Fortinet FCP_FMG_AD-7.6 Practice Test 27
Question 260
At Bridgewater Insurance, the runbook says that a managed FortiGate permits FortiManager from a public IP range broader than its authorized controller. Which false assumption should be removed before approval?
- Opening TCP 443 alone always solves FGFM connectivity failures.
- Editing the default outbound firewall policy is the correct first step for every discovery problem.
- A device group automatically creates an isolated ADOM for each member.
- Management-controller access is safe from all internet hosts as long as the certificate is valid.
Explanation
Correct Answer
D:This is the invalid assumption for management interface source restrictions. Centralized device control traffic should be constrained even when the manager credentials are protected. It creates a risk because the proper action is to restrict the management path to approved manager sources while preserving FGFM connectivity.
Incorrect Answers
A:The quoted shortcut concerns fgfm protocol port; the stated case instead hinges on a different false premise about management interface source restrictions. management-controller access is safe from all internet hosts as long as the certificate is valid.
B:That incorrect belief could cause problems for registration discovery failure. Here the direct trap is management-controller access is safe from all internet hosts as long as the certificate is valid.
C:This is an unsafe assumption about device grouping for rollouts, but it is not the most directly relevant misconception for management interface source restrictions. centralized device control traffic should be constrained even when the manager credentials are protected.
Question 261
A change approver at Bayridge Hotels finds that a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls. What should be done first to correct the stated deficiency?
- Review copied template references and update tenant-specific values before assignment.
- Follow FortiManager's supported chassis inventory and device-type registration workflow.
- Match a supported ADOM device-version relationship or migrate the device under approved compatibility rules.
- Check licensed managed-device capacity and planned registration scope before changing firewall settings.
Explanation
Correct Answer
B:This problem involves chassis managed-device roles. Chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate. The targeted response is to follow FortiManager's supported chassis inventory and device-type registration workflow. Success is evidenced when the chassis and its supported managed components appear with correct parent and serial association.
Incorrect Answers
A:That action is intended for copy templates between adoms, not the specified chassis managed-device roles condition. Here, follow FortiManager's supported chassis inventory and device-type registration workflow.
C:That response relates to version-bound device authorization. It would not directly resolve the reported case: a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls. The required change has a different scope.
D:This is a valid operational idea for managed-device quota preflight, but it does not establish the expected result for chassis managed-device roles: the chassis and its supported managed components appear with correct parent and serial association.
Question 262
At Meridian Telecom, a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls. Which technical explanation BEST describes why the proposed approach is deficient?
- Central management enrollment is a privileged action that should be attributable for future incident review.
- Groups assist organization and targeting but membership should reflect operational ownership.
- Chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate.
- Device replacement should transfer intended configuration ownership rather than blindly duplicate identity.
Explanation
Correct Answer
C:Chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate. For this operating condition, the corrective action is to follow FortiManager's supported chassis inventory and device-type registration workflow. Verify that the chassis and its supported managed components appear with correct parent and serial association.
Incorrect Answers
A:That explanation applies to device registration audit. The distinction in the presented situation is chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate.
B:The concept is relevant to device grouping for rollouts but would not explain chassis managed-device roles. Here, chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate.
D:The stated mechanism covers device blueprint migration, a related but different manager task. It does not explain why a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls.
Question 263
At Coastal Rail, engineers have treated a fault where a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls. Which outcome proves the intended management state?
- The latest device revision contains the expected full configuration and installation comparison is consistent.
- A designated enrollment administrator performs the authorized assignment while read-only users cannot.
- Audit history links the serial, administrator, ADOM and registration timestamp.
- The chassis and its supported managed components appear with correct parent and serial association.
Explanation
Correct Answer
D:This measurement directly checks chassis managed-device roles. The proper intervention is to follow FortiManager's supported chassis inventory and device-type registration workflow. chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: initial configuration retrieval. It cannot confirm chassis managed-device roles, whose proper evidence is that the chassis and its supported managed components appear with correct parent and serial association.
B:An observation about access to discovered devices can be true while the original incident remains unresolved. The required evidence must address a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls.
C:This would validate device registration audit, not chassis managed-device roles. For this change the relevant acceptance criterion is that the chassis and its supported managed components appear with correct parent and serial association.
