Fortinet FCP_FMG_AD-7.6 Practice Test 35
Question 340
At Mapleline Cloud, the runbook says that a critical CLI remediation was executed but the team did not retain its exact command payload. Which false assumption should be removed before approval?
- A read-only FortiManager admin profile makes every script on production devices harmless.
- A scheduled task can prove command execution even when a target device is unreachable.
- A successful system-level script automatically commits all pending ADOM firewall policies.
- The final configuration alone always reveals the complete source script and approval history.
Explanation
Correct Answer
D:This is the invalid assumption for script recording for audit. Reconstructing a privileged change requires both the intended command and per-device execution evidence. It creates a risk because the proper action is to preserve the script content, change identity, task status and affected device list in the audit record.
Incorrect Answers
A:The quoted shortcut concerns scheduled cli script safety; the stated case instead hinges on a different false premise about script recording for audit. the final configuration alone always reveals the complete source script and approval history.
B:This is an unsafe assumption about script target offline status, but it is not the most directly relevant misconception for script recording for audit. reconstructing a privileged change requires both the intended command and per-device execution evidence.
C:That incorrect belief could cause problems for script configuration versus policy installation. Here the direct trap is the final configuration alone always reveals the complete source script and approval history.
Question 341
A change approver at Clearview Services finds that an automation team validates a command only on a development firewall using a different FortiOS version. What should be done first to correct the stated deficiency?
- Sequence prerequisite object creation and validation before commands that reference it.
- Test the script on a representative matching FortiOS build and hardware capability before production.
- Check FortiOS command support and update the script for the target firmware baseline.
- Preserve the script content, change identity, task status and affected device list in the audit record.
Explanation
Correct Answer
B:This problem involves staging cli scripts. Valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet. The targeted response is to test the script on a representative matching FortiOS build and hardware capability before production. Success is evidenced when staging result and production previews demonstrate expected command behavior for the relevant version.
Incorrect Answers
A:That response relates to script order dependencies. It would not directly resolve the reported case: an automation team validates a command only on a development firewall using a different FortiOS version. The required change has a different scope.
C:This is a valid operational idea for script syntax versioning, but it does not establish the expected result for staging cli scripts: staging result and production previews demonstrate expected command behavior for the relevant version.
D:That action is intended for script recording for audit, not the specified staging cli scripts condition. Here, test the script on a representative matching FortiOS build and hardware capability before production.
Question 342
At Bridgewater Insurance, an automation team validates a command only on a development firewall using a different FortiOS version. Which technical explanation BEST describes why the proposed approach is deficient?
- Bulk remediation should not accumulate configuration changes when commands are retried.
- Script tasks and policy installs have different scopes and state transitions.
- Valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet.
- A multi-target job can produce different results even if its scheduled task started successfully.
Explanation
Correct Answer
C:Valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet. For this operating condition, the corrective action is to test the script on a representative matching FortiOS build and hardware capability before production. Verify that staging result and production previews demonstrate expected command behavior for the relevant version.
Incorrect Answers
A:That explanation applies to idempotent script rollout. The distinction in the presented situation is valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet.
B:The concept is relevant to script configuration versus policy installation but would not explain staging cli scripts. Here, valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet.
D:The stated mechanism covers script output inspection, a related but different manager task. It does not explain why an automation team validates a command only on a development firewall using a different FortiOS version.
Question 343
At Harborview Bank, engineers have treated a fault where an automation team validates a command only on a development firewall using a different FortiOS version. Which outcome proves the intended management state?
- The task report identifies each target and its command status with no unreviewed errors.
- Unsupported targets are excluded or use compatible commands with a clean task report.
- The script's execution context and result show commands applied to the intended managed firewall.
- Staging result and production previews demonstrate expected command behavior for the relevant version.
Explanation
Correct Answer
D:This measurement directly checks staging cli scripts. The proper intervention is to test the script on a representative matching FortiOS build and hardware capability before production. valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: script output inspection. It cannot confirm staging cli scripts, whose proper evidence is that staging result and production previews demonstrate expected command behavior for the relevant version.
B:An observation about script failure from missing feature can be true while the original incident remains unresolved. The required evidence must address an automation team validates a command only on a development firewall using a different FortiOS version.
