Fortinet FCP_FMG_AD-7.6 Practice Test 13
Question 120
At Bayridge Hotels, the runbook says that a FortiGate upgraded to a newer supported branch version cannot use features in its older ADOM database. Which false assumption should be removed before approval?
- Upgrading FortiOS automatically upgrades every FortiManager ADOM without review.
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
- Workspace mode must always apply the same locking requirements to every ADOM.
- A contractor who operates one device must automatically receive permission on every sibling device.
Explanation
Correct Answer
A:This is the invalid assumption for adom version compatibility. ADOM versions influence the available managed configuration schema and supported FortiOS features. It creates a risk because the proper action is to plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks.
Incorrect Answers
B:The quoted shortcut concerns adom device movement; the stated case instead hinges on a different false premise about adom version compatibility. upgrading FortiOS automatically upgrades every FortiManager ADOM without review.
C:That incorrect belief could cause problems for per-adom workspace setting. Here the direct trap is upgrading FortiOS automatically upgrades every FortiManager ADOM without review.
D:This is an unsafe assumption about multi-tenant delegated operator, but it is not the most directly relevant misconception for adom version compatibility. ADOM versions influence the available managed configuration schema and supported FortiOS features.
Question 121
A change approver at Mapleline Cloud finds that a branch wants centralized backup visibility but its onsite team must retain all configuration authority. What should be done first to correct the stated deficiency?
- Plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks.
- Scope privileges and device or package access to the smallest supported management boundary.
- Choose backup-oriented ADOM operation rather than normal central management for that business requirement.
- Revise the user's ADOM assignments and recheck inherited administrator privileges.
Explanation
Correct Answer
C:This problem involves adom normal versus backup mode. Backup mode retains configurations without imposing central policy editing authority on the managed device. The targeted response is to choose backup-oriented ADOM operation rather than normal central management for that business requirement. Success is evidenced when revisions are captured while local administrators continue controlling live branch configuration.
Incorrect Answers
A:That action is intended for adom version compatibility, not the specified adom normal versus backup mode condition. Here, choose backup-oriented ADOM operation rather than normal central management for that business requirement.
B:This is a valid operational idea for multi-tenant delegated operator, but it does not establish the expected result for adom normal versus backup mode: revisions are captured while local administrators continue controlling live branch configuration.
D:That response relates to adom to administrator reassignment. It would not directly resolve the reported case: a branch wants centralized backup visibility but its onsite team must retain all configuration authority. The required change has a different scope.
Question 122
At Pinecrest Energy, a branch wants centralized backup visibility but its onsite team must retain all configuration authority. Which technical explanation BEST describes why the proposed approach is deficient?
- ADOM revisions snapshot the central ADOM management database rather than one device's running configuration.
- ADOM upgrades affect database compatibility and should have a recoverable baseline.
- Read privileges permit inventory visibility without implicitly granting policy change authority.
- Backup mode retains configurations without imposing central policy editing authority on the managed device.
Explanation
Correct Answer
D:Backup mode retains configurations without imposing central policy editing authority on the managed device. For this operating condition, the corrective action is to choose backup-oriented ADOM operation rather than normal central management for that business requirement. Verify that revisions are captured while local administrators continue controlling live branch configuration.
Incorrect Answers
A:The concept is relevant to adom revision boundary but would not explain adom normal versus backup mode. Here, backup mode retains configurations without imposing central policy editing authority on the managed device.
B:That explanation applies to one-click adom upgrade preparation. The distinction in the presented situation is backup mode retains configurations without imposing central policy editing authority on the managed device.
C:The stated mechanism covers admin profile read versus write, a related but different manager task. It does not explain why a branch wants centralized backup visibility but its onsite team must retain all configuration authority.
Question 123
At Ironwood Media, engineers have treated a fault where a branch wants centralized backup visibility but its onsite team must retain all configuration authority. Which outcome proves the intended management state?
- Revisions are captured while local administrators continue controlling live branch configuration.
- Each ADOM's target package preview resolves the address to the correct tenant network.
- Tests show the old tenant inaccessible and the new tenant usable with correct role.
- Production edits require the intended lock while lab actions follow its separately approved mode.
Explanation
Correct Answer
A:This measurement directly checks adom normal versus backup mode. The proper intervention is to choose backup-oriented ADOM operation rather than normal central management for that business requirement. backup mode retains configurations without imposing central policy editing authority on the managed device. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:An observation about adom-wide shared object isolation can be true while the original incident remains unresolved. The required evidence must address a branch wants centralized backup visibility but its onsite team must retain all configuration authority.
