Fortinet FCP_FMG_AD-7.6 Practice Test 47
Question 460
At Ironwood Media, the runbook says that a policy install fails because a referenced service object was deleted after package editing. Which false assumption should be removed before approval?
- A shared ADOM object must always resolve to the same site IP at every branch.
- Restarting FortiManager automatically recreates deleted policy dependencies.
- Describing an exception as temporary in its comment causes FortiGate to expire it automatically.
- Changing an address group description removes stale network members from enforcement.
Explanation
Correct Answer
B:This is the invalid assumption for policy package validation. Policy validity depends on referenced objects existing in the correct ADOM database. It creates a risk because the proper action is to run policy and object consistency checks and repair unresolved references before installation.
Incorrect Answers
A:That incorrect belief could cause problems for dynamic address object resolution. Here the direct trap is restarting FortiManager automatically recreates deleted policy dependencies.
C:This is an unsafe assumption about policy schedule objects, but it is not the most directly relevant misconception for policy package validation. policy validity depends on referenced objects existing in the correct ADOM database.
D:The quoted shortcut concerns address group membership; the stated case instead hinges on a different false premise about policy package validation. restarting FortiManager automatically recreates deleted policy dependencies.
Question 461
A change approver at Harborview Bank finds that a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch. What should be done first to correct the stated deficiency?
- Evaluate FortiManager policy blocks or a supported shared design with documented placement.
- Create an approved reusable ADOM address object and reference it consistently in relevant packages.
- Review and correct the address group members in the managed ADOM object database.
- Define authorized ADOM-level metadata variables or mappings and verify device-specific resolution.
Explanation
Correct Answer
D:This problem involves adom metadata variables. Metadata variables can parameterize supported fields in a controlled centralized deployment. The targeted response is to define authorized ADOM-level metadata variables or mappings and verify device-specific resolution. Success is evidenced when installation preview shows each target receiving its approved variable value.
Incorrect Answers
A:That response relates to policy block reuse. It would not directly resolve the reported case: a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch. The required change has a different scope.
B:This is a valid operational idea for shared address object control, but it does not establish the expected result for adom metadata variables: installation preview shows each target receiving its approved variable value.
C:That action is intended for address group membership, not the specified adom metadata variables condition. Here, define authorized ADOM-level metadata variables or mappings and verify device-specific resolution.
Question 462
At Clearview Services, a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch. Which technical explanation BEST describes why the proposed approach is deficient?
- Metadata variables can parameterize supported fields in a controlled centralized deployment.
- The centralized ADOM package is intended desired state for managed policy when FortiManager owns configuration.
- The interface may hide supported management features until explicitly enabled.
- A common package can still require device-specific target selection for individual rules.
Explanation
Correct Answer
A:Metadata variables can parameterize supported fields in a controlled centralized deployment. For this operating condition, the corrective action is to define authorized ADOM-level metadata variables or mappings and verify device-specific resolution. Verify that installation preview shows each target receiving its approved variable value.
Incorrect Answers
B:The concept is relevant to central policy package authority but would not explain adom metadata variables. Here, metadata variables can parameterize supported fields in a controlled centralized deployment.
C:That explanation applies to policy feature visibility. The distinction in the presented situation is metadata variables can parameterize supported fields in a controlled centralized deployment.
D:The stated mechanism covers policy target scope, a related but different manager task. It does not explain why a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch.
Question 463
At Bridgewater Insurance, engineers have treated a fault where a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch. Which outcome proves the intended management state?
- Preinstall validation reports no missing service object and target install completes cleanly.
- Installation preview shows each target receiving its approved variable value.
- Per-device install preview resolves each normalized interface to the intended physical interface.
- The required object type becomes visible to an authorized administrator without changing its device firmware.
Explanation
Correct Answer
B:This measurement directly checks adom metadata variables. The proper intervention is to define authorized ADOM-level metadata variables or mappings and verify device-specific resolution. metadata variables can parameterize supported fields in a controlled centralized deployment. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:The proposed test targets a different area: policy package validation. It cannot confirm adom metadata variables, whose proper evidence is that installation preview shows each target receiving its approved variable value.
C:An observation about normalized interface mapping can be true while the original incident remains unresolved. The required evidence must address a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch.
