Fortinet FCP_FMG_AD-7.6 Practice Test 44
Question 430
During architecture validation following an unexplained device status change, ten branch policies use different literal IPs for the same corporate DNS service. What underlying mechanism matters most?
- A managed shared object reduces drift when its defined value is intended across multiple policies.
- Policy validity depends on referenced objects existing in the correct ADOM database.
- Central and local object representations must agree for predictable package installation.
- Policy block constructs support reuse without treating a standalone rule copy as a synchronized component.
Explanation
Correct Answer
A:A managed shared object reduces drift when its defined value is intended across multiple policies. For this operating condition, the corrective action is to create an approved reusable ADOM address object and reference it consistently in relevant packages. Verify that package previews resolve the object consistently and test DNS access to the intended service.
Incorrect Answers
B:The stated mechanism covers policy package validation, a related but different manager task. It does not explain why ten branch policies use different literal IPs for the same corporate DNS service.
C:That explanation applies to fortigate-specific object mapping. The distinction in the presented situation is a managed shared object reduces drift when its defined value is intended across multiple policies.
D:The concept is relevant to policy block reuse but would not explain shared address object control. Here, a managed shared object reduces drift when its defined value is intended across multiple policies.
Question 431
At Bayridge Hotels, ten branch policies use different literal IPs for the same corporate DNS service. What postchange evidence should the reviewer collect for this specific control?
- Postinstall traffic tests show approved networks match and removed subnets are denied.
- Package previews resolve the object consistently and test DNS access to the intended service.
- Postinstall settings show the approved profile on the intended set of security rules.
- The target package resolves the correct tenant object without overwriting unrelated definitions.
Explanation
Correct Answer
B:This measurement directly checks shared address object control. The proper intervention is to create an approved reusable ADOM address object and reference it consistently in relevant packages. a managed shared object reduces drift when its defined value is intended across multiple policies. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: address group membership. It cannot confirm shared address object control, whose proper evidence is that package previews resolve the object consistently and test DNS access to the intended service.
C:An observation about security profile reuse can be true while the original incident remains unresolved. The required evidence must address ten branch policies use different literal IPs for the same corporate DNS service.
D:This would validate object scope before cross-adom copy, not shared address object control. For this change the relevant acceptance criterion is that package previews resolve the object consistently and test DNS access to the intended service.
Question 432
The central policy owner is challenged after discovering that ten branch policies use different literal IPs for the same corporate DNS service. Which misleading claim creates the greatest risk?
- An ADOM object name automatically overrides every conflicting local object without install validation.
- Any zero-hit firewall policy is always unnecessary for emergency or seasonal traffic.
- Copying raw IP text into every firewall rule provides the same centralized object governance.
- Adding a section header automatically changes traffic-matching precedence.
Explanation
Correct Answer
C:This is the invalid assumption for shared address object control. A managed shared object reduces drift when its defined value is intended across multiple policies. It creates a risk because the proper action is to create an approved reusable ADOM address object and reference it consistently in relevant packages.
Incorrect Answers
A:This is an unsafe assumption about fortigate-specific object mapping, but it is not the most directly relevant misconception for shared address object control. a managed shared object reduces drift when its defined value is intended across multiple policies.
B:That incorrect belief could cause problems for policy hit-count interpretation. Here the direct trap is copying raw IP text into every firewall rule provides the same centralized object governance.
D:The quoted shortcut concerns policy section organization; the stated case instead hinges on a different false premise about shared address object control. copying raw IP text into every firewall rule provides the same centralized object governance.
Question 433
At Pinecrest Energy, the team reports that the object database contains retired address definitions and deleting one might break historical policy references. Which configuration or recovery action is appropriate?
- Check object usage and policy references before retiring an apparently unused object.
- Inspect rule-order matching and overlapping predicates, then reposition or narrow the competing policy.
- Define authorized ADOM-level metadata variables or mappings and verify device-specific resolution.
- Associate the package with the intended managed FortiGate installation targets before installing.