C:This would validate adom to administrator reassignment, not adom normal versus backup mode. For this change the relevant acceptance criterion is that revisions are captured while local administrators continue controlling live branch configuration.
D:The proposed test targets a different area: per-adom workspace setting. It cannot confirm adom normal versus backup mode, whose proper evidence is that revisions are captured while local administrators continue controlling live branch configuration.
Question 124
During review of a proposed correction at Mapleline Cloud, a branch wants centralized backup visibility but its onsite team must retain all configuration authority. Which unsupported belief could leave the fault unresolved?
- Adding a new ADOM assignment automatically revokes every older assignment.
- Backup ADOM mode is the best choice for centralized package installation to live FortiGates.
- One GUI toggle can erase ADOM segregation safely without considering existing managed devices.
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
Explanation
Correct Answer
B:This is the invalid assumption for adom normal versus backup mode. Backup mode retains configurations without imposing central policy editing authority on the managed device. It creates a risk because the proper action is to choose backup-oriented ADOM operation rather than normal central management for that business requirement.
Incorrect Answers
A:That incorrect belief could cause problems for adom to administrator reassignment. Here the direct trap is backup ADOM mode is the best choice for centralized package installation to live FortiGates.
C:The quoted shortcut concerns adom feature disable safeguard; the stated case instead hinges on a different false premise about adom normal versus backup mode. backup ADOM mode is the best choice for centralized package installation to live FortiGates.
D:This is an unsafe assumption about adom device movement, but it is not the most directly relevant misconception for adom normal versus backup mode. backup mode retains configurations without imposing central policy editing authority on the managed device.
Question 125
At Clearview Services, a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager. Which operational step MOST directly addresses this particular problem?
- Plan a supported ADOM version upgrade or compatible migration using backup and compatibility checks.
- Verify per-ADOM module timezone settings separately from system event-log time interpretation.
- Configure a supported per-ADOM workspace policy to match each environment's change controls.
- Create a scoped administrative profile and restrict the operator to authorized ADOMs and operations.
Explanation
Correct Answer
D:This problem involves tenant administrator profile. Administrative profile and ADOM assignments work together to determine effective management rights. The targeted response is to create a scoped administrative profile and restrict the operator to authorized ADOMs and operations. Success is evidenced when the operator can inspect permitted devices without installing unrelated policies or editing system settings.
Incorrect Answers
A:That action is intended for adom version compatibility, not the specified tenant administrator profile condition. Here, create a scoped administrative profile and restrict the operator to authorized ADOMs and operations.
B:That response relates to adom timezone interpretation. It would not directly resolve the reported case: a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager. The required change has a different scope.
C:This is a valid operational idea for per-adom workspace setting, but it does not establish the expected result for tenant administrator profile: the operator can inspect permitted devices without installing unrelated policies or editing system settings.
Question 126
At Bridgewater Insurance, a junior operator asks why the fix is needed when a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager. Which explanation is the most defensible?
- Administrative profile and ADOM assignments work together to determine effective management rights.
- ADOMs partition centrally managed devices and databases to separate operating responsibilities.
- FortiManager cannot simply disable ADOM segregation while populated non-root ADOM structures remain.
- Moving a managed device changes management database scope and can invalidate previous package associations.
Explanation
Correct Answer
A:Administrative profile and ADOM assignments work together to determine effective management rights. For this operating condition, the corrective action is to create a scoped administrative profile and restrict the operator to authorized ADOMs and operations. Verify that the operator can inspect permitted devices without installing unrelated policies or editing system settings.
Incorrect Answers
B:The concept is relevant to enable adom segmentation but would not explain tenant administrator profile. Here, administrative profile and ADOM assignments work together to determine effective management rights.
C:The stated mechanism covers adom feature disable safeguard, a related but different manager task. It does not explain why a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager.
D:That explanation applies to adom device movement. The distinction in the presented situation is administrative profile and ADOM assignments work together to determine effective management rights.
Question 127
During postchange verification at Harborview Bank, a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager. Which test outcome is the strongest sign of success?
- The resulting root-only inventory and policy migration are verified before disabling ADOM feature.
- The operator can inspect permitted devices without installing unrelated policies or editing system settings.
- Customer A cannot enumerate or alter customer B's device records or policy packages.