C:This would validate script execution context, not staging cli scripts. For this change the relevant acceptance criterion is that staging result and production previews demonstrate expected command behavior for the relevant version.
Question 344
During review of a proposed correction at Clearview Services, an automation team validates a command only on a development firewall using a different FortiOS version. Which unsupported belief could leave the fault unresolved?
- A single script run on any FortiOS release is universal compatibility proof.
- A successful system-level script automatically commits all pending ADOM firewall policies.
- FortiManager always translates any obsolete FortiOS CLI into a supported newer command.
- Script change tickets are unnecessary because a command is entered from FortiManager.
Explanation
Correct Answer
A:This is the invalid assumption for staging cli scripts. Valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet. It creates a risk because the proper action is to test the script on a representative matching FortiOS build and hardware capability before production.
Incorrect Answers
B:That incorrect belief could cause problems for script configuration versus policy installation. Here the direct trap is a single script run on any FortiOS release is universal compatibility proof.
C:This is an unsafe assumption about script syntax versioning, but it is not the most directly relevant misconception for staging cli scripts. valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet.
D:The quoted shortcut concerns script approval ticket; the stated case instead hinges on a different false premise about staging cli scripts. a single script run on any FortiOS release is universal compatibility proof.
Question 345
At Coastal Rail, an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes. Which operational step MOST directly addresses this particular problem?
- Use documented device-specific variables or a supported per-device command template.
- Limit script targets, review commands and schedule only the approved managed devices.
- Treat CLI script execution and policy-package installation as separate controlled operations where applicable.
- Choose the supported script target context matching the commands and intended configuration plane.
Explanation
Correct Answer
C:This problem involves script configuration versus policy installation. Script tasks and policy installs have different scopes and state transitions. The targeted response is to treat CLI script execution and policy-package installation as separate controlled operations where applicable. Success is evidenced when the branch device setting and policy package are separately verified after their corresponding tasks.
Incorrect Answers
A:This is a valid operational idea for script variable substitution, but it does not establish the expected result for script configuration versus policy installation: the branch device setting and policy package are separately verified after their corresponding tasks.
B:That response relates to scheduled cli script safety. It would not directly resolve the reported case: an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes. The required change has a different scope.
D:That action is intended for script execution context, not the specified script configuration versus policy installation condition. Here, treat CLI script execution and policy-package installation as separate controlled operations where applicable.
Question 346
At Bayridge Hotels, a junior operator asks why the fix is needed when an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes. Which explanation is the most defensible?
- Valid commands in one environment do not guarantee compatible syntax or semantics across the target fleet.
- Configuration command order affects dependency resolution during script-based deployment.
- A multi-target job can produce different results even if its scheduled task started successfully.
- Script tasks and policy installs have different scopes and state transitions.
Explanation
Correct Answer
D:Script tasks and policy installs have different scopes and state transitions. For this operating condition, the corrective action is to treat CLI script execution and policy-package installation as separate controlled operations where applicable. Verify that the branch device setting and policy package are separately verified after their corresponding tasks.
Incorrect Answers
A:The stated mechanism covers staging cli scripts, a related but different manager task. It does not explain why an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes.
B:The concept is relevant to script order dependencies but would not explain script configuration versus policy installation. Here, script tasks and policy installs have different scopes and state transitions.
C:That explanation applies to script output inspection. The distinction in the presented situation is script tasks and policy installs have different scopes and state transitions.
Question 347
During postchange verification at Meridian Telecom, an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes. Which test outcome is the strongest sign of success?
- The branch device setting and policy package are separately verified after their corresponding tasks.
- Post-incident comparison proves the branch returned to expected baseline after an explicit recovery.
- Staging result and production previews demonstrate expected command behavior for the relevant version.
- A test FortiGate accepts each command with zero syntax errors before fleet deployment.
Explanation
Correct Answer
A:This measurement directly checks script configuration versus policy installation. The proper intervention is to treat CLI script execution and policy-package installation as separate controlled operations where applicable. script tasks and policy installs have different scopes and state transitions. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:This would validate script partial rollback, not script configuration versus policy installation. For this change the relevant acceptance criterion is that the branch device setting and policy package are separately verified after their corresponding tasks.
