Fortinet FCP_FMG_AD-7.6 Practice Test 42
Question 410
During architecture validation ahead of the approved maintenance window, device revision capture is missing for a period when the manager and branch lost communication. What underlying mechanism matters most?
- Revision identifiers represent snapshots and do not by themselves explain the changed attributes.
- Configuration history consumes storage that must be managed without destroying required recovery evidence.
- Retrieval observes device configuration while installation writes managed configuration to a FortiGate.
- A connectivity gap can break the historical configuration record and needs an explicit evidence boundary.
Explanation
Correct Answer
D:A connectivity gap can break the historical configuration record and needs an explicit evidence boundary. For this operating condition, the corrective action is to restore management connectivity then retrieve and document the current baseline without guessing unseen changes. Verify that new revision and task logs accurately reflect current settings while the missing period is flagged.
Incorrect Answers
A:That explanation applies to config revision compare. The distinction in the presented situation is a connectivity gap can break the historical configuration record and needs an explicit evidence boundary.
B:The concept is relevant to revision retention and storage but would not explain revision history stale after outage. Here, a connectivity gap can break the historical configuration record and needs an explicit evidence boundary.
C:The stated mechanism covers revision retrieval versus install, a related but different manager task. It does not explain why device revision capture is missing for a period when the manager and branch lost communication.
Question 411
At Ironwood Media, device revision capture is missing for a period when the manager and branch lost communication. What postchange evidence should the reviewer collect for this specific control?
- New revision and task logs accurately reflect current settings while the missing period is flagged.
- Device revision diff and selected service tests confirm the known-good state is back in force.
- The audit can reproduce the selected revision identity and verify its file hash.
- The new serial has its own accurate baseline and the retired serial is excluded from future jobs.
Explanation
Correct Answer
A:This measurement directly checks revision history stale after outage. The proper intervention is to restore management connectivity then retrieve and document the current baseline without guessing unseen changes. a connectivity gap can break the historical configuration record and needs an explicit evidence boundary. Merely seeing a task start is weaker evidence.
Incorrect Answers
B:An observation about rollback verification after failure can be true while the original incident remains unresolved. The required evidence must address device revision capture is missing for a period when the manager and branch lost communication.
C:This would validate revision integrity proof, not revision history stale after outage. For this change the relevant acceptance criterion is that new revision and task logs accurately reflect current settings while the missing period is flagged.
D:The proposed test targets a different area: retrieve after physical replacement. It cannot confirm revision history stale after outage, whose proper evidence is that new revision and task logs accurately reflect current settings while the missing period is flagged.
Question 412
The central policy owner is challenged after discovering that device revision capture is missing for a period when the manager and branch lost communication. Which misleading claim creates the greatest risk?
- An old device revision restores every shared object and package in its ADOM automatically.
- FortiManager can infer every offline firewall change without a subsequent retrieval.
- Any user with revision history read rights must also be allowed to deploy older configurations.
- An installation task marked rollback guarantees every packet path works as before.
Explanation
Correct Answer
B:This is the invalid assumption for revision history stale after outage. A connectivity gap can break the historical configuration record and needs an explicit evidence boundary. It creates a risk because the proper action is to restore management connectivity then retrieve and document the current baseline without guessing unseen changes.
Incorrect Answers
A:This is an unsafe assumption about adom versus device revision, but it is not the most directly relevant misconception for revision history stale after outage. a connectivity gap can break the historical configuration record and needs an explicit evidence boundary.
C:That incorrect belief could cause problems for revision access separation. Here the direct trap is fortiManager can infer every offline firewall change without a subsequent retrieval.
D:The quoted shortcut concerns rollback verification after failure; the stated case instead hinges on a different false premise about revision history stale after outage. FortiManager can infer every offline firewall change without a subsequent retrieval.
Question 413
At Clearview Services, the team reports that a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings. Which configuration or recovery action is appropriate?
- Configure supported device revision capture and document the baseline before deployment.
- Capture an ADOM revision before import and inspect the resulting delta before authorizing install.
- Restore or inspect an approved ADOM revision for central policy/object state and separately assess device configuration.
- Compare running configuration against the approved recovery revision and test critical application flows.