- The upgrade report shows expected version and compatible devices with preserved assignments.
Explanation
Correct Answer
B:This measurement directly checks tenant administrator profile. The proper intervention is to create a scoped administrative profile and restrict the operator to authorized ADOMs and operations. administrative profile and ADOM assignments work together to determine effective management rights. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:An observation about adom feature disable safeguard can be true while the original incident remains unresolved. The required evidence must address a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager.
C:The proposed test targets a different area: adom isolation for mssp. It cannot confirm tenant administrator profile, whose proper evidence is that the operator can inspect permitted devices without installing unrelated policies or editing system settings.
D:This would validate one-click adom upgrade preparation, not tenant administrator profile. For this change the relevant acceptance criterion is that the operator can inspect permitted devices without installing unrelated policies or editing system settings.
Question 128
In a peer review for Clearview Services, a regional operator receives ADOM read access but is incorrectly assigned superuser capabilities across the manager. Which shortcut is inconsistent with FortiManager behavior?
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
- Using one shared admin login gives better attribution than individually assigned accounts.
- An ADOM label alone overrides all globally assigned administrator privileges.
- A contractor who operates one device must automatically receive permission on every sibling device.
Explanation
Correct Answer
C:This is the invalid assumption for tenant administrator profile. Administrative profile and ADOM assignments work together to determine effective management rights. It creates a risk because the proper action is to create a scoped administrative profile and restrict the operator to authorized ADOMs and operations.
Incorrect Answers
A:This is an unsafe assumption about adom device movement, but it is not the most directly relevant misconception for tenant administrator profile. administrative profile and ADOM assignments work together to determine effective management rights.
B:That incorrect belief could cause problems for administrator session traceability. Here the direct trap is an ADOM label alone overrides all globally assigned administrator privileges.
D:The quoted shortcut concerns multi-tenant delegated operator; the stated case instead hinges on a different false premise about tenant administrator profile. an ADOM label alone overrides all globally assigned administrator privileges.
Question 129
During an approved branch rollout review at Coastal Rail, a branch FortiGate is moved to a different business unit with another ADOM and policy ownership. What should be changed to resolve the exposure?
- Plan a supported device move and reconcile database objects, package assignments and required revisions.
- Maintain distinct ADOM object definitions and verify the correct package context before installing.
- Choose the FortiManager ADOM type compatible with the product family before moving or registering devices.
- Inspect and adjust the role's read/write permissions for the specific FortiManager pane.
Explanation
Correct Answer
A:This problem involves adom device movement. Moving a managed device changes management database scope and can invalidate previous package associations. The targeted response is to plan a supported device move and reconcile database objects, package assignments and required revisions. Success is evidenced when the device is in the intended ADOM with approved package targets and no unreviewed install diff.
Incorrect Answers
B:That response relates to adom-wide shared object isolation. It would not directly resolve the reported case: a branch FortiGate is moved to a different business unit with another ADOM and policy ownership. The required change has a different scope.
C:This is a valid operational idea for adom type match, but it does not establish the expected result for adom device movement: the device is in the intended ADOM with approved package targets and no unreviewed install diff.
D:That action is intended for admin profile read versus write, not the specified adom device movement condition. Here, plan a supported device move and reconcile database objects, package assignments and required revisions.
Question 130
During architecture validation during a remote branch onboarding, a branch FortiGate is moved to a different business unit with another ADOM and policy ownership. What underlying mechanism matters most?
- ADOM revisions snapshot the central ADOM management database rather than one device's running configuration.
- Moving a managed device changes management database scope and can invalidate previous package associations.
- Separate administrator identities and audit trails establish accountability for central policy changes.
- ADOM versions influence the available managed configuration schema and supported FortiOS features.
Explanation
Correct Answer
B:Moving a managed device changes management database scope and can invalidate previous package associations. For this operating condition, the corrective action is to plan a supported device move and reconcile database objects, package assignments and required revisions. Verify that the device is in the intended ADOM with approved package targets and no unreviewed install diff.
Incorrect Answers
A:The stated mechanism covers adom revision boundary, a related but different manager task. It does not explain why a branch FortiGate is moved to a different business unit with another ADOM and policy ownership.
C:The concept is relevant to administrator session traceability but would not explain adom device movement. Here, moving a managed device changes management database scope and can invalidate previous package associations.
D:That explanation applies to adom version compatibility. The distinction in the presented situation is moving a managed device changes management database scope and can invalidate previous package associations.