Fortinet FCP_FMG_AD-7.6 Practice Test 37
Question 360
At Meridian Telecom, the runbook says that two device revisions have different IDs but an analyst assumes the firewall policy changed. Which false assumption should be removed before approval?
- Any new revision ID means firewall access rules were changed.
- A retired firewall's configuration revision is automatically the new firewall's actual running state.
- Purging every revision is the safest response to disk pressure regardless of audit needs.
- A local firewall edit automatically rewrites the FortiManager policy package without retrieval.
Explanation
Correct Answer
A:This is the invalid assumption for config revision compare. Revision identifiers represent snapshots and do not by themselves explain the changed attributes. It creates a risk because the proper action is to inspect revision diff to identify the exact system or policy fields that were modified.
Incorrect Answers
B:That incorrect belief could cause problems for retrieve after physical replacement. Here the direct trap is any new revision ID means firewall access rules were changed.
C:The quoted shortcut concerns revision retention and storage; the stated case instead hinges on a different false premise about config revision compare. any new revision ID means firewall access rules were changed.
D:This is an unsafe assumption about local edit causes out-of-sync, but it is not the most directly relevant misconception for config revision compare. revision identifiers represent snapshots and do not by themselves explain the changed attributes.
Question 361
A change approver at Pinecrest Energy finds that a branch loses DNS after a poorly tested system template modification. What should be done first to correct the stated deficiency?
- Review manager task history, relevant device revisions and policy package changes around the incident time.
- Reconcile replacement identity, retrieve current hardware state and reinstall approved baseline.
- Select the documented known-good device revision and perform controlled restoration with an impact preview.
- Configure supported device revision capture and document the baseline before deployment.
Explanation
Correct Answer
C:This problem involves restore known good device revision. A revision enables recovery to approved historical configuration rather than blind editing. The targeted response is to select the documented known-good device revision and perform controlled restoration with an impact preview. Success is evidenced when post-recovery checks confirm DNS and necessary peer settings match the known-good baseline.
Incorrect Answers
A:This is a valid operational idea for revision history during incidents, but it does not establish the expected result for restore known good device revision: post-recovery checks confirm DNS and necessary peer settings match the known-good baseline.
B:That response relates to retrieve after physical replacement. It would not directly resolve the reported case: a branch loses DNS after a poorly tested system template modification. The required change has a different scope.
D:That action is intended for automated device revision baseline, not the specified restore known good device revision condition. Here, select the documented known-good device revision and perform controlled restoration with an impact preview.
Question 362
At Ironwood Media, a branch loses DNS after a poorly tested system template modification. Which technical explanation BEST describes why the proposed approach is deficient?
- Historical state visibility need not confer the ability to change live firewall configuration.
- Rollback completion is an operational result to verify, not merely a task label.
- Retrieval observes device configuration while installation writes managed configuration to a FortiGate.
- A revision enables recovery to approved historical configuration rather than blind editing.
Explanation
Correct Answer
D:A revision enables recovery to approved historical configuration rather than blind editing. For this operating condition, the corrective action is to select the documented known-good device revision and perform controlled restoration with an impact preview. Verify that post-recovery checks confirm DNS and necessary peer settings match the known-good baseline.
Incorrect Answers
A:The stated mechanism covers revision access separation, a related but different manager task. It does not explain why a branch loses DNS after a poorly tested system template modification.
B:That explanation applies to rollback verification after failure. The distinction in the presented situation is a revision enables recovery to approved historical configuration rather than blind editing.
C:The concept is relevant to revision retrieval versus install but would not explain restore known good device revision. Here, a revision enables recovery to approved historical configuration rather than blind editing.
Question 363
At Mapleline Cloud, engineers have treated a fault where a branch loses DNS after a poorly tested system template modification. Which outcome proves the intended management state?
- Post-recovery checks confirm DNS and necessary peer settings match the known-good baseline.
- The before/after ADOM diffs show exactly the accepted imported policies and objects.
- The approved differences are reconciled and the managed device returns to intended synchronized status.
- The next install preview maps the intended ADOM object value without unintended overwrite.
Explanation
Correct Answer
A:This measurement directly checks restore known good device revision. The proper intervention is to select the documented known-good device revision and perform controlled restoration with an impact preview. a revision enables recovery to approved historical configuration rather than blind editing. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:This would validate revision creation after import, not restore known good device revision. For this change the relevant acceptance criterion is that post-recovery checks confirm DNS and necessary peer settings match the known-good baseline.