Question 264
During review of a proposed correction at Bayridge Hotels, a Fortinet chassis appliance includes subordinate modules but is entered as an arbitrary set of unrelated firewalls. Which unsupported belief could leave the fault unresolved?
- Adding each module under a random device group ensures correct chassis inventory management.
- A replacement FortiGate inherits every managed policy by keeping the retired unit's display name.
- Successful internet browsing proves the FortiManager management protocol is unblocked.
- Opening TCP 443 alone always solves FGFM connectivity failures.
Explanation
Correct Answer
A:This is the invalid assumption for chassis managed-device roles. Chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate. It creates a risk because the proper action is to follow FortiManager's supported chassis inventory and device-type registration workflow.
Incorrect Answers
B:That incorrect belief could cause problems for device blueprint migration. Here the direct trap is adding each module under a random device group ensures correct chassis inventory management.
C:The quoted shortcut concerns fgfm path diagnostics; the stated case instead hinges on a different false premise about chassis managed-device roles. adding each module under a random device group ensures correct chassis inventory management.
D:This is an unsafe assumption about fgfm protocol port, but it is not the most directly relevant misconception for chassis managed-device roles. chassis hardware has distinct management and inventory considerations from a simple standalone FortiGate.
Question 265
At Mapleline Cloud, a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM. Which operational step MOST directly addresses this particular problem?
- Review the existing device configuration and import the approved policy information into the correct ADOM/package.
- Configure the correct reachable management endpoint and NAT forwarding for the manager's FGFM path.
- Verify installation target selection explicitly rather than assuming the selected device group is enforced.
- Restrict the management path to approved manager sources while preserving FGFM connectivity.
Explanation
Correct Answer
C:This problem involves device group target safety. Target selection can change the blast radius even when policy content is valid. The targeted response is to verify installation target selection explicitly rather than assuming the selected device group is enforced. Success is evidenced when install preview lists exactly the four approved devices and no other ADOM members.
Incorrect Answers
A:This is a valid operational idea for import policy on first registration, but it does not establish the expected result for device group target safety: install preview lists exactly the four approved devices and no other ADOM members.
B:That response relates to fortimanager nat endpoint. It would not directly resolve the reported case: a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM. The required change has a different scope.
D:That action is intended for management interface source restrictions, not the specified device group target safety condition. Here, verify installation target selection explicitly rather than assuming the selected device group is enforced.
Question 266
At Pinecrest Energy, a junior operator asks why the fix is needed when a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM. Which explanation is the most defensible?
- Groups assist organization and targeting but membership should reflect operational ownership.
- Visibility of a pending registration does not imply the account can authorize or relocate managed devices.
- The direction of initial management connection matters when the device is hidden behind translation.
- Target selection can change the blast radius even when policy content is valid.
Explanation
Correct Answer
D:Target selection can change the blast radius even when policy content is valid. For this operating condition, the corrective action is to verify installation target selection explicitly rather than assuming the selected device group is enforced. Verify that install preview lists exactly the four approved devices and no other ADOM members.
Incorrect Answers
A:That explanation applies to device grouping for rollouts. The distinction in the presented situation is target selection can change the blast radius even when policy content is valid.
B:The stated mechanism covers access to discovered devices, a related but different manager task. It does not explain why a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM.
C:The concept is relevant to fortigate nat awareness but would not explain device group target safety. Here, target selection can change the blast radius even when policy content is valid.
Question 267
During postchange verification at Ironwood Media, a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM. Which test outcome is the strongest sign of success?
- Install preview lists exactly the four approved devices and no other ADOM members.
- The expected serial appears as the managed successor and receives the planned policy and template.
- FGFM stays connected from approved addresses and an unapproved management source is blocked.
- The remote FortiGate uses the intended routable translated address for stable manager connectivity.
Explanation
Correct Answer
A:This measurement directly checks device group target safety. The proper intervention is to verify installation target selection explicitly rather than assuming the selected device group is enforced. target selection can change the blast radius even when policy content is valid. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:This would validate model device to physical binding, not device group target safety. For this change the relevant acceptance criterion is that install preview lists exactly the four approved devices and no other ADOM members.
