Fortinet FCP_FMG_AD-7.6 Practice Test 32
Question 310
During architecture validation after a central manager service alert, an emergency command change must be approved by a different administrator before it is applied to security firewalls. What underlying mechanism matters most?
- CLI syntax and parameters may change between firmware releases and must be tested per target version.
- Previous task selections can diverge from the current authorized device inventory.
- Script-based changes can bypass intended peer review if execution authority is not governed.
- Reconstructing a privileged change requires both the intended command and per-device execution evidence.
Explanation
Correct Answer
C:Script-based changes can bypass intended peer review if execution authority is not governed. For this operating condition, the corrective action is to require the documented change approval or supported workflow session before script execution. Verify that the audit record shows a reviewer-approved script and the exact deployed target list.
Incorrect Answers
A:The stated mechanism covers script syntax versioning, a related but different manager task. It does not explain why an emergency command change must be approved by a different administrator before it is applied to security firewalls.
B:That explanation applies to script scope by device group. The distinction in the presented situation is script-based changes can bypass intended peer review if execution authority is not governed.
D:The concept is relevant to script recording for audit but would not explain script approval ticket. Here, script-based changes can bypass intended peer review if execution authority is not governed.
Question 311
At Meridian Telecom, an emergency command change must be approved by a different administrator before it is applied to security firewalls. What postchange evidence should the reviewer collect for this specific control?
- A test FortiGate accepts each command with zero syntax errors before fleet deployment.
- Each branch receives its own approved hostname without affecting peer devices.
- Test execution creates the object before the referencing policy without unknown-object errors.
- The audit record shows a reviewer-approved script and the exact deployed target list.
Explanation
Correct Answer
D:This measurement directly checks script approval ticket. The proper intervention is to require the documented change approval or supported workflow session before script execution. script-based changes can bypass intended peer review if execution authority is not governed. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:This would validate script syntax versioning, not script approval ticket. For this change the relevant acceptance criterion is that the audit record shows a reviewer-approved script and the exact deployed target list.
B:The proposed test targets a different area: script variable substitution. It cannot confirm script approval ticket, whose proper evidence is that the audit record shows a reviewer-approved script and the exact deployed target list.
C:An observation about script order dependencies can be true while the original incident remains unresolved. The required evidence must address an emergency command change must be approved by a different administrator before it is applied to security firewalls.
Question 312
The central policy owner is challenged after discovering that an emergency command change must be approved by a different administrator before it is applied to security firewalls. Which misleading claim creates the greatest risk?
- Script change tickets are unnecessary because a command is entered from FortiManager.
- The final configuration alone always reveals the complete source script and approval history.
- A read-only FortiManager admin profile makes every script on production devices harmless.
- A single script run on any FortiOS release is universal compatibility proof.
Explanation
Correct Answer
A:This is the invalid assumption for script approval ticket. Script-based changes can bypass intended peer review if execution authority is not governed. It creates a risk because the proper action is to require the documented change approval or supported workflow session before script execution.
Incorrect Answers
B:The quoted shortcut concerns script recording for audit; the stated case instead hinges on a different false premise about script approval ticket. script change tickets are unnecessary because a command is entered from FortiManager.
C:This is an unsafe assumption about scheduled cli script safety, but it is not the most directly relevant misconception for script approval ticket. script-based changes can bypass intended peer review if execution authority is not governed.
D:That incorrect belief could cause problems for staging cli scripts. Here the direct trap is script change tickets are unnecessary because a command is entered from FortiManager.
Question 313
At Ironwood Media, the team reports that a shared automation script uses the same static hostname for every branch after a template copy. Which configuration or recovery action is appropriate?
- Require the documented change approval or supported workflow session before script execution.
- Coordinate script scheduling and monitor manager task capacity before another large rollout.
- Use documented device-specific variables or a supported per-device command template.
- Review the administrator's script execution and managed-device privileges without escalating to global superuser.
Explanation
Correct Answer
C:This problem involves script variable substitution. Central automation needs a deliberate mapping of site-specific values to device identity. The targeted response is to use documented device-specific variables or a supported per-device command template. Success is evidenced when each branch receives its own approved hostname without affecting peer devices.
