FORTINET-NSE56 Nse5 Fortimanager Operations — Timed 15 Questions

Question 1

Which TWO conditions must be met to successfully use an 'Install Config' wizard for device-level settings?

Accepted Answer

The configuration database must be synchronized.. Option C is correct because the Install Config wizard pushes device-level settings from the management server's configuration database, so that database must be synchronized with the device's current configuration to avoid conflicts or failed commits. Option D is correct because the target device must be in an 'up' state (reachable and operational) for the wizard to establish the management connection and apply the configuration successfully. Option A is not required, since the wizard works with supported firmware versions rather than only the latest. Option B is not required, as existing policies do not need to be deleted before running the wizard. Option E is not required, because 'backup' mode is not a prerequisite for installing configuration.

Answer

The device must be running the latest firmware.

Answer

All policies must be deleted.

Answer

The device must be in 'backup' mode.

Question 2

When using 'Provisioning Templates', which setting allows you to automatically apply CLI commands to new devices as soon as they are added to the FortiManager?

Accepted Answer

Device Templates. Device Templates in Provisioning Templates allow administrators to define CLI commands or configurations that are automatically applied to new devices when they are added to FortiManager. This enables zero-touch provisioning by pushing baseline settings such as admin passwords, DNS, and logging configuration as soon as the device registers.

Answer

Auto-Link

Answer

ADOM Policies

Answer

Install On Install

Question 3

A FortiManager administrator needs to migrate an existing local FortiGate policy into a shared policy package. Which process must be followed?

Accepted Answer

Use the Policy Import tool to move to Global ADOM. FortiManager's Policy Import tool (also called the 'Import Policy' wizard) is the supported mechanism to pull an existing local FortiGate policy into a shared policy package or Global ADOM. It reads the device's current policy configuration and maps it into FortiManager's policy/object database so it can be managed centrally. Manually recreating or re-importing the whole config is not the correct migration path.

Answer

Manually re-import the config

Answer

Disable policy management

Answer

Delete local policy and recreate

Question 4

Which THREE steps are required to implement a new firewall policy using the FortiManager workflow mode?

Accepted Answer

Submit the request for approval.. In FortiManager workflow mode, implementing a new firewall policy requires creating a new policy package (D), since workflow mode enforces a structured change process where policies are built in a package before being pushed to managed FortiGates. Once the package and its policies are defined, the administrator must submit the request for approval (B), which places the change into the approval queue rather than installing it immediately. A designated approver must then approve the request (C), after which the policy package can be installed on the target FortiGate devices. Deleting the original policy (A) is not required, as workflow mode handles policy changes through the package lifecycle rather than forcing deletion of existing policies. Rebooting the FortiGate (E) is never part of the FortiManager workflow process, since policy installation does not require a device reboot.

Answer

Delete the original policy.

Answer

Reboot the FortiGate.

Question 5

Which CLI command is used on a FortiGate to set the central management IP to the FortiManager?

Accepted Answer

config system central-management. The command 'set central-mgmt' is used to define the FortiManager IP address for centralized management.

Answer

set fortimanager-ip

Answer

set remote-log-server

Answer

set manager-address

Question 6

Which protocol does FortiManager use to communicate with managed FortiGate devices?

Accepted Answer

FMG protocol.. FortiManager communicates with managed FortiGate devices using the FortiManager (FMG) protocol, a proprietary Fortinet protocol that operates over TCP port 541. This protocol is specifically designed for FortiManager-to-FortiGate management traffic, carrying configuration pushes, policy installs, device status, and revision history. It is the native management channel that enables centralized administration, and it is distinct from standard remote-access or monitoring protocols.

Answer

SSH.

Answer

SNMP.

Answer

HTTP.

Question 7

Which THREE of the following are components of the 'Policy Package'?

Accepted Answer

Firewall policies.. In a firewall management platform such as Check Point, a Policy Package is the container that holds the security rulebase and the reusable objects those rules reference. Option A (Firewall policies) is correct because the rulebase itself — the ordered set of allow/block/drop rules — is the core component of the Policy Package. Option D (Address objects) is correct because network/host objects (e.g., IP ranges, subnets, groups) are defined and stored within the package so rules can reference them. Option E (Services) is correct because service objects (TCP/UDP ports, protocols such as HTTP/HTTPS) are likewise part of the package and are matched in the rule columns. Option B (Hardware interface settings) is not part of the Policy Package because interface configuration belongs to the gateway/device network configuration, not the security rulebase. Option C (Firmware images) is not part of the Policy Package because firmware is the gateway's operating system software, managed separately from policy objects and rules.

Answer

Hardware interface settings.

Answer

Firmware images.

Question 8

Which THREE of the following are key steps in the 'Policy Install Workflow'?

Accepted Answer

Initiate install.. The Policy Install Workflow in Check Point management begins with initiating the install (Option A), which is the action that pushes the compiled security policy from the Security Management Server to the selected Security Gateways. Option B, checking installation status, is a key step because after the install is triggered you must verify whether the policy was successfully loaded on each gateway (via the Install Policy window status or SmartConsole logs) to confirm enforcement. Option E, running Install Preview, is also a key step since it lets the administrator see which gateways and policy packages will be affected and detect potential issues before committing the actual installation. The unmarked options do not belong: deleting old policies manually (Option C) is not part of the install workflow because policy replacement is handled automatically during install, and factory resetting the device (Option D) is a hardware recovery action unrelated to installing a policy.

