorrect belief could cause problems for adom device movement. Here the direct trap is editing a VDOM on one firewall is enough to separate every business unit in FortiManager.
B:This is an unsafe assumption about tenant administrator profile, but it is not the most directly relevant misconception for enable adom segmentation. ADOMs partition centrally managed devices and databases to separate operating responsibilities.
D:The quoted shortcut concerns administrator session traceability; the stated case instead hinges on a different false premise about enable adom segmentation. editing a VDOM on one firewall is enough to separate every business unit in FortiManager.
Question 113
At Bridgewater Insurance, the team reports that a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices. Which configuration or recovery action is appropriate?
- Choose the FortiManager ADOM type compatible with the product family before moving or registering devices.
- Scope privileges and device or package access to the smallest supported management boundary.
- Create a scoped administrative profile and restrict the operator to authorized ADOMs and operations.
- Back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window.
Explanation
Correct Answer
A:This problem involves adom type match. ADOM type constrains which managed device categories are eligible. The targeted response is to choose the FortiManager ADOM type compatible with the product family before moving or registering devices. Success is evidenced when the target appliance appears in the permitted ADOM with an expected device type.
Incorrect Answers
B:This is a valid operational idea for multi-tenant delegated operator, but it does not establish the expected result for adom type match: the target appliance appears in the permitted ADOM with an expected device type.
C:That response relates to tenant administrator profile. It would not directly resolve the reported case: a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices. The required change has a different scope.
D:That action is intended for one-click adom upgrade preparation, not the specified adom type match condition. Here, choose the FortiManager ADOM type compatible with the product family before moving or registering devices.
Question 114
An operations reviewer notes that a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices at Harborview Bank. Which explanation most directly accounts for the problem?
- Moving a managed device changes management database scope and can invalidate previous package associations.
- ADOM type constrains which managed device categories are eligible.
- ADOM revisions snapshot the central ADOM management database rather than one device's running configuration.
- ADOMs partition centrally managed devices and databases to separate operating responsibilities.
Explanation
Correct Answer
B:ADOM type constrains which managed device categories are eligible. For this operating condition, the corrective action is to choose the FortiManager ADOM type compatible with the product family before moving or registering devices. Verify that the target appliance appears in the permitted ADOM with an expected device type.
Incorrect Answers
A:The stated mechanism covers adom device movement, a related but different manager task. It does not explain why a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices.
C:That explanation applies to adom revision boundary. The distinction in the presented situation is aDOM type constrains which managed device categories are eligible.
D:The concept is relevant to enable adom segmentation but would not explain adom type match. Here, aDOM type constrains which managed device categories are eligible.
Question 115
The audit reviewer must close an incident where a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices. Which verification result is most direct?
- The operator can inspect permitted devices without installing unrelated policies or editing system settings.
- Tests show the old tenant inaccessible and the new tenant usable with correct role.
- The target appliance appears in the permitted ADOM with an expected device type.
- The upgrade report shows expected version and compatible devices with preserved assignments.
Explanation
Correct Answer
C:This measurement directly checks adom type match. The proper intervention is to choose the FortiManager ADOM type compatible with the product family before moving or registering devices. ADOM type constrains which managed device categories are eligible. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: tenant administrator profile. It cannot confirm adom type match, whose proper evidence is that the target appliance appears in the permitted ADOM with an expected device type.
B:An observation about adom to administrator reassignment can be true while the original incident remains unresolved. The required evidence must address a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices.
D:This would validate one-click adom upgrade preparation, not adom type match. For this change the relevant acceptance criterion is that the target appliance appears in the permitted ADOM with an expected device type.
Question 116
At Bridgewater Insurance, a FortiProxy appliance cannot be added to an ADOM created for FortiGate-only devices. Which assumption should an engineer specifically reject?
- A contractor who operates one device must automatically receive permission on every sibling device.
- Different customer firewall subnets alone provide FortiManager database isolation.
- One GUI toggle can erase ADOM segregation safely without considering existing managed devices.
- An ADOM's type can be ignored because all Fortinet appliances use the same database.
Explanation
Correct Answer
D:This is the invalid assumption for adom type match. ADOM type constrains which managed device categories are eligible. It creates a risk because the proper action is to choose the FortiManager ADOM type compatible with the product family before moving or registering devices.
Incorrect Answers
A:This is an unsafe assumption about multi-tenant delegated operator, but it is not the most directly relevant misconception for adom type match. ADOM type constrains which managed device categories are eligible.