Incorrect Answers
A:This is a valid operational idea for script approval ticket, but it does not establish the expected result for script variable substitution: each branch receives its own approved hostname without affecting peer devices.
B:That response relates to script queue impact. It would not directly resolve the reported case: a shared automation script uses the same static hostname for every branch after a template copy. The required change has a different scope.
D:That action is intended for script permissions, not the specified script variable substitution condition. Here, use documented device-specific variables or a supported per-device command template.
Question 314
An operations reviewer notes that a shared automation script uses the same static hostname for every branch after a template copy at Mapleline Cloud. Which explanation most directly accounts for the problem?
- Bulk remediation should not accumulate configuration changes when commands are retried.
- Scheduled configuration work competes for management execution resources and needs controlled concurrency.
- Scripts execute configuration commands against selected targets and can have wide operational effects.
- Central automation needs a deliberate mapping of site-specific values to device identity.
Explanation
Correct Answer
D:Central automation needs a deliberate mapping of site-specific values to device identity. For this operating condition, the corrective action is to use documented device-specific variables or a supported per-device command template. Verify that each branch receives its own approved hostname without affecting peer devices.
Incorrect Answers
A:The stated mechanism covers idempotent script rollout, a related but different manager task. It does not explain why a shared automation script uses the same static hostname for every branch after a template copy.
B:That explanation applies to script queue impact. The distinction in the presented situation is central automation needs a deliberate mapping of site-specific values to device identity.
C:The concept is relevant to scheduled cli script safety but would not explain script variable substitution. Here, central automation needs a deliberate mapping of site-specific values to device identity.
Question 315
The audit reviewer must close an incident where a shared automation script uses the same static hostname for every branch after a template copy. Which verification result is most direct?
- Each branch receives its own approved hostname without affecting peer devices.
- The task log confirms that only authorized lab serials received the tested script.
- A second dry-run or lab execution produces no unintended additional objects or policy changes.
- Task backlog and latency return to acceptable levels while priority installs finish.
Explanation
Correct Answer
A:This measurement directly checks script variable substitution. The proper intervention is to use documented device-specific variables or a supported per-device command template. central automation needs a deliberate mapping of site-specific values to device identity. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:An observation about scheduled cli script safety can be true while the original incident remains unresolved. The required evidence must address a shared automation script uses the same static hostname for every branch after a template copy.
C:The proposed test targets a different area: idempotent script rollout. It cannot confirm script variable substitution, whose proper evidence is that each branch receives its own approved hostname without affecting peer devices.
D:This would validate script queue impact, not script variable substitution. For this change the relevant acceptance criterion is that each branch receives its own approved hostname without affecting peer devices.
Question 316
At Ironwood Media, a shared automation script uses the same static hostname for every branch after a template copy. Which assumption should an engineer specifically reject?
- A successful system-level script automatically commits all pending ADOM firewall policies.
- A script automatically substitutes different hostnames based only on the current ADOM name.
- Scripts are automatically idempotent solely because FortiManager stores their task ID.
- FortiManager scripts always reorder CLI lines to satisfy hidden object dependencies.
Explanation
Correct Answer
B:This is the invalid assumption for script variable substitution. Central automation needs a deliberate mapping of site-specific values to device identity. It creates a risk because the proper action is to use documented device-specific variables or a supported per-device command template.
Incorrect Answers
A:That incorrect belief could cause problems for script configuration versus policy installation. Here the direct trap is a script automatically substitutes different hostnames based only on the current ADOM name.
C:This is an unsafe assumption about idempotent script rollout, but it is not the most directly relevant misconception for script variable substitution. central automation needs a deliberate mapping of site-specific values to device identity.
D:The quoted shortcut concerns script order dependencies; the stated case instead hinges on a different false premise about script variable substitution. a script automatically substitutes different hostnames based only on the current ADOM name.
Question 317
During the FortiManager change review for Harborview Bank, a script configures a firewall feature unavailable on one of several FortiGate models. Which response best fits the requirement?
- Require the documented change approval or supported workflow session before script execution.
- Restore device management connectivity and retry only the affected device after confirming its current state.
- Sequence prerequisite object creation and validation before commands that reference it.
- Test supported feature and firmware constraints on the target device before applying the command.