Explanation
Correct Answer
D:This problem involves rollback verification after failure. Rollback completion is an operational result to verify, not merely a task label. The targeted response is to compare running configuration against the approved recovery revision and test critical application flows. Success is evidenced when device revision diff and selected service tests confirm the known-good state is back in force.
Incorrect Answers
A:That response relates to automated device revision baseline. It would not directly resolve the reported case: a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings. The required change has a different scope.
B:That action is intended for revision creation after import, not the specified rollback verification after failure condition. Here, compare running configuration against the approved recovery revision and test critical application flows.
C:This is a valid operational idea for adom versus device revision, but it does not establish the expected result for rollback verification after failure: device revision diff and selected service tests confirm the known-good state is back in force.
Question 414
An operations reviewer notes that a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings at Bridgewater Insurance. Which explanation most directly accounts for the problem?
- Rollback completion is an operational result to verify, not merely a task label.
- The central ADOM database and individual device database have separate revision boundaries.
- Manager stored device data can lag actual firewall configuration when changes occur outside central management.
- Historical device snapshots provide an auditable basis for drift detection.
Explanation
Correct Answer
A:Rollback completion is an operational result to verify, not merely a task label. For this operating condition, the corrective action is to compare running configuration against the approved recovery revision and test critical application flows. Verify that device revision diff and selected service tests confirm the known-good state is back in force.
Incorrect Answers
B:The concept is relevant to adom versus device revision but would not explain rollback verification after failure. Here, rollback completion is an operational result to verify, not merely a task label.
C:That explanation applies to device database update lag. The distinction in the presented situation is rollback completion is an operational result to verify, not merely a task label.
D:The stated mechanism covers automated device revision baseline, a related but different manager task. It does not explain why a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings.
Question 415
The audit reviewer must close an incident where a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings. Which verification result is most direct?
- New revision and task logs accurately reflect current settings while the missing period is flagged.
- Device revision diff and selected service tests confirm the known-good state is back in force.
- The approved differences are reconciled and the managed device returns to intended synchronized status.
- The next install preview maps the intended ADOM object value without unintended overwrite.
Explanation
Correct Answer
B:This measurement directly checks rollback verification after failure. The proper intervention is to compare running configuration against the approved recovery revision and test critical application flows. rollback completion is an operational result to verify, not merely a task label. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:This would validate revision history stale after outage, not rollback verification after failure. For this change the relevant acceptance criterion is that device revision diff and selected service tests confirm the known-good state is back in force.
C:The proposed test targets a different area: local edit causes out-of-sync. It cannot confirm rollback verification after failure, whose proper evidence is that device revision diff and selected service tests confirm the known-good state is back in force.
D:An observation about revision discrepancy from local object can be true while the original incident remains unresolved. The required evidence must address a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings.
Question 416
At Clearview Services, a failed installation triggers manual rollback but the team marks it closed without inspecting branch settings. Which assumption should an engineer specifically reject?
- The newest manager revision alone proves that the incident was caused by firewall policy.
- Retrieving a revision always pushes every ADOM policy to the device.
- An installation task marked rollback guarantees every packet path works as before.
- An import report automatically contains every prior ADOM revision needed for safe rollback.
Explanation
Correct Answer
C:This is the invalid assumption for rollback verification after failure. Rollback completion is an operational result to verify, not merely a task label. It creates a risk because the proper action is to compare running configuration against the approved recovery revision and test critical application flows.
Incorrect Answers
A:This is an unsafe assumption about revision history during incidents, but it is not the most directly relevant misconception for rollback verification after failure. rollback completion is an operational result to verify, not merely a task label.
B:The quoted shortcut concerns revision retrieval versus install; the stated case instead hinges on a different false premise about rollback verification after failure. an installation task marked rollback guarantees every packet path works as before.
D:That incorrect belief could cause problems for revision creation after import. Here the direct trap is an installation task marked rollback guarantees every packet path works as before.
Question 417
During the FortiManager change review for Coastal Rail, a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls. Which response best fits the requirement?
- Separate revision read access from restoration/installation authority with appropriate profiles.
- Compare the device and ADOM object values and decide which version is authoritative before installation.
