Knowledge + Practice

CCNA Nse5 Fortimanager Operations Questions

65 questions · Nse5 Fortimanager Operations · All types, answers revealed

Practice these questions Domain overview All questions

1

Multi-Selectmedium

Which TWO of the following are common reasons for a policy installation failure in FortiManager?

Select 2 answers

A.Referenced objects missing on the target device.

B.Device firmware is too new.

C.Too many policies in the package.

D.The administrator password is incorrect.

E.Device is not synchronized.

AnswersA, E

Policy installation pushes policy packages referencing objects such as addresses, services or virtual IPs. If those objects are absent on the target FortiGate, FortiManager cannot resolve them during the push, so installation fails with a missing-object error.

Why this answer

Option A is correct because a policy installation fails when the policy package references objects (addresses, services, VIPs, etc.) that do not exist on the target FortiGate, so FortiManager cannot resolve them during the install. Option E is correct because FortiManager requires the target device to be synchronized with its configuration database; if the device status is out of sync, the install is blocked until a retrieve/import is performed. Option B is not a standard cause, since FortiManager generally supports a range of FortiOS versions and firmware being newer is not itself a failure reason.

Option C is not a defined limit that causes installation failure; policy count is bounded by platform resources, not a FortiManager install rule. Option D is not relevant, because policy installation uses the FortiManager-to-FortiGate management tunnel/FGFM authorization, not the administrator's login password.

Exam trap

The trap is picking plausible-sounding but non-causal reasons like 'too many policies' or 'wrong admin password' — the exam expects you to know that object reference and synchronization issues are the real installation blockers.

Practice this question →

2

MCQeasy

You have imported a new FortiGate into FortiManager. Which operation must you perform to synchronize the existing policy package with the new device?

A.Upgrade the firmware.

B.Re-install the device settings.

C.Perform an Import Policy operation.

D.Run a script to update the policy database.

AnswerC

Import Policy retrieves the policy package already running on the newly added FortiGate and installs it into FortiManager, aligning the manager's database with the device. This satisfies the stem's requirement to synchronise the existing policy package with the imported device.

Why this answer

When a new FortiGate is added to FortiManager, the device's existing policies are not automatically reflected in FortiManager's policy packages. The administrator must run an Import Policy operation to pull the device's current policy configuration into FortiManager so the policy package and the device are synchronized. Only after importing can the policy package be installed back to the device with confidence that it matches the device's actual state.

Exam trap

The trap is confusing 'import' (pull from device to FortiManager) with 'install' (push from FortiManager to device) — candidates often pick 're-install device settings' thinking it synchronizes both directions.

How to eliminate wrong answers

Option A is wrong because a firmware upgrade changes the device's software version and has nothing to do with synchronizing policy packages — it can actually cause compatibility issues if FortiManager does not support the new firmware. Option B is wrong because 'Re-install the device settings' pushes FortiManager's configuration to the device; it does not pull the device's existing policy into FortiManager, so it would overwrite rather than synchronize. Option D is wrong because running a script to update the policy database is not a supported synchronization operation — FortiManager uses the Import Policy wizard, not arbitrary scripts, for this purpose.

Practice this question →

3

MCQeasy

Which of the following is a mandatory step when creating a new ADOM in FortiManager?

A.Selecting a firmware version.

B.Assigning an IP address.

C.Defining a policy package.

D.Configuring SNMP.

AnswerA

FortiManager requires a firmware version when creating an ADOM because the ADOM schema, object model and available features differ across firmware releases. Selecting it satisfies the stem's mandatory-step constraint, ensuring policy and objects match the managed devices' version.

Why this answer

When creating a new Administrative Domain (ADOM) in FortiManager, you must specify the firmware version that the managed devices in that ADOM will run. This is because FortiManager uses the firmware version to determine the available objects, features, and schema for policy packages and device configurations within the ADOM. Without selecting a firmware version, the ADOM cannot be created, as the version dictates the database structure and compatibility.

Exam trap

FORTINET-NSE56 often tests the misconception that ADOM creation requires network settings like IP addresses or policy packages, when in fact the firmware version is the only mandatory selection.

How to eliminate wrong answers

Option B is wrong because assigning an IP address is not part of ADOM creation; IP addresses are configured on managed devices or interfaces, not on the ADOM itself. Option C is wrong because defining a policy package is an optional step that occurs after ADOM creation, not a mandatory prerequisite. Option D is wrong because configuring SNMP is unrelated to ADOM creation; SNMP is a monitoring protocol configured on devices or FortiManager system settings, not a requirement for creating an ADOM.

Practice this question →

4

MCQmedium

Which tab is used to monitor traffic logs from the managed FortiGates?

A.Log View.

B.FortiView.

C.System Settings.

D.Device Manager.

AnswerA

Log View provides centralised, real-time traffic log monitoring for managed FortiGates, satisfying the requirement to inspect traffic logs from the Security Fabric. Unlike FortiView, which aggregates and visualises data, Log View displays raw log entries with filtering, letting administrators verify individual sessions and troubleshoot specific events directly.

Why this answer

In FortiManager, the Log View tab (under Log & Report or a dedicated Log View section) is used to browse and filter traffic logs received from managed FortiGates. It provides a raw log view with filters for source, destination, policy, and action, making it the direct place to monitor traffic logs.

