Free and Premium Fortinet NSE6_FMG_AD-7.6 Dumps Questions Answers

The correct answers are A and C. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “FortiManager creates a configuration revision when: FortiGate is added to FortiManager, Device changes are installed from FortiManager, FortiGate configuration is retrieved from FortiManager, A local change on FortiGate causes an automatic update”.

This exactly proves A, because device changes are installed from FortiManager, and C, because a local change on FortiGate causes an automatic update. The guide also states: “By default, all changes made on a managed FortiGate device are automatically updated on FortiManager and reflected in revision history”.

B and D only modify the FortiManager device-level database status to Modified. They do not, by themselves, create a new revision history until an install, retrieve, or auto-update occurs.

The correct answer is C. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “If you need to move a device from one ADOM to another, run the Import Configuration wizard to import the policy package into the new ADOM.” It also states: “When you move devices from one ADOM to another ADOM, shared policy packages and objects do not move to the new ADOM. You will need to import policy packages from managed devices.”

That is exactly why the administrator cannot see the policy and object configuration after the move: the device itself moved, but its shared policy package and objects did not automatically move with it. The required corrective action is to manually import the policy package into the new ADOM using Import Configuration. Options A, B, and D are not the documented remedy in the uploaded FortiManager sources.

=========

The correct answer is D. The FortiManager 7.6 Administrator Study Guide gives the exact extract under Web Filter and Email Filter: “fgdlinkd — Responsible for downloading web filter and email filter databases”. The same study guide section explains that the execute top command displays real-time CPU and RAM usage, and the %MEM column shows the memory percentage used by each process.

In the exhibit, the line for fgdlinkd shows %MEM 2.9. Therefore, the process responsible for downloading the web and email filter databases is using 2.9% of RAM. That matches option D exactly. The other values belong to different processes, such as fgdsvr and other FortiGuard-related daemons, but not the downloader process identified in the study guide.

=========

The correct answer is B. The LAN address object shown in the exhibit has a default value of 10.0.0.0/255.255.255.0, and it has per-device mappings only for BR1-FGT-1, HQ-NGFW-1, and Local-Firewall. There is no per-device mapping entry for Remote-Firewall.

The FortiManager 7.6 Administrator Study Guide gives the exact rule for this behavior: “The devices in the ADOM that do not have a dynamic mapping for LAN have a default value”. The same page also explains that dynamic objects let you map one logical object to unique values per device, but devices without a mapping use the object’s default definition.

Since Remote-Firewall is not listed in the Per-Device Mapping table, it inherits the default LAN value: 10.0.0.0/255.255.255.0.

=========

If a BGP template is assigned to the FortiGate device on FortiManager, device-level BGP configurations made directly in the device-level database are overridden by the template settings, so the changes do not get pushed to the device.

The correct answers are A and E. The study guide explicitly states under Database Integrity that scheduled backups “Automatically executes database integrity commands” and “Does not automatically make corrections”. That exactly verifies A.

It also states in Best Practices—Database Integrity: “Always follow the proper upgrade path” and “If you don’t, it may cause inconsistencies in the database.” That exactly verifies E.

B is incorrect because diagnose dvm check-integrity verifies and corrects device manager database issues such as device states, memberships, lock statuses, and duplicate VDOM entries, not a corrupted file system. C is incorrect because locked device status issues are listed under diagnose dvm check-integrity, not diagnose cdb check adom-integrity. D is not a stated FortiManager best practice in the uploaded guide.

The correct answers are B and C. The FortiManager 7.6 Administrator Study Guide explicitly states: “Scripts that you run directly on remote devices also cause automatic updates and create a revision history.” This exact extract proves both results: FortiManager creates a new revision history and the device status becomes Auto-Updated, meaning the FortiGate change is automatically reflected in the FortiManager device-level database.

The lab guide also distinguishes this from database-targeted scripts by stating: “You must perform an installation if you run a script on a device database, policy package, or ADOM database.” That wording excludes Remote FortiGate Directly via CLI, so D is incorrect.

A is also incorrect because direct remote execution does not use the install preview workflow; preview and validation are tied to Install Wizard operations, not direct CLI execution.

=========

FortiManager helps with mass provisioning by using templates that allow administrators to configure the same settings on multiple FortiGate devices simultaneously, streamlining deployment and management.

The FortiManager 7.6 Administrator Study Guide states that global policies must be explicitly assigned: “You must explicitly assign global policy packages to specific ADOMs,” and FortiManager can also target specific policy packages in individual ADOMs. The lab guide confirms that assignment is performed from the Global Database ADOM: the administrator selects Global Database ADOM, clicks Assignment, adds the ADOM, chooses Specify Policy Packages To Assign, selects the target package, and then clicks Assign.

So creating a new policy package inside ADOM1 does not automatically inherit the existing global package assignment. It also does not automatically install policies. The administrator must go back to the global ADOM and assign the global policy package to that new local policy package.

The correct answer is D. In FortiManager HA manual mode, the study guide explains what happens when members change: if the primary fails, you must manually promote a secondary and repoint the others, but that is not this scenario. For a failed secondary, the relevant exact extract is: “if you remove a secondary member from the HA configuration, the primary FortiManager removes the secondary serial number from the central management configuration of FortiGate, and updates the managed FortiGate devices immediately.”

Operationally, in the HA configuration, removing that failed secondary means deleting its HA peer entry from the primary, which corresponds to removing the failed device’s peer IP. A is false because manual HA is not transparent in this case. B is only a diagnostic detail. C applies when the primary fails, not a secondary.