Explanation
Correct Answer
A:This problem involves unused object cleanup. An object may be referenced indirectly and removal must be based on actual dependencies. The targeted response is to check object usage and policy references before retiring an apparently unused object. Success is evidenced when usage search shows no live policy references and installation preview has no missing objects.
Incorrect Answers
B:That response relates to policy shadowing diagnosis. It would not directly resolve the reported case: the object database contains retired address definitions and deleting one might break historical policy references. The required change has a different scope.
C:This is a valid operational idea for adom metadata variables, but it does not establish the expected result for unused object cleanup: usage search shows no live policy references and installation preview has no missing objects.
D:That action is intended for package assignment versus saving, not the specified unused object cleanup condition. Here, check object usage and policy references before retiring an apparently unused object.
Question 434
An operations reviewer notes that the object database contains retired address definitions and deleting one might break historical policy references at Ironwood Media. Which explanation most directly accounts for the problem?
- A common package can still require device-specific target selection for individual rules.
- An object may be referenced indirectly and removal must be based on actual dependencies.
- High-impact exceptions require accountable provenance in addition to technically valid match fields.
- The interface may hide supported management features until explicitly enabled.
Explanation
Correct Answer
B:An object may be referenced indirectly and removal must be based on actual dependencies. For this operating condition, the corrective action is to check object usage and policy references before retiring an apparently unused object. Verify that usage search shows no live policy references and installation preview has no missing objects.
Incorrect Answers
A:That explanation applies to policy target scope. The distinction in the presented situation is an object may be referenced indirectly and removal must be based on actual dependencies.
C:The concept is relevant to policy comment provenance but would not explain unused object cleanup. Here, an object may be referenced indirectly and removal must be based on actual dependencies.
D:The stated mechanism covers policy feature visibility, a related but different manager task. It does not explain why the object database contains retired address definitions and deleting one might break historical policy references.
Question 435
The audit reviewer must close an incident where the object database contains retired address definitions and deleting one might break historical policy references. Which verification result is most direct?
- The target list shows the approved serials and the install task applies the package to those devices.
- Target preview and running configuration show one intended service definition after reconciliation.
- Usage search shows no live policy references and installation preview has no missing objects.
- Policy references point to the retained authorized object after a clean package install.
Explanation
Correct Answer
C:This measurement directly checks unused object cleanup. The proper intervention is to check object usage and policy references before retiring an apparently unused object. an object may be referenced indirectly and removal must be based on actual dependencies. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: package assignment versus saving. It cannot confirm unused object cleanup, whose proper evidence is that usage search shows no live policy references and installation preview has no missing objects.
B:An observation about fortigate-specific object mapping can be true while the original incident remains unresolved. The required evidence must address the object database contains retired address definitions and deleting one might break historical policy references.
D:This would validate duplicate object reconciliation, not unused object cleanup. For this change the relevant acceptance criterion is that usage search shows no live policy references and installation preview has no missing objects.
Question 436
At Pinecrest Energy, the object database contains retired address definitions and deleting one might break historical policy references. Which assumption should an engineer specifically reject?
- All rules inside a shared policy package must be installed to every device regardless of per-policy target settings.
- Describing an exception as temporary in its comment causes FortiGate to expire it automatically.
- Adding a section header automatically changes traffic-matching precedence.
- An object with an old creation date is always unused and safe to delete.
Explanation
Correct Answer
D:This is the invalid assumption for unused object cleanup. An object may be referenced indirectly and removal must be based on actual dependencies. It creates a risk because the proper action is to check object usage and policy references before retiring an apparently unused object.
Incorrect Answers
A:That incorrect belief could cause problems for policy target scope. Here the direct trap is an object with an old creation date is always unused and safe to delete.
B:The quoted shortcut concerns policy schedule objects; the stated case instead hinges on a different false premise about unused object cleanup. an object with an old creation date is always unused and safe to delete.
C:This is an unsafe assumption about policy section organization, but it is not the most directly relevant misconception for unused object cleanup. an object may be referenced indirectly and removal must be based on actual dependencies.
Question 437
During the FortiManager change review for Bridgewater Insurance, two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews. Which response best fits the requirement?
- Check FortiManager feature-visibility settings and relevant ADOM/device compatibility.