Exam trap

The trap is confusing FortiView (visual analytics) with Log View (raw log browsing) — candidates pick FortiView because it sounds like the monitoring tool, but the question asks specifically for traffic logs.

How to eliminate wrong answers

Option B is wrong because FortiView is a graphical analytics and visualization tool (top talkers, threats, etc.) rather than the raw traffic log browser; it aggregates and presents data differently. Option C is wrong because System Settings is for administrative configuration of FortiManager itself, not log monitoring. Option D is wrong because Device Manager is for managing device configurations and provisioning, not for viewing traffic logs.

Practice this question →

5

MCQmedium

What happens when you change an ADOM's version?

A.All logs are cleared.

B.All device policies are automatically converted.

C.The ADOM supports the new firmware version features.

D.The FortiManager reboots.

AnswerC

Changing an ADOM's version upgrades its object schema to the target firmware release, so the ADOM can then use and manage features introduced in that firmware version. This directly satisfies the stem's requirement about new firmware version features.

Why this answer

Changing an ADOM's version in FortiManager updates the ADOM to support the features and object model of a specific FortiOS firmware version. This allows the ADOM to manage devices running that firmware with the correct schema, enabling new features and ensuring compatibility. It does not clear logs, automatically convert policies, or reboot the FortiManager.

Exam trap

FortiNet NSE56 often tests whether candidates believe that changing an ADOM version automatically converts policies or clears logs, when in fact it only updates the ADOM's supported feature set and schema.

How to eliminate wrong answers

Option A is wrong because changing the ADOM version does not clear logs; logs are stored in FortiAnalyzer or the device, and ADOM version changes affect configuration management, not log storage. Option B is wrong because device policies are not automatically converted; policy conversion may be required manually or via specific migration tools, and changing the ADOM version alone does not alter existing policies. Option D is wrong because the FortiManager does not reboot when an ADOM version is changed; it is a configuration setting that updates the ADOM schema without requiring a restart.

Practice this question →

6

MCQmedium

When managing policy packages, what does the 'Policy Package' clone feature do?

A.It merges two packages into one.

B.It resets the package to factory defaults.

C.It creates a duplicate of the package.

D.It deletes the original package.

AnswerC

Cloning a policy package creates a full duplicate, copying its policies, objects and installation targets into a new package. This satisfies the requirement by producing an independent copy that can be modified without affecting the original.

Why this answer

The 'Policy Package' clone feature in FortiManager creates an exact duplicate of an existing policy package, including all firewall policies, objects, and configuration settings. This allows administrators to quickly replicate a package for use as a template or for testing changes without affecting the original. The clone operation does not merge, reset, or delete the original package; it simply produces a copy.

Exam trap

The trap here is confusing 'clone' with other package operations like merge, reset, or delete, as candidates might assume clone implies altering the original or combining packages.

How to eliminate wrong answers

Option A is wrong because merging two packages into one is not the purpose of the clone feature; merging would require a different operation or manual consolidation. Option B is wrong because resetting to factory defaults would discard all configurations, whereas cloning preserves them in a new copy. Option D is wrong because cloning does not delete the original package; the original remains intact and unchanged.

Practice this question →

7

MCQmedium

An administrator is managing multiple FortiGate devices using FortiManager. They need to ensure that policy changes made in the ADOM are only pushed to specific firewalls. Which feature should they use to achieve granular control over policy deployment?

A.Global Policy Packages

B.Policy Packages

C.Provisioning Templates

D.Device Groups

AnswerB

Policy packages group policies for assignment to specific managed devices or groups, giving granular control over which FortiGates receive changes. This satisfies the requirement to push ADOM policy changes only to selected firewalls, rather than the entire ADOM.

Why this answer

Policy Packages in FortiManager are containers that group firewall policies and objects and are assigned to specific devices or device groups within an ADOM. By installing only the desired policy package to selected devices, the administrator achieves granular control over which firewalls receive which policy changes. This is the standard mechanism for scoped policy deployment.

Exam trap

FORTINET-NSE56 often tests the distinction between policy packages (which deploy firewall policies) and provisioning templates (which deploy system settings), catching candidates who pick templates for policy deployment.

How to eliminate wrong answers

Option A is wrong because Global Policy Packages apply across all ADOMs and are used for organization-wide baseline policies, not for granular per-device control. Option C is wrong because Provisioning Templates are used to push system-level settings (e.g., interfaces, SNMP, syslog) to devices, not firewall policies. Option D is wrong because Device Groups are logical groupings used for targeting, but they do not themselves contain or deploy policies — policy deployment is done via policy packages assigned to those groups.

Practice this question →

8

Multi-Selecthard

Which THREE of the following are benefits of using ADOMs in FortiManager?

Select 3 answers

A.Increased throughput for traffic.

B.Ability to manage different firmware versions.

C.Improved administrative control by assigning roles per ADOM.

D.Automatic hardware upgrades.

E.Logical separation of managed devices.

AnswersB, C, E

Each ADOM is tied to a specific firmware version, so devices running different FortiOS releases are grouped separately. This lets a single FortiManager manage mixed firmware versions without version conflicts, satisfying the requirement to manage different firmware versions.