B:The quoted shortcut concerns adom isolation for mssp; the stated case instead hinges on a different false premise about adom type match. an ADOM's type can be ignored because all Fortinet appliances use the same database.
C:That incorrect belief could cause problems for adom feature disable safeguard. Here the direct trap is an ADOM's type can be ignored because all Fortinet appliances use the same database.
Question 117
During the FortiManager change review for Bayridge Hotels, a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database. Which response best fits the requirement?
- Configure a supported per-ADOM workspace policy to match each environment's change controls.
- Plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks.
- Segregate customers into appropriately scoped ADOMs with separately owned packages and roles.
- Back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window.
Explanation
Correct Answer
B:This problem involves adom version compatibility. ADOM versions influence the available managed configuration schema and supported FortiOS features. The targeted response is to plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks. Success is evidenced when post-upgrade policy preview contains expected supported attributes and assigned devices remain synchronized.
Incorrect Answers
A:That action is intended for per-adom workspace setting, not the specified adom version compatibility condition. Here, plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks.
C:This is a valid operational idea for adom isolation for mssp, but it does not establish the expected result for adom version compatibility: post-upgrade policy preview contains expected supported attributes and assigned devices remain synchronized.
D:That response relates to one-click adom upgrade preparation. It would not directly resolve the reported case: a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database. The required change has a different scope.
Question 118
The security operations analyst investigates a case where a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database. Which FortiManager principle governs the decision?
- An ADOM alone may be wider than the contractor's assigned branch fleet.
- MSSP tenancy needs management isolation across device inventory, objects and operational permissions.
- ADOM versions influence the available managed configuration schema and supported FortiOS features.
- ADOM upgrades affect database compatibility and should have a recoverable baseline.
Explanation
Correct Answer
C:ADOM versions influence the available managed configuration schema and supported FortiOS features. For this operating condition, the corrective action is to plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks. Verify that post-upgrade policy preview contains expected supported attributes and assigned devices remain synchronized.
Incorrect Answers
A:The concept is relevant to multi-tenant delegated operator but would not explain adom version compatibility. Here, aDOM versions influence the available managed configuration schema and supported FortiOS features.
B:The stated mechanism covers adom isolation for mssp, a related but different manager task. It does not explain why a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database.
D:That explanation applies to one-click adom upgrade preparation. The distinction in the presented situation is aDOM versions influence the available managed configuration schema and supported FortiOS features.
Question 119
After resolving a case where a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database at Coastal Rail, which observation BEST establishes the remediation worked?
- Customer A cannot enumerate or alter customer B's device records or policy packages.
- A controlled test verifies the analyst's approved read operation and denies unapproved changes.
- The upgrade report shows expected version and compatible devices with preserved assignments.
- Post-upgrade policy preview contains expected supported attributes and assigned devices remain synchronized.
Explanation
Correct Answer
D:This measurement directly checks adom version compatibility. The proper intervention is to plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks. ADOM versions influence the available managed configuration schema and supported FortiOS features. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: adom isolation for mssp. It cannot confirm adom version compatibility, whose proper evidence is that post-upgrade policy preview contains expected supported attributes and assigned devices remain synchronized.
B:An observation about admin profile read versus write can be true while the original incident remains unresolved. The required evidence must address a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database.
C:This would validate one-click adom upgrade preparation, not adom version compatibility. For this change the relevant acceptance criterion is that post-upgrade policy preview contains expected supported attributes and assigned devices remain synchronized.
Question 120
At Bayridge Hotels, the runbook says that a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database. Which false assumption should be removed before approval?
- Upgrading FortiOS automatically upgrades every FortiManager ADOM without review.
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
- Workspace mode must always apply the same locking requirements to every ADOM.
- A contractor who operates one device must automatically receive permission on every sibling device.
Explanation
Correct Answer
A:This is the invalid assumption for adom version compatibility. ADOM versions influence the available managed configuration schema and supported FortiOS features. It creates a risk because the proper action is to plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks.
Incorrect Answers
B:The quoted shortcut concerns adom device movement; the stated case instead hinges on a different false premise about adom version compatibility. upgrading FortiOS automatically upgrades every FortiManager ADOM without review.
C:That incorrect belief could cause problems for per-adom workspace setting. Here the direct trap is upgrading FortiOS automatically upgrades every FortiManager ADOM without review.
D:This is an unsafe assumption about multi-tenant delegated operator, but it is not the most directly relevant misconception for adom version compatibility. ADOM versions influence the available managed configuration schema and supported FortiOS features.