Explanation
Correct Answer
D:This problem involves script failure from missing feature. Script validity depends on target capabilities rather than one common manager-side CLI parser. The targeted response is to test supported feature and firmware constraints on the target device before applying the command. Success is evidenced when unsupported targets are excluded or use compatible commands with a clean task report.
Incorrect Answers
A:That response relates to script approval ticket. It would not directly resolve the reported case: a script configures a firewall feature unavailable on one of several FortiGate models. The required change has a different scope.
B:This is a valid operational idea for script target offline status, but it does not establish the expected result for script failure from missing feature: unsupported targets are excluded or use compatible commands with a clean task report.
C:That action is intended for script order dependencies, not the specified script failure from missing feature condition. Here, test supported feature and firmware constraints on the target device before applying the command.
Question 318
The security operations analyst investigates a case where a script configures a firewall feature unavailable on one of several FortiGate models. Which FortiManager principle governs the decision?
- Script validity depends on target capabilities rather than one common manager-side CLI parser.
- Valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet.
- A multi-target job can produce different results even if its scheduled task started successfully.
- Configuration command order affects dependency resolution during script-based deployment.
Explanation
Correct Answer
A:Script validity depends on target capabilities rather than one common manager-side CLI parser. For this operating condition, the corrective action is to test supported feature and firmware constraints on the target device before applying the command. Verify that unsupported targets are excluded or use compatible commands with a clean task report.
Incorrect Answers
B:That explanation applies to staging cli scripts. The distinction in the presented situation is script validity depends on target capabilities rather than one common manager-side CLI parser.
C:The concept is relevant to script output inspection but would not explain script failure from missing feature. Here, script validity depends on target capabilities rather than one common manager-side CLI parser.
D:The stated mechanism covers script order dependencies, a related but different manager task. It does not explain why a script configures a firewall feature unavailable on one of several FortiGate models.
Question 319
After resolving a case where a script configures a firewall feature unavailable on one of several FortiGate models at Bridgewater Insurance, which observation BEST establishes the remediation worked?
- Task backlog and latency return to acceptable levels while priority installs finish.
- Unsupported targets are excluded or use compatible commands with a clean task report.
- Each branch receives its own approved hostname without affecting peer devices.
- The branch device setting and policy package are separately verified after their corresponding tasks.
Explanation
Correct Answer
B:This measurement directly checks script failure from missing feature. The proper intervention is to test supported feature and firmware constraints on the target device before applying the command. script validity depends on target capabilities rather than one common manager-side CLI parser. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:This would validate script queue impact, not script failure from missing feature. For this change the relevant acceptance criterion is that unsupported targets are excluded or use compatible commands with a clean task report.
C:The proposed test targets a different area: script variable substitution. It cannot confirm script failure from missing feature, whose proper evidence is that unsupported targets are excluded or use compatible commands with a clean task report.
D:An observation about script configuration versus policy installation can be true while the original incident remains unresolved. The required evidence must address a script configures a firewall feature unavailable on one of several FortiGate models.
Question 320
At Harborview Bank, the runbook says that a script configures a firewall feature unavailable on one of several FortiGate models. Which false assumption should be removed before approval?
- Scripts are automatically idempotent solely because FortiManager stores their task ID.
- FortiManager scripts always reorder CLI lines to satisfy hidden object dependencies.
- If a command works on one FortiGate every hardware model supports it identically.
- A scheduled task can prove command execution even when a target device is unreachable.
Explanation
Correct Answer
C:This is the invalid assumption for script failure from missing feature. Script validity depends on target capabilities rather than one common manager-side CLI parser. It creates a risk because the proper action is to test supported feature and firmware constraints on the target device before applying the command.
Incorrect Answers
A:This is an unsafe assumption about idempotent script rollout, but it is not the most directly relevant misconception for script failure from missing feature. script validity depends on target capabilities rather than one common manager-side CLI parser.
B:The quoted shortcut concerns script order dependencies; the stated case instead hinges on a different false premise about script failure from missing feature. if a command works on one FortiGate every hardware model supports it identically.
D:That incorrect belief could cause problems for script target offline status. Here the direct trap is if a command works on one FortiGate every hardware model supports it identically.