FORTINET-NSE56 Nse5 Fortimanager Operations — 25 Questions

Question 1

Which TWO conditions must be met to successfully use an 'Install Config' wizard for device-level settings?

Accepted Answer

The configuration database must be synchronized.. Option C is correct because the Install Config wizard pushes device-level settings from the management server's configuration database, so that database must be synchronized with the device's current configuration to avoid conflicts or failed commits. Option D is correct because the target device must be in an 'up' state (reachable and operational) for the wizard to establish the management connection and apply the configuration successfully. Option A is not required, since the wizard works with supported firmware versions rather than only the latest. Option B is not required, as existing policies do not need to be deleted before running the wizard. Option E is not required, because 'backup' mode is not a prerequisite for installing configuration.

Answer

The device must be running the latest firmware.

Answer

All policies must be deleted.

Answer

The device must be in 'backup' mode.

Question 2

When using 'Provisioning Templates', which setting allows you to automatically apply CLI commands to new devices as soon as they are added to the FortiManager?

Accepted Answer

Device Templates. Device Templates in Provisioning Templates allow administrators to define CLI commands or configurations that are automatically applied to new devices when they are added to FortiManager. This enables zero-touch provisioning by pushing baseline settings such as admin passwords, DNS, and logging configuration as soon as the device registers.

Answer

Auto-Link

Answer

ADOM Policies

Answer

Install On Install

Question 3

A FortiManager administrator needs to migrate an existing local FortiGate policy into a shared policy package. Which process must be followed?

Accepted Answer

Use the Policy Import tool to move to Global ADOM. FortiManager's Policy Import tool (also called the 'Import Policy' wizard) is the supported mechanism to pull an existing local FortiGate policy into a shared policy package or Global ADOM. It reads the device's current policy configuration and maps it into FortiManager's policy/object database so it can be managed centrally. Manually recreating or re-importing the whole config is not the correct migration path.

Answer

Manually re-import the config

Answer

Disable policy management

Answer

Delete local policy and recreate

Question 4

Which THREE steps are required to implement a new firewall policy using the FortiManager workflow mode?

Accepted Answer

Submit the request for approval.. In FortiManager workflow mode, implementing a new firewall policy requires creating a new policy package (D), since workflow mode enforces a structured change process where policies are built in a package before being pushed to managed FortiGates. Once the package and its policies are defined, the administrator must submit the request for approval (B), which places the change into the approval queue rather than installing it immediately. A designated approver must then approve the request (C), after which the policy package can be installed on the target FortiGate devices. Deleting the original policy (A) is not required, as workflow mode handles policy changes through the package lifecycle rather than forcing deletion of existing policies. Rebooting the FortiGate (E) is never part of the FortiManager workflow process, since policy installation does not require a device reboot.

Answer

Delete the original policy.

Answer

Reboot the FortiGate.

Question 5

Which CLI command is used on a FortiGate to set the central management IP to the FortiManager?

Accepted Answer

config system central-management. The command 'set central-mgmt' is used to define the FortiManager IP address for centralized management.

Answer

set fortimanager-ip

Answer

set remote-log-server

Answer

set manager-address

Question 6

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

FMG protocol.. FortiManager communicates with managed FortiGate devices using the FortiManager (FMG) protocol, a proprietary Fortinet protocol that operates over TCP port 541. This protocol is specifically designed for FortiManager-to-FortiGate management traffic, carrying configuration pushes, policy installs, device status, and revision history. It is the native management channel that enables centralized administration, and it is distinct from standard remote-access or monitoring protocols.

Answer

SSH.

Answer

SNMP.

Answer

HTTP.

Question 7

Which THREE of the following are components of the 'Policy Package'?

Accepted Answer

Firewall policies.. In a firewall management platform such as Check Point, a Policy Package is the container that holds the security rulebase and the reusable objects those rules reference. Option A (Firewall policies) is correct because the rulebase itself — the ordered set of allow/block/drop rules — is the core component of the Policy Package. Option D (Address objects) is correct because network/host objects (e.g., IP ranges, subnets, groups) are defined and stored within the package so rules can reference them. Option E (Services) is correct because service objects (TCP/UDP ports, protocols such as HTTP/HTTPS) are likewise part of the package and are matched in the rule columns. Option B (Hardware interface settings) is not part of the Policy Package because interface configuration belongs to the gateway/device network configuration, not the security rulebase. Option C (Firmware images) is not part of the Policy Package because firmware is the gateway's operating system software, managed separately from policy objects and rules.