Why this answer

Option B is correct because ADOMs allow a single FortiManager to manage devices running different FortiOS firmware versions, since each ADOM can be set to a specific firmware version and devices are grouped accordingly. Option C is correct because ADOMs enable granular administrative control: administrators can be assigned per-ADOM permissions and roles, restricting their scope to only the ADOMs they are responsible for. Option E is correct because ADOMs provide logical separation of managed devices, allowing devices to be organized into independent administrative domains (for example by customer, region, or business unit) without requiring separate FortiManager instances.

Option A is not a benefit of ADOMs, as ADOMs are a management/organizational feature and do not increase traffic throughput. Option D is also incorrect because ADOMs do not perform automatic hardware upgrades; firmware and hardware management are separate functions and ADOMs do not automate physical hardware replacement.

Exam trap

FORTINET-NSE56 often tests whether candidates attribute performance or automation benefits to ADOMs — the trap is selecting 'increased throughput' or 'automatic hardware upgrades' because they sound like management benefits.

Practice this question →

9

MCQeasy

An administrator needs to revert a firewall configuration to a state from two weeks ago. Which feature in FortiManager allows for this recovery?

A.Provisioning Templates

B.Configuration Backup

C.Revision History

D.Script Manager

AnswerC

Revision History stores timestamped configuration revisions each time a change is committed, letting the administrator select the version from two weeks ago and restore it directly. This satisfies the rollback requirement without manual rebuilds, since FortiManager retains the full prior configuration state for point-in-time recovery.

Why this answer

FortiManager's Revision History stores every configuration revision pushed to or pulled from a managed FortiGate, including timestamps and diffs. An administrator can browse revisions, compare them, and revert the device to any prior revision — including one from two weeks ago — directly from the Device Manager.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Revision History (versioned rollback) with Configuration Backup (point-in-time file copy) — both sound like recovery options, but only Revision History supports browsing and reverting to arbitrary past states.

How to eliminate wrong answers

Option A is wrong because Provisioning Templates are used to push standardized configuration to devices, not to restore historical states. Option B is wrong because Configuration Backup refers to saving a copy of the current config (often to a file or remote server), not to browsing and reverting to past revisions. Option D is wrong because Script Manager runs CLI scripts on devices on demand or on schedule; it does not maintain a versioned history for rollback.

Practice this question →

10

MCQeasy

Which setting in the 'System Settings' is used to define the administrator's password policy?

A.Device Manager.

B.Policy & Objects.

C.FortiGuard.

D.Administrator settings.

AnswerD

Administrator settings holds the password policy controls, letting you enforce complexity, minimum length, and expiry for admin accounts. This directly satisfies the stem's requirement to define the administrator's password policy within System Settings, rather than global authentication or user-facing options.

Why this answer

In FortiGate's GUI, the administrator password policy is configured under System > Settings > Administrator Settings. This section allows you to enforce password complexity, minimum length, expiration, and reuse restrictions for local admin accounts. The other options are unrelated to password policy configuration.

Exam trap

FORTINET-NSE56 often tests the distinction between system-level administrative settings and policy/object configurations, causing candidates to confuse password policy location with firewall policy or device management sections.

How to eliminate wrong answers

Option A is wrong because Device Manager is not a valid FortiGate GUI menu; it is a concept from other products like FortiManager, and does not control local admin password policies. Option B is wrong because Policy & Objects is used to define firewall policies, addresses, services, and other security profiles, not administrator authentication settings. Option C is wrong because FortiGuard refers to subscription services for security updates (e.g., antivirus, IPS signatures) and does not manage admin password rules.

Practice this question →

11

MCQmedium

Which object type should you use in FortiManager to ensure a consistent naming convention for address objects across multiple ADOMs?

A.Provisioning templates.

B.Local ADOM objects.

C.CLI templates.

D.Global objects.

AnswerD

Global objects reside above ADOMs, so a single definition propagates to every ADOM, enforcing one naming convention across all managed domains. Per-ADOM objects would need duplicating and could drift, breaking the consistency the stem demands.

Why this answer

Global objects in FortiManager are shared across all ADOMs, making them the correct choice for enforcing a consistent naming convention for address objects across multiple ADOMs. When a global object is created, it is available to every ADOM and can be referenced in policies, ensuring uniform naming and values everywhere. This centralizes object management and prevents naming drift between ADOMs.

Exam trap

The trap is confusing global objects with CLI or provisioning templates — candidates must recognize that only global objects provide a shared, cross-ADOM object repository for naming consistency.

How to eliminate wrong answers

Option A is wrong because provisioning templates are used to configure device settings (like interface or system settings) during device provisioning, not to share address objects across ADOMs. Option B is wrong because local ADOM objects exist only within a single ADOM and cannot enforce consistency across multiple ADOMs. Option C is wrong because CLI templates push raw CLI configuration to devices; they do not provide a shared object repository with consistent naming across ADOMs.

Practice this question →

12

MCQhard

You are troubleshooting a failed policy installation. Where can you view the detailed diff between the FortiManager policy database and the actual FortiGate running configuration?

A.Policy & Objects > Installation Preview.

B.Object Usage.

C.FortiView.

D.Device Manager > Revision History.