- Record revision identifiers, timestamps, source device or ADOM and cryptographic hashes for exported backups.
- Inspect revision diff to identify the exact system or policy fields that were modified.
Explanation
Correct Answer
A:This problem involves revision access separation. Historical state visibility need not confer the ability to change live firewall configuration. The targeted response is to separate revision read access from restoration/installation authority with appropriate profiles. Success is evidenced when the operator can inspect snapshots while unauthorized rollback actions are denied.
Incorrect Answers
B:That action is intended for revision discrepancy from local object, not the specified revision access separation condition. Here, separate revision read access from restoration/installation authority with appropriate profiles.
C:That response relates to revision integrity proof. It would not directly resolve the reported case: a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls. The required change has a different scope.
D:This is a valid operational idea for config revision compare, but it does not establish the expected result for revision access separation: the operator can inspect snapshots while unauthorized rollback actions are denied.
Question 418
The security operations analyst investigates a case where a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls. Which FortiManager principle governs the decision?
- Retrieval observes device configuration while installation writes managed configuration to a FortiGate.
- Historical state visibility need not confer the ability to change live firewall configuration.
- Manager stored device data can lag actual firewall configuration when changes occur outside central management.
- Imports can alter central package/object state and need rollback evidence.
Explanation
Correct Answer
B:Historical state visibility need not confer the ability to change live firewall configuration. For this operating condition, the corrective action is to separate revision read access from restoration/installation authority with appropriate profiles. Verify that the operator can inspect snapshots while unauthorized rollback actions are denied.
Incorrect Answers
A:That explanation applies to revision retrieval versus install. The distinction in the presented situation is historical state visibility need not confer the ability to change live firewall configuration.
C:The concept is relevant to device database update lag but would not explain revision access separation. Here, historical state visibility need not confer the ability to change live firewall configuration.
D:The stated mechanism covers revision creation after import, a related but different manager task. It does not explain why a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls.
Question 419
After resolving a case where a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls at Meridian Telecom, which observation BEST establishes the remediation worked?
- Restored ADOM objects and device settings match their intended checkpoints after targeted installs.
- Each planned change has a before/after revision with expected diff and timestamps.
- The operator can inspect snapshots while unauthorized rollback actions are denied.
- The latest revision reflects branch running state and an approved install commits the new rule afterward.
Explanation
Correct Answer
C:This measurement directly checks revision access separation. The proper intervention is to separate revision read access from restoration/installation authority with appropriate profiles. historical state visibility need not confer the ability to change live firewall configuration. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:This would validate adom versus device revision, not revision access separation. For this change the relevant acceptance criterion is that the operator can inspect snapshots while unauthorized rollback actions are denied.
B:The proposed test targets a different area: automated device revision baseline. It cannot confirm revision access separation, whose proper evidence is that the operator can inspect snapshots while unauthorized rollback actions are denied.
D:An observation about revision retrieval versus install can be true while the original incident remains unresolved. The required evidence must address a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls.
Question 420
At Coastal Rail, the runbook says that a junior administrator can view device revisions but has been granted broad permissions to restore production firewalls. Which false assumption should be removed before approval?
- Local modifications always take precedence when FortiManager later installs a package.
- An installation task marked rollback guarantees every packet path works as before.
- FortiManager automatically polls all local changes and writes them into ADOM policies immediately.
- Any user with revision history read rights must also be allowed to deploy older configurations.
Explanation
Correct Answer
D:This is the invalid assumption for revision access separation. Historical state visibility need not confer the ability to change live firewall configuration. It creates a risk because the proper action is to separate revision read access from restoration/installation authority with appropriate profiles.
Incorrect Answers
A:The quoted shortcut concerns revision discrepancy from local object; the stated case instead hinges on a different false premise about revision access separation. any user with revision history read rights must also be allowed to deploy older configurations.
B:This is an unsafe assumption about rollback verification after failure, but it is not the most directly relevant misconception for revision access separation. historical state visibility need not confer the ability to change live firewall configuration.
C:That incorrect belief could cause problems for device database update lag. Here the direct trap is any user with revision history read rights must also be allowed to deploy older configurations.
