Fortinet FCP_FMG_AD-7.6 Practice Test 14
Question 130
During architecture validation during a remote branch onboarding, a branch FortiGate is moved to a different business unit with another ADOM and policy ownership. What underlying mechanism matters most?
- ADOM revisions snapshot the central ADOM management database rather than one device's running configuration.
- Moving a managed device changes management database scope and can invalidate previous package associations.
- Separate administrator identities and audit trails establish accountability for central policy changes.
- ADOM versions influence the available managed configuration schema and supported FortiOS features.
Explanation
Correct Answer
B:Moving a managed device changes management database scope and can invalidate previous package associations. For this operating condition, the corrective action is to plan a supported device move and reconcile database objects, package assignments and required revisions. Verify that the device is in the intended ADOM with approved package targets and no unreviewed install diff.
Incorrect Answers
A:The stated mechanism covers adom revision boundary, a related but different manager task. It does not explain why a branch FortiGate is moved to a different business unit with another ADOM and policy ownership.
C:The concept is relevant to administrator session traceability but would not explain adom device movement. Here, moving a managed device changes management database scope and can invalidate previous package associations.
D:That explanation applies to adom version compatibility. The distinction in the presented situation is moving a managed device changes management database scope and can invalidate previous package associations.
Question 131
At Meridian Telecom, a branch FortiGate is moved to a different business unit with another ADOM and policy ownership. What postchange evidence should the reviewer collect for this specific control?
- Change history links a policy update to the correct operator, time and ADOM.
- Each ADOM's target package preview resolves the address to the correct tenant network.
- The device is in the intended ADOM with approved package targets and no unreviewed install diff.
- Event timestamps are interpreted consistently after documenting ADOM and system timezone differences.
Explanation
Correct Answer
C:This measurement directly checks adom device movement. The proper intervention is to plan a supported device move and reconcile database objects, package assignments and required revisions. moving a managed device changes management database scope and can invalidate previous package associations. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:An observation about administrator session traceability can be true while the original incident remains unresolved. The required evidence must address a branch FortiGate is moved to a different business unit with another ADOM and policy ownership.
B:The proposed test targets a different area: adom-wide shared object isolation. It cannot confirm adom device movement, whose proper evidence is that the device is in the intended ADOM with approved package targets and no unreviewed install diff.
D:This would validate adom timezone interpretation, not adom device movement. For this change the relevant acceptance criterion is that the device is in the intended ADOM with approved package targets and no unreviewed install diff.
Question 132
The central policy owner is challenged after discovering that a branch FortiGate is moved to a different business unit with another ADOM and policy ownership. Which misleading claim creates the greatest risk?
- Identically named objects in different ADOMs must always reference identical addresses.
- An ADOM label alone overrides all globally assigned administrator privileges.
- One GUI toggle can erase ADOM segregation safely without considering existing managed devices.
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
Explanation
Correct Answer
D:This is the invalid assumption for adom device movement. Moving a managed device changes management database scope and can invalidate previous package associations. It creates a risk because the proper action is to plan a supported device move and reconcile database objects, package assignments and required revisions.
Incorrect Answers
A:This is an unsafe assumption about adom-wide shared object isolation, but it is not the most directly relevant misconception for adom device movement. moving a managed device changes management database scope and can invalidate previous package associations.
B:The quoted shortcut concerns tenant administrator profile; the stated case instead hinges on a different false premise about adom device movement. dragging a device to another ADOM guarantees that every old object and policy remains compatible.
C:That incorrect belief could cause problems for adom feature disable safeguard. Here the direct trap is dragging a device to another ADOM guarantees that every old object and policy remains compatible.
Question 133
At Ironwood Media, the team reports that a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan. Which configuration or recovery action is appropriate?
- Segregate customers into appropriately scoped ADOMs with separately owned packages and roles.
- Back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window.
- Scope privileges and device or package access to the smallest supported management boundary.
- Configure a supported per-ADOM workspace policy to match each environment's change controls.
Explanation
Correct Answer
B:This problem involves one-click adom upgrade preparation. ADOM upgrades affect database compatibility and should have a recoverable baseline. The targeted response is to back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window. Success is evidenced when the upgrade report shows expected version and compatible devices with preserved assignments.