C:An observation about local edit causes out-of-sync can be true while the original incident remains unresolved. The required evidence must address a branch loses DNS after a poorly tested system template modification.
D:The proposed test targets a different area: revision discrepancy from local object. It cannot confirm restore known good device revision, whose proper evidence is that post-recovery checks confirm DNS and necessary peer settings match the known-good baseline.
Question 364
During review of a proposed correction at Pinecrest Energy, a branch loses DNS after a poorly tested system template modification. Which unsupported belief could leave the fault unresolved?
- Local modifications always take precedence when FortiManager later installs a package.
- Choosing any older revision guarantees that it is the correct and safe recovery point.
- An installation task marked rollback guarantees every packet path works as before.
- Purging every revision is the safest response to disk pressure regardless of audit needs.
Explanation
Correct Answer
B:This is the invalid assumption for restore known good device revision. A revision enables recovery to approved historical configuration rather than blind editing. It creates a risk because the proper action is to select the documented known-good device revision and perform controlled restoration with an impact preview.
Incorrect Answers
A:The quoted shortcut concerns revision discrepancy from local object; the stated case instead hinges on a different false premise about restore known good device revision. choosing any older revision guarantees that it is the correct and safe recovery point.
C:That incorrect belief could cause problems for rollback verification after failure. Here the direct trap is choosing any older revision guarantees that it is the correct and safe recovery point.
D:This is an unsafe assumption about revision retention and storage, but it is not the most directly relevant misconception for restore known good device revision. a revision enables recovery to approved historical configuration rather than blind editing.
Question 365
At Bridgewater Insurance, a security incident began after a policy installation and responders need to correlate the change. Which operational step MOST directly addresses this particular problem?
- Check device revision date against package assignment and ADOM revision before restoration.
- Retrieve the device configuration and compare post-retrieval data with running settings.
- Capture an ADOM revision before import and inspect the resulting delta before authorizing install.
- Review manager task history, relevant device revisions and policy package changes around the incident time.
Explanation
Correct Answer
D:This problem involves revision history during incidents. A change event must be linked to a specific deployment and resulting device configuration. The targeted response is to review manager task history, relevant device revisions and policy package changes around the incident time. Success is evidenced when a revision/task correlation identifies the exact installed change and responsible operator.
Incorrect Answers
A:This is a valid operational idea for revision and package mismatch, but it does not establish the expected result for revision history during incidents: a revision/task correlation identifies the exact installed change and responsible operator.
B:That action is intended for device database update lag, not the specified revision history during incidents condition. Here, review manager task history, relevant device revisions and policy package changes around the incident time.
C:That response relates to revision creation after import. It would not directly resolve the reported case: a security incident began after a policy installation and responders need to correlate the change. The required change has a different scope.
Question 366
At Harborview Bank, a junior operator asks why the fix is needed when a security incident began after a policy installation and responders need to correlate the change. Which explanation is the most defensible?
- A change event must be linked to a specific deployment and resulting device configuration.
- Configuration history consumes storage that must be managed without destroying required recovery evidence.
- Rollback completion is an operational result to verify, not merely a task label.
- Out-of-sync status indicates managed and actual configuration may diverge.
Explanation
Correct Answer
A:A change event must be linked to a specific deployment and resulting device configuration. For this operating condition, the corrective action is to review manager task history, relevant device revisions and policy package changes around the incident time. Verify that a revision/task correlation identifies the exact installed change and responsible operator.
Incorrect Answers
B:The concept is relevant to revision retention and storage but would not explain revision history during incidents. Here, a change event must be linked to a specific deployment and resulting device configuration.
C:The stated mechanism covers rollback verification after failure, a related but different manager task. It does not explain why a security incident began after a policy installation and responders need to correlate the change.
D:That explanation applies to local edit causes out-of-sync. The distinction in the presented situation is a change event must be linked to a specific deployment and resulting device configuration.
Question 367
During postchange verification at Clearview Services, a security incident began after a policy installation and responders need to correlate the change. Which test outcome is the strongest sign of success?
- Device revision diff and selected service tests confirm the known-good state is back in force.
- A revision/task correlation identifies the exact installed change and responsible operator.
- New revision and task logs accurately reflect current settings while the missing period is flagged.