E.System Settings > Task Monitor.

AnswerA

Installation Preview compares the FortiManager policy database against the FortiGate's running configuration, displaying the exact configuration diff before installation. This satisfies the troubleshooting requirement by exposing precisely which policy objects differ, without committing changes to the managed device.

Why this answer

The Installation Preview in Policy & Objects shows a detailed diff between the FortiManager policy database and the FortiGate's running configuration before installation. This allows administrators to review exactly what changes will be pushed, making it the correct place to troubleshoot a failed policy installation.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Installation Preview (pre-install diff) with Revision History (post-install historical snapshots) or Task Monitor (task status), leading them to pick a location that does not show the diff.

How to eliminate wrong answers

Option B (Object Usage) is wrong because it shows where objects are referenced, not a configuration diff. Option C (FortiView) is wrong because FortiView is a log analytics tool, not a policy diff viewer. Option D (Device Manager > Revision History) is wrong because it shows historical configuration revisions, not a live diff between FortiManager and FortiGate.

Option E (System Settings > Task Monitor) is wrong because it shows task status and logs, not a detailed configuration diff.

Practice this question →

13

MCQeasy

Which tab in the FortiManager GUI is primarily used for managing firewall policies and objects?

A.FortiView

B.Policy & Objects

C.Device Manager

D.System Settings

AnswerB

Policy & Objects is the dedicated FortiManager tab where firewall policies and their associated objects are created, edited and installed to managed devices. It centralises policy configuration, directly matching the stem's requirement for managing firewall policies and objects.

Why this answer

The 'Policy & Objects' tab in FortiManager is specifically designed for centralized management of firewall policies and address/service objects across multiple FortiGate devices. It allows administrators to create, edit, and install policy packages and object definitions, which are then pushed to managed devices. This tab provides a unified interface for policy orchestration, making it the primary location for these tasks.

Exam trap

FORTINET-NSE56 often tests the distinction between management, monitoring, and device-level configuration tabs, causing candidates to confuse FortiView (monitoring) with Policy & Objects (policy management).

How to eliminate wrong answers

Option A is wrong because FortiView is used for monitoring and analytics, displaying logs and traffic patterns, not for configuring policies or objects. Option C is wrong because Device Manager is used for device-level configuration, such as interface settings and routing, but not for centralized policy management. Option D is wrong because System Settings is for administrative configuration of FortiManager itself, such as administrators, HA, and network settings, not for managing firewall policies on managed devices.

Practice this question →

14

MCQmedium

You are troubleshooting a sync issue where a device shows 'Modified' status in the Device Manager. What is the most likely cause?

A.The FortiManager license has expired.

B.The FortiManager firmware is outdated.

C.The policy package was deleted.

D.The configuration on the FortiGate was changed locally.

AnswerD

Local configuration changes on the FortiGate set the device's synchronisation state to 'Modified', because FortiManager detects a configuration drift between its own database and the managed device. This mismatch is exactly the sync issue described in the stem, making a local edit the most likely cause.

Why this answer

When a device shows 'Modified' status in FortiManager's Device Manager, it typically means the configuration on the FortiGate has been changed locally and is out of sync with the FortiManager's database. This can happen if someone logs into the FortiGate directly and makes changes.

Exam trap

The trap is attributing sync issues to licensing or firmware problems; candidates may overlook the common cause of local configuration changes on the managed device.

How to eliminate wrong answers

Option A is wrong because an expired FortiManager license would not cause a 'Modified' status; it would affect management capabilities but not the sync status in this way. Option B is wrong because outdated firmware on FortiManager does not directly cause a device to show 'Modified'; it might cause compatibility issues but not this status. Option C is wrong because if the policy package was deleted, the device would show as unassigned or have no policy package, not 'Modified'.

Practice this question →

15

MCQmedium

You are creating a new policy package. You need to ensure that shared objects from the Global ADOM are available. What is the correct workflow?

A.Use the 'Install Wizard' to sync global objects.

B.Export objects from the Global ADOM and re-import them.

C.Import the objects directly into the local policy package.

D.Assign the Global ADOM to the target ADOM.

AnswerD

Assigning the Global ADOM to the target ADOM makes global shared objects available for use within that ADOM's policy packages. This satisfies the requirement by establishing the inheritance link through which Global ADOM objects become accessible.

Why this answer

To make shared objects from the Global ADOM available in a policy package, you must assign the Global ADOM to the target ADOM. This creates a parent-child relationship where the target ADOM inherits global objects, which can then be referenced in local policies. The other options involve manual export/import or wizard-based syncing, which are not the correct workflow for global object availability.

Exam trap

FORTINET-NSE56 often tests the Global ADOM workflow; candidates mistakenly think they need to export/import objects or use the Install Wizard, missing the assignment step that enables inheritance.

How to eliminate wrong answers

Option A is wrong because the Install Wizard installs policies to devices, not sync global objects. Option B is wrong because exporting and re-importing objects is a manual workaround, not the intended workflow, and it breaks the inheritance model. Option C is wrong because importing objects directly into a local policy package does not leverage the Global ADOM's shared object mechanism and would create duplicates.

Practice this question →

16

MCQmedium

What is the purpose of 'Revision History' when it comes to policy packages?