Incorrect Answers
A:That action is intended for adom isolation for mssp, not the specified one-click adom upgrade preparation condition. Here, back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window.
C:That response relates to multi-tenant delegated operator. It would not directly resolve the reported case: a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan. The required change has a different scope.
D:This is a valid operational idea for per-adom workspace setting, but it does not establish the expected result for one-click adom upgrade preparation: the upgrade report shows expected version and compatible devices with preserved assignments.
Question 134
An operations reviewer notes that a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan at Mapleline Cloud. Which explanation most directly accounts for the problem?
- Object names are resolved inside their relevant ADOM databases unless deliberately managed globally.
- Separate administrator identities and audit trails establish accountability for central policy changes.
- ADOM upgrades affect database compatibility and should have a recoverable baseline.
- An ADOM alone may be wider than the contractor's assigned branch fleet.
Explanation
Correct Answer
C:ADOM upgrades affect database compatibility and should have a recoverable baseline. For this operating condition, the corrective action is to back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window. Verify that the upgrade report shows expected version and compatible devices with preserved assignments.
Incorrect Answers
A:That explanation applies to adom-wide shared object isolation. The distinction in the presented situation is aDOM upgrades affect database compatibility and should have a recoverable baseline.
B:The concept is relevant to administrator session traceability but would not explain one-click adom upgrade preparation. Here, aDOM upgrades affect database compatibility and should have a recoverable baseline.
D:The stated mechanism covers multi-tenant delegated operator, a related but different manager task. It does not explain why a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan.
Question 135
The audit reviewer must close an incident where a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan. Which verification result is most direct?
- Customer A cannot enumerate or alter customer B's device records or policy packages.
- The device is in the intended ADOM with approved package targets and no unreviewed install diff.
- The resulting root-only inventory and policy migration are verified before disabling ADOM feature.
- The upgrade report shows expected version and compatible devices with preserved assignments.
Explanation
Correct Answer
D:This measurement directly checks one-click adom upgrade preparation. The proper intervention is to back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window. ADOM upgrades affect database compatibility and should have a recoverable baseline. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:An observation about adom isolation for mssp can be true while the original incident remains unresolved. The required evidence must address a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan.
B:This would validate adom device movement, not one-click adom upgrade preparation. For this change the relevant acceptance criterion is that the upgrade report shows expected version and compatible devices with preserved assignments.
C:The proposed test targets a different area: adom feature disable safeguard. It cannot confirm one-click adom upgrade preparation, whose proper evidence is that the upgrade report shows expected version and compatible devices with preserved assignments.
Question 136
At Ironwood Media, a team starts a bulk ADOM upgrade with no backup and no feature-compatibility plan. Which assumption should an engineer specifically reject?
- The existence of a one-click upgrade button removes the need for any compatibility check.
- An ADOM label alone overrides all globally assigned administrator privileges.
- Dragging a device to another ADOM guarantees that every old object and policy remains compatible.
- Any user with ADOM view permission can install policy packages automatically.
Explanation
Correct Answer
A:This is the invalid assumption for one-click adom upgrade preparation. ADOM upgrades affect database compatibility and should have a recoverable baseline. It creates a risk because the proper action is to back up the manager and verify supported ADOM upgrade prerequisites, device versions and change window.
Incorrect Answers
B:The quoted shortcut concerns tenant administrator profile; the stated case instead hinges on a different false premise about one-click adom upgrade preparation. the existence of a one-click upgrade button removes the need for any compatibility check.
C:This is an unsafe assumption about adom device movement, but it is not the most directly relevant misconception for one-click adom upgrade preparation. ADOM upgrades affect database compatibility and should have a recoverable baseline.
D:That incorrect belief could cause problems for admin profile read versus write. Here the direct trap is the existence of a one-click upgrade button removes the need for any compatibility check.
Question 137
During the FortiManager change review for Harborview Bank, engineering needs strict locks in production but parallel editing in a laboratory ADOM. Which response best fits the requirement?
- Revise the user's ADOM assignments and recheck inherited administrator privileges.
- Choose backup-oriented ADOM operation rather than normal central management for that business requirement.
- Configure a supported per-ADOM workspace policy to match each environment's change controls.