- The latest revision reflects branch running state and an approved install commits the new rule afterward.
Explanation
Correct Answer
B:This measurement directly checks revision history during incidents. The proper intervention is to review manager task history, relevant device revisions and policy package changes around the incident time. a change event must be linked to a specific deployment and resulting device configuration. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:This would validate rollback verification after failure, not revision history during incidents. For this change the relevant acceptance criterion is that a revision/task correlation identifies the exact installed change and responsible operator.
C:The proposed test targets a different area: revision history stale after outage. It cannot confirm revision history during incidents, whose proper evidence is that a revision/task correlation identifies the exact installed change and responsible operator.
D:An observation about revision retrieval versus install can be true while the original incident remains unresolved. The required evidence must address a security incident began after a policy installation and responders need to correlate the change.
Question 368
In a peer review for Bridgewater Insurance, a security incident began after a policy installation and responders need to correlate the change. Which shortcut is inconsistent with FortiManager behavior?
- FortiManager automatically polls all local changes and writes them into ADOM policies immediately.
- Local modifications always take precedence when FortiManager later installs a package.
- The newest manager revision alone proves that the incident was caused by firewall policy.
- A friendly backup filename is sufficient to prove every byte matches the approved configuration.
Explanation
Correct Answer
C:This is the invalid assumption for revision history during incidents. A change event must be linked to a specific deployment and resulting device configuration. It creates a risk because the proper action is to review manager task history, relevant device revisions and policy package changes around the incident time.
Incorrect Answers
A:This is an unsafe assumption about device database update lag, but it is not the most directly relevant misconception for revision history during incidents. a change event must be linked to a specific deployment and resulting device configuration.
B:That incorrect belief could cause problems for revision discrepancy from local object. Here the direct trap is the newest manager revision alone proves that the incident was caused by firewall policy.
D:The quoted shortcut concerns revision integrity proof; the stated case instead hinges on a different false premise about revision history during incidents. the newest manager revision alone proves that the incident was caused by firewall policy.
Question 369
During an approved branch rollout review at Bayridge Hotels, branches undergo planned maintenance but the team has no snapshots to compare postchange settings. What should be changed to resolve the exposure?
- Configure supported device revision capture and document the baseline before deployment.
- Compare the device and ADOM object values and decide which version is authoritative before installation.
- Use retrieval for device-state collection and a separate targeted install for approved manager changes.
- Select the documented known-good device revision and perform controlled restoration with an impact preview.
Explanation
Correct Answer
A:This problem involves automated device revision baseline. Historical device snapshots provide an auditable basis for drift detection. The targeted response is to configure supported device revision capture and document the baseline before deployment. Success is evidenced when each planned change has a before/after revision with expected diff and timestamps.
Incorrect Answers
B:That action is intended for revision discrepancy from local object, not the specified automated device revision baseline condition. Here, configure supported device revision capture and document the baseline before deployment.
C:That response relates to revision retrieval versus install. It would not directly resolve the reported case: branches undergo planned maintenance but the team has no snapshots to compare postchange settings. The required change has a different scope.
D:This is a valid operational idea for restore known good device revision, but it does not establish the expected result for automated device revision baseline: each planned change has a before/after revision with expected diff and timestamps.
Question 370
During architecture validation while consolidating tenant ADOMs, branches undergo planned maintenance but the team has no snapshots to compare postchange settings. What underlying mechanism matters most?
- Historical state visibility need not confer the ability to change live firewall configuration.
- Historical device snapshots provide an auditable basis for drift detection.
- Revision identifiers represent snapshots and do not by themselves explain the changed attributes.
- Out-of-sync status indicates managed and actual configuration may diverge.
Explanation
Correct Answer
B:Historical device snapshots provide an auditable basis for drift detection. For this operating condition, the corrective action is to configure supported device revision capture and document the baseline before deployment. Verify that each planned change has a before/after revision with expected diff and timestamps.
Incorrect Answers
A:The stated mechanism covers revision access separation, a related but different manager task. It does not explain why branches undergo planned maintenance but the team has no snapshots to compare postchange settings.
C:The concept is relevant to config revision compare but would not explain automated device revision baseline. Here, historical device snapshots provide an auditable basis for drift detection.
D:That explanation applies to local edit causes out-of-sync. The distinction in the presented situation is historical device snapshots provide an auditable basis for drift detection.