=========

The import report clearly shows: " firewall profile-protocol-options " , SKIPPED, " (name=default, oid=3491, DUPLICATE) " . In FortiManager import reporting, SKIPPED means the object was not imported or updated, and DUPLICATE means an object with that identity already exists in the ADOM database. So FortiManager did not update its database with the imported value for the object default, which makes C correct.

The lab guide reinforces this behavior in the conflict-handling workflow. It explains that during import, FortiManager checks for duplicate names and conflicts, and for conflicting objects the administrator may need to choose whether to keep the value from FortiGate or FortiManager. For the default Firewall Profile-Protocol-Options object, the guide specifically discusses keeping the existing FortiManager value to avoid unnecessary changes.

=========

Running the script through the policy package or ADOM database method allows FortiManager to properly interpret object relationships and dependencies in the IPsec configuration, preventing object mismatch errors when pushing complex VPN settings directly via CLI.

When a script is run using Remote FortiGate Directly via CLI, FortiManager sends the commands straight to the FortiGate and does not preview or validate dependent objects first. The study guide also explains that scripts containing ADOM-level objects or dynamic mappings must be executed on the Policy Package or ADOM Database, then installed through the installation workflow. That matches this IPsec error scenario, where phase2-interface is referencing an object relationship that FortiManager cannot properly validate in direct CLI mode. Therefore, the administrator should run the script on the policy package or ADOM database method, then install it.

Option A addresses only one possible syntax issue. B is a valid deployment approach in general, but it is not what the question asks as the direct fix for this script execution error. C is incorrect and would not resolve the object dependency mismatch.

The correct answer is B because FortiManager supports ADOM-level metadata variables in scripts and templates. The study guide explicitly states that meta fields cannot be used as variables in scripts or provisioning templates; instead, you must use ADOM-level metadata variables. It further says these variables can be used in templates, and their values can be mapped depending on the device where the template is applied.

That makes metadata variables the proper method for handling per-device differences such as whether a FortiGate should use a LAN or WAN source interface for FortiAnalyzer communication. A is wrong because per-device dynamic objects apply to objects like addresses and VIPs, not template interface selection. D is wrong because meta fields are comments/attributes, not template variables. C could work operationally, but it is not the FortiManager feature intended for this use case.

=========

The best conclusion is A. From the exhibit, B is clearly incorrect because policy sequence #1 Ping_Access is targeted to ISFW root and ISFW Student, not to root NAT and Trainer NAT. Also, C is incorrect because FortiManager allows a rule to inherit Installation Targets. The study guide explains that a policy package can target one or more devices or VDOMs, and the Install On column is used only for per-rule exceptions in a shared policy package. A rule does not need explicit devices listed if it is meant to apply to the package’s installation targets.

D is also incorrect because global header policies are created in the Global Database ADOM and placed at the top only when a global package is assigned. The exhibit shows a shared policy package, not a global ADOM header-policy assignment.

=========

The correct answer is C. The FortiManager 7.6 Administrator Study Guide explicitly says: “You must explicitly assign global policy packages to specific ADOMs” and “you can even pick specific policy packages in individual ADOMs that you want to apply the global policies to.” The study guide also explains the assignment workflow: “This slide shows the steps to assign a global policy package to an ADOM policy package” and “First, add the required ADOMs as targets. Second, assign the global policy package to the ADOMs.”

Because Remotes is a newly created policy package, it does not inherit the earlier assignment automatically. The administrator must explicitly assign the Training global policy package to the Remotes policy package. Automatic install does not create that assignment, and unassigning all packages is unnecessary.

Using the Install Wizard is the recommended method to reinstall the central policy package on the BR1-FGT-1 firewall, ensuring all settings, installation targets, and dependencies are correctly processed during installation.

The correct answer is C. The uploaded FortiManager 7.6 Administrator Lab Guide gives the exact extract: “FortiManager will update the universally unique identifiers (UUID) without deleting other configurations” and “UUIDs on both FortiGate and FortiManager are critical for ensuring the unique identification, consistency, and correct management of firewall policies across multiple devices and configurations. They provide a reliable and immutable reference for policies.”

The same source also shows administrators enabling UUIDs in Traffic Log on FortiGate log settings, which supports the logging and policy-correlation use case with FortiAnalyzer/FortiManager.

So the attribute that improves policy identification and logging correlation is the Universally Unique Identifier, not Policy ID, Log ID, or Sequence ID.

=========

The correct answer is A. This conclusion comes from the HA settings shown in the exhibit plus Fortinet’s HA behavior. In the exhibit, HQ-NGFW-1 has memory-based-failover enabled, memory-failover-threshold 70, memory-failover-monitor-period 50, and its memory usage is about 90%, while HQ-NGFW-2 is about 48.7%. Fortinet’s official documentation states that memory-failover-threshold is the memory percentage that triggers failover, and memory-failover-monitor-period is the duration high memory must persist before failover occurs. It also states that if utilization stays above the threshold for the entire monitor period, a failover is triggered, and the peer becomes primary. (Fortinet Document Library)

Because the condition was observed for 55 seconds, which is longer than the configured 50-second monitor period, the cluster would fail over from HQ-NGFW-1 to HQ-NGFW-2 due to the memory-failover-threshold condition. The priority setting does not explain this result here, because override is disabled, and flip-timeout governs subsequent memory-based failovers, not the initial trigger. (Fortinet Document Library)

=========

The configuration includes a server-list with server-type set to " update rating, " which enables FortiGate HQ-NGFW-1 to contact FortiManager as a FortiGuard Distribution Server (FDS) for FortiGuard updates.

The installation includes a root_CA3 certificate, which FortiManager will install on FortiGate HQ-NGFW-1 to authenticate FGFM tunnel connections between the devices.