C:The proposed test targets a different area: management interface source restrictions. It cannot confirm device group target safety, whose proper evidence is that install preview lists exactly the four approved devices and no other ADOM members.
D:An observation about fortimanager nat endpoint can be true while the original incident remains unresolved. The required evidence must address a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM.
Question 268
In a peer review for Mapleline Cloud, a change ticket authorizes only four branches but the default install selection includes all devices in the ADOM. Which shortcut is inconsistent with FortiManager behavior?
- A replacement FortiGate inherits every managed policy by keeping the retired unit's display name.
- Being inside the right ADOM guarantees no extra branches can be selected in the install wizard.
- Increasing branch firewall session tables raises FortiManager's licensed device count.
- Successful internet browsing proves the FortiManager management protocol is unblocked.
Explanation
Correct Answer
B:This is the invalid assumption for device group target safety. Target selection can change the blast radius even when policy content is valid. It creates a risk because the proper action is to verify installation target selection explicitly rather than assuming the selected device group is enforced.
Incorrect Answers
A:The quoted shortcut concerns device blueprint migration; the stated case instead hinges on a different false premise about device group target safety. being inside the right ADOM guarantees no extra branches can be selected in the install wizard.
C:That incorrect belief could cause problems for managed-device quota preflight. Here the direct trap is being inside the right ADOM guarantees no extra branches can be selected in the install wizard.
D:This is an unsafe assumption about fgfm path diagnostics, but it is not the most directly relevant misconception for device group target safety. target selection can change the blast radius even when policy content is valid.
Question 269
During an approved branch rollout review at Clearview Services, a branch cannot be discovered and the administrator changes policy objects without checking the firewall's management network. What should be changed to resolve the exposure?
- Review and authorize the expected device-initiated registration request after validating identity.
- Inspect the approved FortiManager/FortiGate FGFM path and required TCP service rather than opening every port.
- Associate the arriving physical device identity with the approved model deployment workflow.
- Start with device identity, IP/routing, DNS if used, credentials and FGFM reachability diagnostics.
Explanation
Correct Answer
D:This problem involves registration discovery failure. Discovery failures are usually registration or path prerequisites rather than firewall policy package defects. The targeted response is to start with device identity, IP/routing, DNS if used, credentials and FGFM reachability diagnostics. Success is evidenced when the documented connectivity test and manager registration diagnostics explain the failure before edits proceed.
Incorrect Answers
A:This is a valid operational idea for device-initiated registration authorization, but it does not establish the expected result for registration discovery failure: the documented connectivity test and manager registration diagnostics explain the failure before edits proceed.
B:That response relates to fgfm protocol port. It would not directly resolve the reported case: a branch cannot be discovered and the administrator changes policy objects without checking the firewall's management network. The required change has a different scope.
C:That action is intended for model device to physical binding, not the specified registration discovery failure condition. Here, start with device identity, IP/routing, DNS if used, credentials and FGFM reachability diagnostics.
Question 270
During architecture validation following an unexplained device status change, a branch cannot be discovered and the administrator changes policy objects without checking the firewall's management network. What underlying mechanism matters most?
- Discovery failures are usually registration or path prerequisites rather than firewall policy package defects.
- The advertised control endpoint must be reachable from managed devices across translation boundaries.
- Central management enrollment is a privileged action that should be attributable for future incident review.
- Preprovisioning controls must be tied to the actual authorized hardware before installation.
Explanation
Correct Answer
A:Discovery failures are usually registration or path prerequisites rather than firewall policy package defects. For this operating condition, the corrective action is to start with device identity, IP/routing, DNS if used, credentials and FGFM reachability diagnostics. Verify that the documented connectivity test and manager registration diagnostics explain the failure before edits proceed.
Incorrect Answers
B:That explanation applies to fortimanager nat endpoint. The distinction in the presented situation is discovery failures are usually registration or path prerequisites rather than firewall policy package defects.
C:The stated mechanism covers device registration audit, a related but different manager task. It does not explain why a branch cannot be discovered and the administrator changes policy objects without checking the firewall's management network.
D:The concept is relevant to model device to physical binding but would not explain registration discovery failure. Here, discovery failures are usually registration or path prerequisites rather than firewall policy package defects.