Fortinet Certified Professional - FortiManager 7.4 Administrator Free Sample Questions

In FortiManager's workflow mode, the approver's role is to validate the submitted changes. If an error is found, the correct procedure is to reject the session and provide comments. This sends the session back to the original administrator who can then repair the session by correcting the error and resubmitting it for approval. Approving a session with a known error violates the principle of change control. Approvers cannot directly edit or repair sessions submitted by others.

For Zero Touch Provisioning (ZTP) to automatically install configurations, including policy packages, the 'auto-link' setting must be enabled within the device blueprint. This setting instructs FortiManager to automatically run the installation process for assigned templates and policy packages after the device successfully registers. If it is disabled, the device will be added to FortiManager but will require a manual installation task to be initiated.

When creating a user identity-based firewall policy, you must specify both the source user/group and the source address. The FSSO user group object identifies the authenticated user, while the firewall address object (often 'all' or a specific subnet) defines the network location from which the user's traffic originates. Both are required for the policy to function correctly.

False. FortiManager can operate as a local FortiGuard Distribution Server (FDS) in a closed or air-gapped network. An administrator can use a separate FortiManager with internet access to download FortiGuard packages, export them to a removable media, and then import them into the closed-network FortiManager. This allows the air-gapped FortiManager to provide FortiGuard updates to its managed devices.

When a device's configuration state is 'Modified', it means the running configuration on the FortiGate differs from what FortiManager has in its database for that device. To enforce FortiManager's configuration and overwrite the local changes, the administrator must perform an installation. Using the Install Wizard and selecting 'Install Device Settings' will push the configuration from the FortiManager device database to the FortiGate, resolving the 'Modified' state and ensuring consistency.

The Global ADOM is designed for this purpose. By creating a global policy package and defining rules within the 'Header Policy' section, these rules are enforced at the top of the policy table for all ADOMs that use this global package. Building IT staff can then add their own rules in the ADOM-level policy package, which will be evaluated after the centrally-controlled header policies. This maintains central control while allowing for local flexibility.

FortiManager HA synchronization relies on a secure channel established between the cluster members. A common cause for synchronization failure is a mismatch in the HA configuration itself. The primary unit must be configured with the correct peer IP address of the secondary unit and a shared HA password. The secondary unit must have the same HA password configured. Any discrepancy in these settings will prevent the secure channel from being established, leading to sync failures.

The Script History page provides detailed logs for each script execution. For failed tasks, it shows the specific device, the time of failure, and often a response from the device indicating the reason for the failure (e.g., command not found, invalid parameter, permission denied). This is the most direct and informative first step for troubleshooting script execution issues.

An ADOM revision is a snapshot of the ADOM's database at a specific moment. This includes all policy packages, objects, and settings within that ADOM. It serves as a backup and a restore point, allowing an administrator to revert the entire ADOM configuration to a previous known-good state if necessary.

FortiManager provides granular permissions within administrator profiles. To limit access to a specific function like WAF policy management, a custom profile should be created. The administrator can then navigate to the 'Policy & Objects' section of the permissions and set the access level for 'Security Profiles - WAF Profile' to 'Read-Write' while setting other unrelated permissions to 'None'. This ensures the team can only see and manage the specific components relevant to their job.