- Identify duplicate object definitions and consolidate approved references through a controlled change.
- Reconcile the object ownership and install-time mapping for that target instead of blindly overwriting either definition.
- Bind the approved time schedule to the exception rule and verify device time synchronization.
Explanation
Correct Answer
B:This problem involves duplicate object reconciliation. Duplicate definitions can obscure consistency even when their current values match. The targeted response is to identify duplicate object definitions and consolidate approved references through a controlled change. Success is evidenced when policy references point to the retained authorized object after a clean package install.
Incorrect Answers
A:This is a valid operational idea for policy feature visibility, but it does not establish the expected result for duplicate object reconciliation: policy references point to the retained authorized object after a clean package install.
C:That response relates to fortigate-specific object mapping. It would not directly resolve the reported case: two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews. The required change has a different scope.
D:That action is intended for policy schedule objects, not the specified duplicate object reconciliation condition. Here, identify duplicate object definitions and consolidate approved references through a controlled change.
Question 438
The security operations analyst investigates a case where two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews. Which FortiManager principle governs the decision?
- The centralized ADOM package is intended desired state for managed policy when FortiManager owns configuration.
- Policy block constructs support reuse without treating a standalone rule copy as a synchronized component.
- Duplicate definitions can obscure consistency even when their current values match.
- Policy validity depends on referenced objects existing in the correct ADOM database.
Explanation
Correct Answer
C:Duplicate definitions can obscure consistency even when their current values match. For this operating condition, the corrective action is to identify duplicate object definitions and consolidate approved references through a controlled change. Verify that policy references point to the retained authorized object after a clean package install.
Incorrect Answers
A:That explanation applies to central policy package authority. The distinction in the presented situation is duplicate definitions can obscure consistency even when their current values match.
B:The concept is relevant to policy block reuse but would not explain duplicate object reconciliation. Here, duplicate definitions can obscure consistency even when their current values match.
D:The stated mechanism covers policy package validation, a related but different manager task. It does not explain why two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews.
Question 439
After resolving a case where two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews at Clearview Services, which observation BEST establishes the remediation worked?
- The firewall permits the maintenance flow only in the approved period after installation.
- The target list shows the approved serials and the install task applies the package to those devices.
- A change to the reviewed block resolves consistently in every intentionally associated package.
- Policy references point to the retained authorized object after a clean package install.
Explanation
Correct Answer
D:This measurement directly checks duplicate object reconciliation. The proper intervention is to identify duplicate object definitions and consolidate approved references through a controlled change. duplicate definitions can obscure consistency even when their current values match. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: policy schedule objects. It cannot confirm duplicate object reconciliation, whose proper evidence is that policy references point to the retained authorized object after a clean package install.
B:This would validate package assignment versus saving, not duplicate object reconciliation. For this change the relevant acceptance criterion is that policy references point to the retained authorized object after a clean package install.
C:An observation about policy block reuse can be true while the original incident remains unresolved. The required evidence must address two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews.
Question 440
At Bridgewater Insurance, the runbook says that two objects in the same ADOM represent the same subnet under different names and cause inconsistent policy reviews. Which false assumption should be removed before approval?
- Different object names always imply materially different networks.
- Policy-package text always substitutes local site values without configuring any variable.
- An address group can reference a deleted member indefinitely with no installation impact.
- Local firewall rules always override centrally installed package contents.
Explanation
Correct Answer
A:This is the invalid assumption for duplicate object reconciliation. Duplicate definitions can obscure consistency even when their current values match. It creates a risk because the proper action is to identify duplicate object definitions and consolidate approved references through a controlled change.
Incorrect Answers
B:This is an unsafe assumption about adom metadata variables, but it is not the most directly relevant misconception for duplicate object reconciliation. duplicate definitions can obscure consistency even when their current values match.
C:The quoted shortcut concerns firewall object dependency chain; the stated case instead hinges on a different false premise about duplicate object reconciliation. different object names always imply materially different networks.
D:That incorrect belief could cause problems for central policy package authority. Here the direct trap is different object names always imply materially different networks.