FORTINET-NSE56 Nse5 Fortimanager Operations Practice Test 2 — 15 Questions

Question 1

You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?

Accepted Answer

Perform an Import Policy operation.. When a new FortiGate is added to FortiManager, the device's existing policies are not automatically reflected in FortiManager's policy packages. The administrator must run an Import Policy operation to pull the device's current policy configuration into FortiManager so the policy package and the device are synchronized. Only after importing can the policy package be installed back to the device with confidence that it matches the device's actual state.

Answer

Upgrade the firmware.

Answer

Re-install the device settings.

Answer

Run a script to update the policy database.

Question 2

You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?

Accepted Answer

Policy Check. Policy Check is the FortiManager feature that verifies policies for syntax errors, conflicts, and compliance before installation. It helps ensure that the policy package is valid and can be successfully installed on FortiGates, reducing the risk of misconfigurations.

Answer

Install Wizard

Answer

Revision History

Answer

Device Manager

Question 3

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

Accepted Answer

Policy & Objects > Installation Preview.. The Installation Preview in Policy & Objects shows a detailed diff between the FortiManager policy database and the FortiGate's running configuration before installation. This allows administrators to review exactly what changes will be pushed, making it the correct place to troubleshoot a failed policy installation.

Answer

Object Usage.

Answer

FortiView.

Answer

Device Manager > Revision History.

Answer

System Settings > Task Monitor.

Question 4

Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?

Accepted Answer

Assign a name to the ADOM. Enabling ADOMs in System Settings (D) is mandatory because the ADOM feature is disabled by default in FortiManager; until you turn it on under System Settings > Admin > System Settings (or via the CLI), no ADOM can exist or be created. Assigning a name to the ADOM (C) is also mandatory, since every ADOM must have a unique name that identifies it in the ADOM list and is used when adding devices or policies to that ADOM. In contrast, configuring global policies (A) is optional and only applies if you use Global ADOM/global policy features, scheduling backups (B) is an administrative maintenance task unrelated to ADOM creation, and assigning a firewall to the ADOM (E) happens after the ADOM exists and is not required to create it.

Answer

Configure global policies

Answer

Schedule backups

Answer

Assign a firewall to the ADOM

Question 5

An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?

Accepted Answer

Policy Packages. Policy Packages in FortiManager are containers that group firewall policies and objects and are assigned to specific devices or device groups within an ADOM. By installing only the desired policy package to selected devices, the administrator achieves granular control over which firewalls receive which policy changes. This is the standard mechanism for scoped policy deployment.

Answer

Global Policy Packages

Answer

Provisioning Templates

Answer

Device Groups

Question 6

Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?

Accepted Answer

Using the Script Manager.. The Script Manager in FortiManager allows administrators to create and run CLI scripts on multiple managed FortiGate devices simultaneously. It is the most efficient method to apply a specific set of CLI commands to many devices at once, as it supports scheduling, targeting device groups, and executing scripts in parallel. This avoids manual CLI access and is more direct than modifying provisioning templates for ad-hoc changes.

Answer

Updating the firmware.

Answer

Manual CLI access to each device.

Answer

Modifying the Provisioning Template.

Question 7

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

Accepted Answer

The installation fails during the validation phase.. When the FortiManager Install Wizard pushes a policy package, it performs a validation phase that checks whether all referenced objects exist on the target FortiGate. If any object is missing, the installation fails during validation rather than proceeding, because FortiManager will not push a policy that references undefined objects. This prevents broken or incomplete configurations from being deployed.

Answer

The installation proceeds and ignores the missing objects.

Answer

The FortiGate automatically creates the missing objects using default settings.

Answer

The objects are pushed as CLI commands only.

Question 8

You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?

Accepted Answer

The configuration on the FortiManager differs from the configuration on the FortiGate.. 'Modified' in Device Status indicates that the configuration on FortiManager differs from the configuration on the FortiGate. This means the device has out-of-sync changes, either because the FortiGate was changed locally or the FortiManager has pending changes not installed.