- Plan a supported device move and reconcile database objects, package assignments and required revisions.
Explanation
Correct Answer
C:This problem involves per-adom workspace setting. Workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode. The targeted response is to configure a supported per-ADOM workspace policy to match each environment's change controls. Success is evidenced when production edits require the intended lock while lab actions follow its separately approved mode.
Incorrect Answers
A:That action is intended for adom to administrator reassignment, not the specified per-adom workspace setting condition. Here, configure a supported per-ADOM workspace policy to match each environment's change controls.
B:That response relates to adom normal versus backup mode. It would not directly resolve the reported case: engineering needs strict locks in production but parallel editing in a laboratory ADOM. The required change has a different scope.
D:This is a valid operational idea for adom device movement, but it does not establish the expected result for per-adom workspace setting: production edits require the intended lock while lab actions follow its separately approved mode.
Question 138
The security operations analyst investigates a case where engineering needs strict locks in production but parallel editing in a laboratory ADOM. Which FortiManager principle governs the decision?
- Read privileges permit inventory visibility without implicitly granting policy change authority.
- Administrative profile and ADOM assignments work together to determine effective management rights.
- ADOM revisions snapshot the central ADOM management database rather than one device's running configuration.
- Workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode.
Explanation
Correct Answer
D:Workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode. For this operating condition, the corrective action is to configure a supported per-ADOM workspace policy to match each environment's change controls. Verify that production edits require the intended lock while lab actions follow its separately approved mode.
Incorrect Answers
A:The stated mechanism covers admin profile read versus write, a related but different manager task. It does not explain why engineering needs strict locks in production but parallel editing in a laboratory ADOM.
B:The concept is relevant to tenant administrator profile but would not explain per-adom workspace setting. Here, workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode.
C:That explanation applies to adom revision boundary. The distinction in the presented situation is workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode.
Question 139
After resolving a case where engineering needs strict locks in production but parallel editing in a laboratory ADOM at Bridgewater Insurance, which observation BEST establishes the remediation worked?
- Production edits require the intended lock while lab actions follow its separately approved mode.
- The target appliance appears in the permitted ADOM with an expected device type.
- Tests show the old tenant inaccessible and the new tenant usable with correct role.
- The contractor can work only on approved assets while other devices remain read-only or hidden.
Explanation
Correct Answer
A:This measurement directly checks per-adom workspace setting. The proper intervention is to configure a supported per-ADOM workspace policy to match each environment's change controls. workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:An observation about adom type match can be true while the original incident remains unresolved. The required evidence must address engineering needs strict locks in production but parallel editing in a laboratory ADOM.
C:The proposed test targets a different area: adom to administrator reassignment. It cannot confirm per-adom workspace setting, whose proper evidence is that production edits require the intended lock while lab actions follow its separately approved mode.
D:This would validate multi-tenant delegated operator, not per-adom workspace setting. For this change the relevant acceptance criterion is that production edits require the intended lock while lab actions follow its separately approved mode.
Question 140
At Harborview Bank, the runbook says that engineering needs strict locks in production but parallel editing in a laboratory ADOM. Which false assumption should be removed before approval?
- The existence of a one-click upgrade button removes the need for any compatibility check.
- Workspace mode must always apply the same locking requirements to every ADOM.
- Backup ADOM mode is the best choice for centralized package installation to live FortiGates.
- Adding a new ADOM assignment automatically revokes every older assignment.
Explanation
Correct Answer
B:This is the invalid assumption for per-adom workspace setting. Workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode. It creates a risk because the proper action is to configure a supported per-ADOM workspace policy to match each environment's change controls.
Incorrect Answers
A:This is an unsafe assumption about one-click adom upgrade preparation, but it is not the most directly relevant misconception for per-adom workspace setting. workspace settings can be differentiated by ADOM when the manager supports per-ADOM mode.
C:That incorrect belief could cause problems for adom normal versus backup mode. Here the direct trap is workspace mode must always apply the same locking requirements to every ADOM.
D:The quoted shortcut concerns adom to administrator reassignment; the stated case instead hinges on a different false premise about per-adom workspace setting. workspace mode must always apply the same locking requirements to every ADOM.