D:This would validate policy feature visibility, not adom metadata variables. For this change the relevant acceptance criterion is that installation preview shows each target receiving its approved variable value.
Question 464
During review of a proposed correction at Harborview Bank, a shared firewall policy needs a site identifier in a supported configuration field but the team hardcodes the same value for every branch. Which unsupported belief could leave the fault unresolved?
- Changing an address group description removes stale network members from enforcement.
- Any zero-hit firewall policy is always unnecessary for emergency or seasonal traffic.
- Policy-package text always substitutes local site values without configuring any variable.
- An unseen rule in a filtered table is definitely absent from the FortiManager database.
Explanation
Correct Answer
C:This is the invalid assumption for adom metadata variables. Metadata variables can parameterize supported fields in a controlled centralized deployment. It creates a risk because the proper action is to define authorized ADOM-level metadata variables or mappings and verify device-specific resolution.
Incorrect Answers
A:This is an unsafe assumption about address group membership, but it is not the most directly relevant misconception for adom metadata variables. metadata variables can parameterize supported fields in a controlled centralized deployment.
B:That incorrect belief could cause problems for policy hit-count interpretation. Here the direct trap is policy-package text always substitutes local site values without configuring any variable.
D:The quoted shortcut concerns policy search and filtered views; the stated case instead hinges on a different false premise about adom metadata variables. policy-package text always substitutes local site values without configuring any variable.
Question 465
At Meridian Telecom, an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately. Which operational step MOST directly addresses this particular problem?
- Refresh and interpret policy hit counts with a relevant observation window and business-owner review.
- Associate the package with the intended managed FortiGate installation targets before installing.
- Use supported fine-grained policy locking or workspace control appropriate to the manager mode.
- Create an approved reusable ADOM address object and reference it consistently in relevant packages.
Explanation
Correct Answer
A:This problem involves policy hit-count interpretation. Observed traffic counts are time-window evidence and do not establish business purpose on their own. The targeted response is to refresh and interpret policy hit counts with a relevant observation window and business-owner review. Success is evidenced when an approved removal change includes coverage period, owner confirmation and monitored postchange behavior.
Incorrect Answers
B:This is a valid operational idea for package assignment versus saving, but it does not establish the expected result for policy hit-count interpretation: an approved removal change includes coverage period, owner confirmation and monitored postchange behavior.
C:That response relates to per-policy lock governance. It would not directly resolve the reported case: an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately. The required change has a different scope.
D:That action is intended for shared address object control, not the specified policy hit-count interpretation condition. Here, refresh and interpret policy hit counts with a relevant observation window and business-owner review.
Question 466
At Coastal Rail, a junior operator asks why the fix is needed when an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately. Which explanation is the most defensible?
- Firewall policy permission relies on the service object's actual protocol and port definition.
- Observed traffic counts are time-window evidence and do not establish business purpose on their own.
- Normalized interfaces let common policy logic target device-specific physical interface names.
- Name collisions can cause unexpected references or rejected imports when object values diverge.
Explanation
Correct Answer
B:Observed traffic counts are time-window evidence and do not establish business purpose on their own. For this operating condition, the corrective action is to refresh and interpret policy hit counts with a relevant observation window and business-owner review. Verify that an approved removal change includes coverage period, owner confirmation and monitored postchange behavior.
Incorrect Answers
A:The concept is relevant to service object port accuracy but would not explain policy hit-count interpretation. Here, observed traffic counts are time-window evidence and do not establish business purpose on their own.
C:The stated mechanism covers normalized interface mapping, a related but different manager task. It does not explain why an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately.
D:That explanation applies to policy object collision after import. The distinction in the presented situation is observed traffic counts are time-window evidence and do not establish business purpose on their own.
Question 467
During postchange verification at Bayridge Hotels, an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately. Which test outcome is the strongest sign of success?
- Postinstall traffic tests show approved networks match and removed subnets are denied.
- An install task and device-level comparison confirm the changed policy reached its intended target.
- An approved removal change includes coverage period, owner confirmation and monitored postchange behavior.
- A change to the reviewed block resolves consistently in every intentionally associated package.
Explanation
Correct Answer
C:This measurement directly checks policy hit-count interpretation. The proper intervention is to refresh and interpret policy hit counts with a relevant observation window and business-owner review. observed traffic counts are time-window evidence and do not establish business purpose on their own. Merely seeing a task start is weaker evidence.