Answer

The FortiGate has been re-registered.

Answer

A firmware upgrade is pending.

Answer

The device is unreachable.

Question 9

An administrator needs to revert a firewall configuration to a state from two weeks ago. Which feature in FortiManager allows for this recovery?

Accepted Answer

Revision History. FortiManager's Revision History stores every configuration revision pushed to or pulled from a managed FortiGate, including timestamps and diffs. An administrator can browse revisions, compare them, and revert the device to any prior revision — including one from two weeks ago — directly from the Device Manager.

Answer

Provisioning Templates

Answer

Configuration Backup

Answer

Script Manager

Question 10

If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?

Accepted Answer

It merges the FortiGate policies into the FortiManager policy package.. The 'Import Policy' function in FortiManager retrieves the policy configuration from a managed FortiGate and merges it into the FortiManager policy package for that device or ADOM. This is used when a FortiGate has been configured locally and the administrator wants FortiManager's database to reflect the device's actual policy set, enabling centralized management going forward.

Answer

It forces a firmware downgrade.

Answer

It automatically creates a new ADOM.

Answer

It deletes all existing policies in the ADOM.

Question 11

What is the primary purpose of using 'Provisioning Templates' in FortiManager?

Accepted Answer

To standardize system settings like NTP, DNS, and logging on multiple devices.. Provisioning Templates in FortiManager are used to standardize and automate the configuration of system-level settings such as NTP, DNS, logging, and other device-wide parameters across multiple FortiGate devices. They ensure consistency and reduce manual configuration errors when onboarding or managing many devices. They are not used for firewall policies, endpoint management, or reporting.

Answer

To manage FortiClient endpoints.

Answer

To create firewall policies across all devices.

Answer

To generate performance reports.

Question 12

What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?

Accepted Answer

The FortiGate must be added and authorized in the Device Manager.. Before FortiManager can manage a FortiGate within a specific ADOM, the device must be added to that ADOM and authorized. Adding and authorizing in Device Manager establishes the management tunnel and trust relationship, after which the FortiGate appears in the ADOM's device list and can receive policy packages and templates.

Answer

The ADOM must be in 'Advanced' mode.

Answer

A policy package must be created first.

Answer

The FortiGate must be in a 'Disconnected' state.

Question 13

When configuring 'Global Objects' in FortiManager, what happens to the specific objects in the ADOM-level database?

Accepted Answer

They are referenced by the ADOM.. When an object is configured as a Global Object in FortiManager, it is stored in the Global Database (ADOM) and can be referenced by policies and objects within individual ADOMs. The ADOM-level database does not duplicate or delete the object; instead, it maintains a reference to the global object, allowing centralized management while still being usable in ADOM-specific policies.

Answer

They are hidden from the administrator.

Answer

They are deleted.

Answer

They are converted to CLI commands.

Question 14

Which tab in the FortiManager GUI is primarily used for managing firewall policies and objects?

Accepted Answer

Policy & Objects. The 'Policy & Objects' tab in FortiManager is specifically designed for centralized management of firewall policies and address/service objects across multiple FortiGate devices. It allows administrators to create, edit, and install policy packages and object definitions, which are then pushed to managed devices. This tab provides a unified interface for policy orchestration, making it the primary location for these tasks.

Answer

FortiView

Answer

Device Manager

Answer

System Settings

Question 15

Which of the following is a mandatory step when creating a new ADOM in FortiManager?

Accepted Answer

Selecting a firmware version.. When creating a new Administrative Domain (ADOM) in FortiManager, you must specify the firmware version that the managed devices in that ADOM will run. This is because FortiManager uses the firmware version to determine the available objects, features, and schema for policy packages and device configurations within the ADOM. Without selecting a firmware version, the ADOM cannot be created, as the version dictates the database structure and compatibility.

Answer

Assigning an IP address.

Answer

Defining a policy package.

Answer

Configuring SNMP.