A.To synchronize objects across ADOMs.

B.To generate audit reports.

C.To archive logs.

D.To store and revert changes made to policies.

AnswerD

Revision History records each saved policy package version, allowing comparison and rollback to a prior state. This satisfies the requirement to store and revert changes, providing version control independent of installation, so an administrator can undo an unwanted edit without rebuilding the package.

Why this answer

Revision History in FortiManager records every change made to policy packages, including who made the change, when, and what was modified. Its primary purpose is to allow administrators to view past versions and revert to a previous configuration if a change causes problems. This provides rollback capability and change accountability for policy packages.

Exam trap

The trap here is confusing Revision History with audit logging or object synchronization—candidates often pick 'generate audit reports' because revision history sounds like an audit function, but it is specifically for version control and rollback of policy packages.

How to eliminate wrong answers

Option A is wrong because object synchronization across ADOMs is handled by ADOM-level object management or 'install wizard' features, not Revision History. Option B is wrong because audit reports are generated through FortiManager's report module or event logs, not Revision History. Option C is wrong because log archiving is a function of log settings, FortiAnalyzer, or syslog servers, not policy package revision tracking.

Practice this question →

17

Multi-Selecteasy

Which TWO of the following are valid ways to monitor the status of managed FortiGate devices in the Device Manager?

Select 2 answers

A.License expiry alert

B.ADOM-level dashboard

C.Connection Status icon

D.Global policy report

E.Firmware log

AnswersB, C

An ADOM-level dashboard aggregates health and status metrics across every managed FortiGate within that administrative domain, satisfying the requirement to monitor device status centrally. It draws on FortiManager's stored device data, so administrators see real-time up/down state and connectivity for all members without querying each device individually.

Why this answer

Option B (ADOM-level dashboard) is correct because FortiManager's Device Manager provides an ADOM-level dashboard that summarizes managed device health, including up/down status, CPU, memory, and disk usage for the FortiGates in that ADOM. Option C (Connection Status icon) is correct because each managed device entry in Device Manager shows a Connection Status icon (green/up, red/down, etc.) that indicates whether FortiManager currently has a management tunnel/connection to that FortiGate. Option A (License expiry alert) is not a Device Manager status-monitoring mechanism for managed FortiGates; license/entitlement tracking is handled through FortiCare/FortiManager licensing views, not as a Device Manager status indicator.

Option D (Global policy report) is incorrect because global policy is a policy package concept for applying policies across ADOMs, not a device status monitor. Option E (Firmware log) is incorrect because firmware version is shown as device inventory information, and there is no 'Firmware log' status monitor in Device Manager for checking managed FortiGate status.

Exam trap

The trap is assuming that any monitoring-related feature (like license alerts or firmware logs) is part of Device Manager, when in fact Device Manager focuses on connection status and ADOM-level dashboards for device health.

Practice this question →

18

MCQhard

You are managing a FortiManager ADOM that contains multiple FortiGate devices. You notice that the 'Device Status' shows 'Modified'. What does this indicate?

A.The configuration on the FortiManager differs from the configuration on the FortiGate.

B.The FortiGate has been re-registered.

C.A firmware upgrade is pending.

D.The device is unreachable.

AnswerA

'Modified' means the FortiGate's running configuration no longer matches the policy package stored in FortiManager, satisfying the stem's scenario. This mismatch typically arises from direct device changes or pending installations, prompting an install to resynchronise.

Why this answer

'Modified' in Device Status indicates that the configuration on FortiManager differs from the configuration on the FortiGate. This means the device has out-of-sync changes, either because the FortiGate was changed locally or the FortiManager has pending changes not installed.

Exam trap

FORTINET-NSE56 often tests the meaning of device statuses, causing candidates to confuse 'Modified' with firmware or connectivity issues.

How to eliminate wrong answers

Option B is wrong because re-registration would show a different status, such as 'Unknown' or 'Unauthorized'. Option C is wrong because a pending firmware upgrade is not indicated by 'Modified'; it would be shown separately. Option D is wrong because unreachable devices show 'Offline' or 'Unreachable', not 'Modified'.

Practice this question →

19

MCQeasy

Where do you configure the email server settings for FortiManager alert notifications?

A.FortiView.

B.Policy & Objects.

C.Device Manager.

D.System Settings.

AnswerD

Email server details for FortiManager alert notifications live under System Settings, where the mail server, port and authentication are defined. This satisfies the stem's constraint by placing SMTP configuration at the system level, not within individual ADOMs, devices or policy packages.

Why this answer

Email server settings for FortiManager alert notifications (SMTP server, port, authentication, sender address) are configured under System Settings > Alert Email, which is the centralized location for notification delivery configuration.

Exam trap

The trap is looking for email settings under Device Manager or Policy & Objects because those are the most-used FortiManager sections — but system-level notification config always lives under System Settings.

How to eliminate wrong answers

Option A is wrong because FortiView is a log visualization and analytics dashboard, not a configuration area for notification delivery. Option B is wrong because Policy & Objects is where firewall policies, address objects, and security profiles are defined, not system-level alerting. Option C is wrong because Device Manager manages managed FortiGate devices and their provisioning, not FortiManager's own notification settings.