Answer

Hardware interface settings.

Answer

Firmware images.

Question 8

Which THREE of the following are key steps in the 'Policy Install Workflow'?

Accepted Answer

Initiate install.. The Policy Install Workflow in Check Point management begins with initiating the install (Option A), which is the action that pushes the compiled security policy from the Security Management Server to the selected Security Gateways. Option B, checking installation status, is a key step because after the install is triggered you must verify whether the policy was successfully loaded on each gateway (via the Install Policy window status or SmartConsole logs) to confirm enforcement. Option E, running Install Preview, is also a key step since it lets the administrator see which gateways and policy packages will be affected and detect potential issues before committing the actual installation. The unmarked options do not belong: deleting old policies manually (Option C) is not part of the install workflow because policy replacement is handled automatically during install, and factory resetting the device (Option D) is a hardware recovery action unrelated to installing a policy.

Answer

Delete old policies manually.

Answer

Factory reset the device.

Question 9

Which THREE of the following are features of the FortiManager 'Global Settings'?

Accepted Answer

Admin user management.. Option A (Admin user management) is correct because Global Settings in FortiManager centralizes administrative accounts, profiles, and permission scopes that apply across all managed ADOMs and devices. Option B (FortiGuard service configuration) is correct because Global Settings lets you configure FortiGuard subscription services, including update servers, ports, and proxy settings used by the FortiManager and its managed devices. Option D (System time/NTP configuration) is correct because Global Settings includes system-level time zone and NTP server configuration that governs scheduling, logging timestamps, and synchronization for the FortiManager. Option C (Per-device policy package management) is not part of Global Settings; policy packages are managed per ADOM/device within Policy & Objects, not globally. Option E (Automated firmware deployment) is not a Global Settings feature; firmware management and upgrades are handled through Device Manager or the Firmware Manager/upgrade workflow, not the global system settings.

Answer

Per-device policy package management.

Answer

Automated firmware deployment.

Question 10

Which object type allows you to define a single configuration setting that can be applied to multiple FortiGate devices using Provisioning Templates?

Accepted Answer

Meta Fields. Meta Fields in FortiManager are custom variables that can be assigned to managed devices and referenced in Provisioning Templates, allowing a single configuration setting to be applied across multiple FortiGates. They act as placeholders that resolve to device-specific values during template deployment.

Answer

Device Objects

Answer

CLI Templates

Answer

Policy Objects

Question 11

Which component in FortiManager is responsible for managing the logical grouping of multiple FortiGate devices that share the same policy package?

Accepted Answer

Policy Package. A Policy Package in FortiManager is the container that holds a set of firewall policies and objects which can be assigned to multiple FortiGate devices. It provides the logical grouping so that devices sharing the same policy set are managed together through that package.

Answer

Firmware Template

Answer

ADOM

Answer

Device Group

Question 12

Which TWO of the following are valid methods to initiate a configuration backup of a managed FortiGate device from FortiManager?

Accepted Answer

Device Manager > Device Dashboard > Backup. Option D is correct because in FortiManager, selecting a managed FortiGate in Device Manager and using the Device Dashboard's Backup action retrieves the device's current configuration and stores it as a revision in the FortiManager database. Option E is correct because Device Manager > Revision History > Create New explicitly triggers a new configuration revision (backup) from the selected managed device, adding it to that device's revision history. Both methods are standard FortiManager workflows for pulling a configuration backup from a managed FortiGate. Option A (Policy & Objects > Import Policy) is for importing policy objects/packages into FortiManager, not for backing up a device configuration. Option B (Scripts > Create > Run on Device) executes CLI scripts on devices and is not a backup mechanism. Option C (System Settings > Network > Backup) does not exist as a device-configuration backup path in FortiManager; system settings backups relate to FortiManager's own configuration, not managed FortiGates.

Answer

Policy & Objects > Import Policy

Answer

Scripts > Create > Run on Device

Answer

System Settings > Network > Backup

Question 13

A security administrator manages 40 FortiGates from FortiManager. A new firewall policy is created and successfully installed, but almost immediately after, the FortiManager administrator notices the device-level configuration on several FortiGates no longer matches the last installed revision. The administrator wants to identify what changed on those devices after the install. Which FortiManager feature should the administrator use to review the differences between the FortiManager database and the managed FortiGate configuration?