Incorrect Answers
A:An observation about address group membership can be true while the original incident remains unresolved. The required evidence must address an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately.
B:The proposed test targets a different area: device package status interpretation. It cannot confirm policy hit-count interpretation, whose proper evidence is that an approved removal change includes coverage period, owner confirmation and monitored postchange behavior.
D:This would validate policy block reuse, not policy hit-count interpretation. For this change the relevant acceptance criterion is that an approved removal change includes coverage period, owner confirmation and monitored postchange behavior.
Question 468
In a peer review for Meridian Telecom, an unused-rule cleanup project treats a zero hit count as proof that a security rule can be deleted immediately. Which shortcut is inconsistent with FortiManager behavior?
- A deny rule always takes priority regardless of its position in the installed package.
- Identical logical policy interfaces require identical hardware interface names on every FortiGate.
- Policy-package text always substitutes local site values without configuring any variable.
- Any zero-hit firewall policy is always unnecessary for emergency or seasonal traffic.
Explanation
Correct Answer
D:This is the invalid assumption for policy hit-count interpretation. Observed traffic counts are time-window evidence and do not establish business purpose on their own. It creates a risk because the proper action is to refresh and interpret policy hit counts with a relevant observation window and business-owner review.
Incorrect Answers
A:That incorrect belief could cause problems for policy ordering principle. Here the direct trap is any zero-hit firewall policy is always unnecessary for emergency or seasonal traffic.
B:This is an unsafe assumption about normalized interface mapping, but it is not the most directly relevant misconception for policy hit-count interpretation. observed traffic counts are time-window evidence and do not establish business purpose on their own.
C:The quoted shortcut concerns adom metadata variables; the stated case instead hinges on a different false premise about policy hit-count interpretation. any zero-hit firewall policy is always unnecessary for emergency or seasonal traffic.
Question 469
During an approved branch rollout review at Pinecrest Energy, several branch policies reference slightly different antivirus profiles even though central protection requirements are the same. What should be changed to resolve the exposure?
- Verify application ports and update the managed service object before reinstalling the package.
- Standardize the approved security profile object and update package references intentionally.
- Bind the approved time schedule to the exception rule and verify device time synchronization.
- Review rule sequence and move the specific control to the intended order before deployment.
Explanation
Correct Answer
B:This problem involves security profile reuse. Central policy-object management enables consistent inspection settings but changes must still be installed. The targeted response is to standardize the approved security profile object and update package references intentionally. Success is evidenced when postinstall settings show the approved profile on the intended set of security rules.
Incorrect Answers
A:This is a valid operational idea for service object port accuracy, but it does not establish the expected result for security profile reuse: postinstall settings show the approved profile on the intended set of security rules.
C:That response relates to policy schedule objects. It would not directly resolve the reported case: several branch policies reference slightly different antivirus profiles even though central protection requirements are the same. The required change has a different scope.
D:That action is intended for policy ordering principle, not the specified security profile reuse condition. Here, standardize the approved security profile object and update package references intentionally.
Question 470
During architecture validation after a central manager service alert, several branch policies reference slightly different antivirus profiles even though central protection requirements are the same. What underlying mechanism matters most?
- A policy package depends on nested object references and a missing child can block installation.
- Normalized interfaces let common policy logic target device-specific physical interface names.
- Central policy-object management enables consistent inspection settings but changes must still be installed.
- Central and local object representations must agree for predictable package installation.
Explanation
Correct Answer
C:Central policy-object management enables consistent inspection settings but changes must still be installed. For this operating condition, the corrective action is to standardize the approved security profile object and update package references intentionally. Verify that postinstall settings show the approved profile on the intended set of security rules.
Incorrect Answers
A:That explanation applies to firewall object dependency chain. The distinction in the presented situation is central policy-object management enables consistent inspection settings but changes must still be installed.
B:The stated mechanism covers normalized interface mapping, a related but different manager task. It does not explain why several branch policies reference slightly different antivirus profiles even though central protection requirements are the same.
D:The concept is relevant to fortigate-specific object mapping but would not explain security profile reuse. Here, central policy-object management enables consistent inspection settings but changes must still be installed.