Practice this question →

20

MCQhard

When using 'Install Wizard', what does the 'Auto-update' check-box do?

A.It triggers a backup.

B.It automatically pushes changes to the device.

C.It updates the device firmware.

D.It deletes duplicate policies.

AnswerB

Ticking Auto-update makes the wizard push the generated configuration straight to the FortiGate, removing any manual upload step. This satisfies the stem's requirement that the wizard itself apply changes, rather than merely producing a file for later import. The device receives and commits the settings immediately.

Why this answer

In the Install Wizard, the 'Auto-update' checkbox controls whether FortiManager automatically pushes the selected changes to the target device(s) as part of the install operation. When enabled, the install proceeds without requiring a separate manual push step; when disabled, changes are staged and must be pushed manually.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse 'Auto-update' (automatic push of config changes) with firmware updates or backups — the trap is picking 'updates the device firmware' because of the word 'update'.

How to eliminate wrong answers

Option A is wrong because backups are handled by the backup/revision feature, not the Install Wizard's Auto-update option. Option C is wrong because firmware updates are performed through the device firmware upgrade path, not the Install Wizard. Option D is wrong because duplicate policy removal is a policy cleanup function, not related to Auto-update.

Practice this question →

21

MCQmedium

If an administrator needs to ensure that a specific set of CLI commands is always applied during the deployment of a new device, which tool should be used?

A.CLI Template

B.Global Database

C.Policy Package

D.Import Wizard

AnswerA

A CLI Template stores a fixed set of CLI commands that FortiManager automatically pushes during device provisioning, guaranteeing the same commands run on every new device. This satisfies the requirement that the command set is always applied at deployment.

Why this answer

A CLI Template in FortiManager stores a reusable set of CLI commands that can be automatically applied to devices during provisioning or deployment. This ensures a consistent baseline configuration is pushed to new devices without manual intervention, exactly matching the requirement to always apply a specific command set.

Exam trap

FORTINET-NSE56 often tests whether candidates distinguish CLI Templates (raw command automation) from Policy Packages (firewall policy management) and Provisioning Templates (broader device setup), since all three relate to deployment.

How to eliminate wrong answers

Option B is wrong because the Global Database stores shared policy objects (addresses, services) for reuse across policy packages, not raw CLI command sequences applied at deployment. Option C is wrong because a Policy Package is a container of firewall policies and objects assigned to devices — it manages policy, not arbitrary CLI configuration. Option D is wrong because the Import Wizard is used to bring existing device configurations into FortiManager for management, not to enforce a predefined command set on new deployments.

Practice this question →

22

MCQeasy

You are deploying a new policy package to multiple FortiGate devices. Which FortiManager feature allows you to verify that the policies are syntactically correct before pushing them to the production environment?

A.Install Wizard

B.Revision History

C.Policy Check

D.Device Manager

AnswerC

Policy Check validates policy packages for syntax, conflicts and errors before installation, satisfying the requirement to verify correctness prior to pushing to production. It performs static analysis without deploying, unlike Install Wizard, which pushes configurations to managed FortiGates.

Why this answer

Policy Check is the FortiManager feature that verifies policies for syntax errors, conflicts, and compliance before installation. It helps ensure that the policy package is valid and can be successfully installed on FortiGates, reducing the risk of misconfigurations.

Exam trap

FORTINET-NSE56 often tests the difference between Policy Check and Install Wizard, causing candidates to choose Install Wizard for pre-installation validation.

How to eliminate wrong answers

Option A is wrong because Install Wizard is used to install policies, not to verify them beforehand. Option B is wrong because Revision History tracks changes to configurations, not syntax validation. Option D is wrong because Device Manager is for managing device settings, not policy validation.

Practice this question →

23

MCQhard

What must occur before a FortiGate can be managed by a specific ADOM in FortiManager?

A.The FortiGate must be added and authorized in the Device Manager.

B.The ADOM must be in 'Advanced' mode.

C.A policy package must be created first.

D.The FortiGate must be in a 'Disconnected' state.

AnswerA

Adding and authorising the FortiGate in Device Manager creates the management tunnel and registers its serial number, after which FortiManager can assign it to an ADOM. Without this authorisation step, the device cannot be placed into any ADOM.

Why this answer

Before FortiManager can manage a FortiGate within a specific ADOM, the device must be added to that ADOM and authorized. Adding and authorizing in Device Manager establishes the management tunnel and trust relationship, after which the FortiGate appears in the ADOM's device list and can receive policy packages and templates.

Exam trap

FORTINET-NSE56 often tests the order of operations — candidates assume a policy package or ADOM mode must be set first, but device authorization is the actual prerequisite.

How to eliminate wrong answers

Option B is wrong because ADOM mode (Normal vs Advanced) affects object and policy features, not the prerequisite for device management. Option C is wrong because a policy package is not required before adding a device; you can add a device first and create packages later. Option D is wrong because a 'Disconnected' state is a status, not a prerequisite — the device must be authorized and connected to be managed.

Practice this question →

24

Multi-Selectmedium

Which TWO of the following are valid states for a device in FortiManager?

Select 2 answers

A.Upgrading.

B.Synchronized.

C.Archived.

D.Modified.

E.Formatting.