Accepted Answer

The Configuration Diff option in the Device Manager dashboard for each FortiGate.. Configuration Diff in the Device Manager dashboard is the dedicated tool for comparing the FortiManager database with the configuration currently running on a managed FortiGate. Because the devices were changed after the install, the administrator needs a side-by-side comparison to pinpoint the local modifications and then retrieve or overwrite them.

Answer

The Revision History view in the Device Manager pane for each FortiGate.

Answer

The Install Preview option in the Install Wizard for the affected policy package.

Answer

The FortiManager event log filtered by the Configuration Changed event type.

Question 14

You are troubleshooting a FortiManager installation failure for a policy package to a FortiGate. The installation log shows an error: 'Failed to install policy package: object not found on device'. Which action should you take to resolve this issue?

Accepted Answer

Use the 'Install Wizard' and select the option to install the missing objects along with the policy package.. When a policy package installation fails because an object is not found on the device, the Install Wizard can be configured to install the missing objects along with the policy package. This option ensures that all referenced objects are present on the FortiGate before the policy is applied. This approach maintains centralized management and avoids manual intervention on the device, which could lead to configuration drift.

Answer

Retrieve the FortiGate configuration to synchronize the object database.

Answer

Manually create the missing object on the FortiGate via CLI or GUI.

Answer

Remove the missing object from the policy package and reinstall.

Question 15

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

Accepted Answer

Global objects.. Global objects in FortiManager are shared across all ADOMs, making them the correct choice for enforcing a consistent naming convention for address objects across multiple ADOMs. When a global object is created, it is available to every ADOM and can be referenced in policies, ensuring uniform naming and values everywhere. This centralizes object management and prevents naming drift between ADOMs.

Answer

Provisioning templates.

Answer

Local ADOM objects.

Answer

CLI templates.

Question 16

You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?

Accepted Answer

Perform an Import Policy operation.. When a new FortiGate is added to FortiManager, the device's existing policies are not automatically reflected in FortiManager's policy packages. The administrator must run an Import Policy operation to pull the device's current policy configuration into FortiManager so the policy package and the device are synchronized. Only after importing can the policy package be installed back to the device with confidence that it matches the device's actual state.

Answer

Upgrade the firmware.

Answer

Re-install the device settings.

Answer

Run a script to update the policy database.

Question 17

You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?

Accepted Answer

Policy Check. Policy Check is the FortiManager feature that verifies policies for syntax errors, conflicts, and compliance before installation. It helps ensure that the policy package is valid and can be successfully installed on FortiGates, reducing the risk of misconfigurations.

Answer

Install Wizard

Answer

Revision History

Answer

Device Manager

Question 18

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

Accepted Answer

Policy & Objects > Installation Preview.. The Installation Preview in Policy & Objects shows a detailed diff between the FortiManager policy database and the FortiGate's running configuration before installation. This allows administrators to review exactly what changes will be pushed, making it the correct place to troubleshoot a failed policy installation.

Answer

Object Usage.

Answer

FortiView.

Answer

Device Manager > Revision History.

Answer

System Settings > Task Monitor.

Question 19

Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?

Accepted Answer

Assign a name to the ADOM. Enabling ADOMs in System Settings (D) is mandatory because the ADOM feature is disabled by default in FortiManager; until you turn it on under System Settings > Admin > System Settings (or via the CLI), no ADOM can exist or be created. Assigning a name to the ADOM (C) is also mandatory, since every ADOM must have a unique name that identifies it in the ADOM list and is used when adding devices or policies to that ADOM. In contrast, configuring global policies (A) is optional and only applies if you use Global ADOM/global policy features, scheduling backups (B) is an administrative maintenance task unrelated to ADOM creation, and assigning a firewall to the ADOM (E) happens after the ADOM exists and is not required to create it.

Answer

Configure global policies

Answer

Schedule backups

Answer

Assign a firewall to the ADOM

Question 20

An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?

Accepted Answer

Policy Packages. Policy Packages in FortiManager are containers that group firewall policies and objects and are assigned to specific devices or device groups within an ADOM. By installing only the desired policy package to selected devices, the administrator achieves granular control over which firewalls receive which policy changes. This is the standard mechanism for scoped policy deployment.

Answer

Global Policy Packages

Answer

Provisioning Templates

Answer

Device Groups