C:An observation about staging cli scripts can be true while the original incident remains unresolved. The required evidence must address an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes.
D:The proposed test targets a different area: script syntax versioning. It cannot confirm script configuration versus policy installation, whose proper evidence is that the branch device setting and policy package are separately verified after their corresponding tasks.
Question 348
In a peer review for Coastal Rail, an engineer uses a Device Manager script to change a firewall system parameter and assumes it also installs ADOM policy package changes. Which shortcut is inconsistent with FortiManager behavior?
- A single script run on any FortiOS release is universal compatibility proof.
- A successful system-level script automatically commits all pending ADOM firewall policies.
- FortiManager always translates any obsolete FortiOS CLI into a supported newer command.
- A script automatically substitutes different hostnames based only on the current ADOM name.
Explanation
Correct Answer
B:This is the invalid assumption for script configuration versus policy installation. Script tasks and policy installs have different scopes and state transitions. It creates a risk because the proper action is to treat CLI script execution and policy-package installation as separate controlled operations where applicable.
Incorrect Answers
A:That incorrect belief could cause problems for staging cli scripts. Here the direct trap is a successful system-level script automatically commits all pending ADOM firewall policies.
C:This is an unsafe assumption about script syntax versioning, but it is not the most directly relevant misconception for script configuration versus policy installation. script tasks and policy installs have different scopes and state transitions.
D:The quoted shortcut concerns script variable substitution; the stated case instead hinges on a different false premise about script configuration versus policy installation. a successful system-level script automatically commits all pending ADOM firewall policies.
Question 349
During an approved branch rollout review at Ironwood Media, a branch admin changes a firewall object locally while FortiManager retains the older managed configuration. What should be changed to resolve the exposure?
- Review manager task history, relevant device revisions and policy package changes around the incident time.
- Check device revision date against package assignment and ADOM revision before restoration.
- Select the documented known-good device revision and perform controlled restoration with an impact preview.
- Compare FortiGate running state with the device and ADOM database and resolve intended ownership before install.
Explanation
Correct Answer
D:This problem involves local edit causes out-of-sync. Out-of-sync status indicates managed and actual configuration may diverge. The targeted response is to compare FortiGate running state with the device and ADOM database and resolve intended ownership before install. Success is evidenced when the approved differences are reconciled and the managed device returns to intended synchronized status.
Incorrect Answers
A:That action is intended for revision history during incidents, not the specified local edit causes out-of-sync condition. Here, compare FortiGate running state with the device and ADOM database and resolve intended ownership before install.
B:That response relates to revision and package mismatch. It would not directly resolve the reported case: a branch admin changes a firewall object locally while FortiManager retains the older managed configuration. The required change has a different scope.
C:This is a valid operational idea for restore known good device revision, but it does not establish the expected result for local edit causes out-of-sync: the approved differences are reconciled and the managed device returns to intended synchronized status.
Question 350
During architecture validation after a FortiOS upgrade, a branch admin changes a firewall object locally while FortiManager retains the older managed configuration. What underlying mechanism matters most?
- Out-of-sync status indicates managed and actual configuration may diverge.
- Retrieval observes device configuration while installation writes managed configuration to a FortiGate.
- A change event must be linked to a specific deployment and resulting device configuration.
- A revision enables recovery to approved historical configuration rather than blind editing.
Explanation
Correct Answer
A:Out-of-sync status indicates managed and actual configuration may diverge. For this operating condition, the corrective action is to compare FortiGate running state with the device and ADOM database and resolve intended ownership before install. Verify that the approved differences are reconciled and the managed device returns to intended synchronized status.
Incorrect Answers
B:The stated mechanism covers revision retrieval versus install, a related but different manager task. It does not explain why a branch admin changes a firewall object locally while FortiManager retains the older managed configuration.
C:The concept is relevant to revision history during incidents but would not explain local edit causes out-of-sync. Here, out-of-sync status indicates managed and actual configuration may diverge.
D:That explanation applies to restore known good device revision. The distinction in the presented situation is out-of-sync status indicates managed and actual configuration may diverge.