Answer

Delete old policies manually.

Answer

Factory reset the device.

Question 9

Which THREE of the following are features of the FortiManager 'Global Settings'?

Accepted Answer

Admin user management.. Option A (Admin user management) is correct because Global Settings in FortiManager centralizes administrative accounts, profiles, and permission scopes that apply across all managed ADOMs and devices. Option B (FortiGuard service configuration) is correct because Global Settings lets you configure FortiGuard subscription services, including update servers, ports, and proxy settings used by the FortiManager and its managed devices. Option D (System time/NTP configuration) is correct because Global Settings includes system-level time zone and NTP server configuration that governs scheduling, logging timestamps, and synchronization for the FortiManager. Option C (Per-device policy package management) is not part of Global Settings; policy packages are managed per ADOM/device within Policy & Objects, not globally. Option E (Automated firmware deployment) is not a Global Settings feature; firmware management and upgrades are handled through Device Manager or the Firmware Manager/upgrade workflow, not the global system settings.

Answer

Per-device policy package management.

Answer

Automated firmware deployment.

Question 10

Which object type allows you to define a single configuration setting that can be applied to multiple FortiGate devices using Provisioning Templates?

Accepted Answer

Meta Fields. Meta Fields in FortiManager are custom variables that can be assigned to managed devices and referenced in Provisioning Templates, allowing a single configuration setting to be applied across multiple FortiGates. They act as placeholders that resolve to device-specific values during template deployment.

Answer

Device Objects

Answer

CLI Templates

Answer

Policy Objects

Question 11

Which component in FortiManager is responsible for managing the logical grouping of multiple FortiGate devices that share the same policy package?

Accepted Answer

Policy Package. A Policy Package in FortiManager is the container that holds a set of firewall policies and objects which can be assigned to multiple FortiGate devices. It provides the logical grouping so that devices sharing the same policy set are managed together through that package.

Answer

Firmware Template

Answer

ADOM

Answer

Device Group

Question 12

Which TWO of the following are valid methods to initiate a configuration backup of a managed FortiGate device from FortiManager?

Accepted Answer

Device Manager > Device Dashboard > Backup. Option D is correct because in FortiManager, selecting a managed FortiGate in Device Manager and using the Device Dashboard's Backup action retrieves the device's current configuration and stores it as a revision in the FortiManager database. Option E is correct because Device Manager > Revision History > Create New explicitly triggers a new configuration revision (backup) from the selected managed device, adding it to that device's revision history. Both methods are standard FortiManager workflows for pulling a configuration backup from a managed FortiGate. Option A (Policy & Objects > Import Policy) is for importing policy objects/packages into FortiManager, not for backing up a device configuration. Option B (Scripts > Create > Run on Device) executes CLI scripts on devices and is not a backup mechanism. Option C (System Settings > Network > Backup) does not exist as a device-configuration backup path in FortiManager; system settings backups relate to FortiManager's own configuration, not managed FortiGates.

Answer

Policy & Objects > Import Policy

Answer

Scripts > Create > Run on Device

Answer

System Settings > Network > Backup

Question 13

A security administrator manages 40 FortiGates from FortiManager. A new firewall policy is created and successfully installed, but almost immediately after, the FortiManager administrator notices the device-level configuration on several FortiGates no longer matches the last installed revision. The administrator wants to identify what changed on those devices after the install. Which FortiManager feature should the administrator use to review the differences between the FortiManager database and the managed FortiGate configuration?

Accepted Answer

The Configuration Diff option in the Device Manager dashboard for each FortiGate.. Configuration Diff in the Device Manager dashboard is the dedicated tool for comparing the FortiManager database with the configuration currently running on a managed FortiGate. Because the devices were changed after the install, the administrator needs a side-by-side comparison to pinpoint the local modifications and then retrieve or overwrite them.

Answer

The Revision History view in the Device Manager pane for each FortiGate.

Answer

The Install Preview option in the Install Wizard for the affected policy package.

Answer

The FortiManager event log filtered by the Configuration Changed event type.

Question 14

You are troubleshooting a FortiManager installation failure for a policy package to a FortiGate. The installation log shows an error: 'Failed to install policy package: object not found on device'. Which action should you take to resolve this issue?

Accepted Answer

Use the 'Install Wizard' and select the option to install the missing objects along with the policy package.. When a policy package installation fails because an object is not found on the device, the Install Wizard can be configured to install the missing objects along with the policy package. This option ensures that all referenced objects are present on the FortiGate before the policy is applied. This approach maintains centralized management and avoids manual intervention on the device, which could lead to configuration drift.

Answer

Retrieve the FortiGate configuration to synchronize the object database.

Answer

Manually create the missing object on the FortiGate via CLI or GUI.

Answer

Remove the missing object from the policy package and reinstall.

Question 15

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

Accepted Answer

Global objects.. Global objects in FortiManager are shared across all ADOMs, making them the correct choice for enforcing a consistent naming convention for address objects across multiple ADOMs. When a global object is created, it is available to every ADOM and can be referenced in policies, ensuring uniform naming and values everywhere. This centralizes object management and prevents naming drift between ADOMs.

Answer

Provisioning templates.

Answer

Local ADOM objects.

Answer

CLI templates.