AnswersB, D

Synchronized is a genuine FortiManager device state, indicating the FortiGate's configuration matches the policy package assigned to it. This satisfies the stem's requirement for valid device states, alongside Modified, which flags unsaved or pending configuration differences.

Why this answer

In FortiManager, a managed device's configuration status is shown by states such as Synchronized (option B), meaning the device's configuration matches the policy package and object database stored on FortiManager, and Modified (option D), meaning the device's configuration differs from what FortiManager has, typically because local changes were made or a policy/object change has not yet been installed. These two are the standard device configuration status values used in the Device Manager to indicate whether the device is in sync with FortiManager. The other options are not valid FortiManager device states: Upgrading (A) and Formatting (E) describe firmware or disk operations rather than a device configuration status, and Archived (C) is not a FortiManager device state (archiving relates to configuration revisions, not a device status).

Exam trap

FORTINET-NSE56 often tests whether candidates confuse device synchronization states (Synchronized/Modified) with unrelated operational states (Upgrading, Archived, Formatting), leading them to select invalid options.

Practice this question →

25

MCQmedium

Which of the following is a valid method for importing a FortiGate configuration into FortiManager?

A.Upload the backup file via the 'Import' GUI option in the device list.

B.By modifying the FortiManager's config file manually.

C.Using a USB drive plugged into the FortiManager.

D.Emailing the configuration to the FortiManager.

AnswerA

FortiManager's device list offers an Import action that accepts a FortiGate configuration backup file, parsing it into the ADOM so the device can be managed centrally. This is the supported GUI method for bringing an existing configuration under FortiManager control.

Why this answer

FortiManager provides a GUI-based Import option in the Device Manager device list that allows an administrator to upload a FortiGate backup configuration file and import it into FortiManager. This is the supported, documented method for bringing an existing FortiGate configuration into FortiManager without requiring the device to be online. The other options describe unsupported or nonsensical methods.

Exam trap

FORTINET-NSE56 often tests whether candidates know the supported import channels — the trap is picking a plausible-sounding but unsupported method like USB or manual file editing instead of the GUI Import option.

How to eliminate wrong answers

Option B is wrong because manually editing FortiManager's internal configuration files is unsupported, risks corrupting the database, and is not a valid import method. Option C is wrong because FortiManager does not support importing configurations via a USB drive — USB is used for firmware or backup on FortiGate devices, not for FortiManager config import. Option D is wrong because FortiManager has no email-based configuration import feature; configurations are imported via GUI, CLI, or API.

Practice this question →

26

MCQmedium

You are a network security analyst managing a FortiManager appliance that administers 40 FortiGate devices. A new security policy was created and installed on all managed FortiGates. A week later, an administrator accidentally modifies a firewall address object directly on one of the FortiGates via its local GUI. When FortiManager next retrieves the device configuration, what will it report?

A.FortiManager will automatically overwrite the local change with the version stored in its database.

B.The device will be marked as 'Out of Sync' and the policy package status will show as 'Modified'.

C.The device will show a configuration change detected, and the administrator can review the differences in the Revision History or Device Manager.

D.The FortiGate will immediately revert to the last installed policy package without any notification.

AnswerC

When FortiManager retrieves the configuration from a managed FortiGate, it detects any differences between the device's running configuration and the last known revision in its database. These differences are logged, and the administrator can inspect them through the Device Manager or Revision History. This allows the administrator to decide whether to import the local change or reinstall the FortiManager policy to overwrite it.

Why this answer

FortiManager detects configuration drift by comparing the retrieved configuration from the managed FortiGate with the last known revision in its database. The administrator is then alerted to the difference and can review it via Revision History or Device Manager. This process does not automatically overwrite or revert changes; it simply highlights discrepancies so the administrator can decide whether to import the local change or reinstall the centralized policy.

Exam trap

The trap here is assuming that FortiManager automatically overwrites local changes or marks the device as Out of Sync immediately after a retrieve, when in fact it only detects and logs the difference for administrator review.

Practice this question →

27

Multi-Selecthard

Which THREE actions can be performed on a policy package within the Policy & Objects tab?

Select 3 answers

A.Clone

B.Factory Reset

C.Delete

D.Firmware Upgrade

E.Lock

AnswersA, C, E

Clone duplicates an existing policy package, including its policies and objects, into a new package. This satisfies the question by being one of the three permitted actions on a policy package within the Policy & Objects tab.

Why this answer

In the Policy & Objects tab, a policy package can be cloned (A) to create a duplicate copy of the package with all its policies and objects, which is useful for replicating configurations across different scopes. It can also be deleted (C) to remove the package entirely from the policy management structure when it is no longer needed. Additionally, a policy package can be locked (E) to prevent other administrators from making concurrent changes, which helps avoid configuration conflicts in multi-admin environments.

Options B (Factory Reset) and D (Firmware Upgrade) are not valid actions for a policy package; factory reset and firmware upgrade are device-level operations performed on the firewall itself, not on a policy package within the Policy & Objects tab.

Exam trap

The trap is mixing up system-wide operations (factory reset, firmware upgrade) with policy package-specific actions; candidates may assume any management action is available on a policy package, but only clone, delete, and lock apply.

Practice this question →

28

MCQmedium

When using the FortiManager 'Install Wizard' to push configuration changes, what happens if the policy package being pushed contains objects that do not exist on the target FortiGate?

A.The installation proceeds and ignores the missing objects.

B.The FortiGate automatically creates the missing objects using default settings.

C.The objects are pushed as CLI commands only.

D.The installation fails during the validation phase.

AnswerD

The Install Wizard validates the policy package against the target FortiGate's existing objects before committing. Any referenced object absent on that device fails validation, so the push aborts rather than creating objects or partially applying configuration.

Why this answer

When the FortiManager Install Wizard pushes a policy package, it performs a validation phase that checks whether all referenced objects exist on the target FortiGate. If any object is missing, the installation fails during validation rather than proceeding, because FortiManager will not push a policy that references undefined objects. This prevents broken or incomplete configurations from being deployed.

Exam trap

FORTINET-NSE56 often tests the Install Wizard's validation behaviour — candidates assume FortiManager auto-creates or ignores missing objects, but it actually fails the install during validation.

How to eliminate wrong answers

Option A is wrong because FortiManager does not silently ignore missing objects — it aborts the install to avoid deploying an invalid policy. Option B is wrong because the FortiGate does not auto-create missing objects with defaults; object creation must be explicit via FortiManager or CLI. Option C is wrong because FortiManager does not fall back to pushing raw CLI commands for missing objects — it validates and fails instead.

Practice this question →

29

Multi-Selectmedium

Which TWO of the following are mandatory steps when configuring an ADOM in FortiManager?

Select 2 answers

A.Configure global policies

B.Schedule backups

C.Assign a name to the ADOM

D.Enable ADOMs in System Settings

E.Assign a firewall to the ADOM

AnswersC, D

Assigning a name is mandatory because FortiManager cannot create an ADOM without a unique identifier. This satisfies the question's requirement for a compulsory configuration step, as the name field must be populated before the ADOM can be saved.

Why this answer

Enabling ADOMs in System Settings (D) is mandatory because the ADOM feature is disabled by default in FortiManager; until you turn it on under System Settings > Admin > System Settings (or via the CLI), no ADOM can exist or be created. Assigning a name to the ADOM (C) is also mandatory, since every ADOM must have a unique name that identifies it in the ADOM list and is used when adding devices or policies to that ADOM. In contrast, configuring global policies (A) is optional and only applies if you use Global ADOM/global policy features, scheduling backups (B) is an administrative maintenance task unrelated to ADOM creation, and assigning a firewall to the ADOM (E) happens after the ADOM exists and is not required to create it.

Exam trap

The trap is treating optional ADOM configuration tasks (global policies, backups, device assignment) as mandatory — the exam wants you to identify only the two prerequisites: enabling ADOMs and naming the ADOM.

Practice this question →

30

MCQhard

An administrator is using the 'Policy Lookup' tool in FortiManager. What does this tool provide?

A.It shows which user is logged in.

B.It modifies traffic parameters.

C.It scans for unused objects.

D.It identifies which policy matches a specific traffic scenario.

AnswerD

Policy Lookup accepts source, destination, service and interface details, then traverses the policy package to return the exact policy that would handle that traffic. This lets administrators verify which rule matches a specific traffic scenario without manually inspecting every policy.

Why this answer

The 'Policy Lookup' tool in FortiManager allows administrators to simulate a traffic flow by specifying source, destination, service, etc., and it identifies which policy (or policies) would match that traffic on a managed FortiGate. This helps troubleshoot policy ordering and rule matching.

Exam trap

FORTINET-NSE56 often tests the difference between Policy Lookup and other tools like Policy Check or Object Usage, and candidates might confuse its diagnostic purpose with configuration changes.

How to eliminate wrong answers

Option A is wrong because showing logged-in users is not the purpose of Policy Lookup; that is handled by other monitoring tools. Option B is wrong because Policy Lookup does not modify traffic parameters; it is a read-only diagnostic tool. Option C is wrong because scanning for unused objects is typically done via the 'Policy Check' or 'Unused Objects' feature, not Policy Lookup.

Practice this question →

31

MCQmedium

What does the 'Auto-Link' feature in the 'Policy & Objects' tab do?

A.It maps matching objects between the managed device and the FortiManager database.

B.It automatically creates rules.

C.It links two separate ADOMs.

D.It enables VPN tunnels.

AnswerA

Auto-Link reconciles objects on the managed FortiGate with those already stored in the FortiManager database, mapping matching entries so policies referencing them resolve correctly. This satisfies the scenario's requirement to synchronise object definitions between device and manager, avoiding duplicate or orphaned objects during policy installation.

Why this answer

The Auto-Link feature in FortiManager's Policy & Objects tab automatically maps objects (addresses, services, etc.) that exist on the managed FortiGate with those in the FortiManager database, ensuring consistency when policies are installed. This prevents duplicate objects and simplifies policy management by aligning the device's configuration with the central database. It does not create rules, link ADOMs, or enable VPNs.

Exam trap

FORTINET-NSE56 often tests the distinction between object mapping and policy creation; candidates assume Auto-Link generates rules or performs ADOM operations, when it strictly maps objects.

How to eliminate wrong answers

Option B is wrong because Auto-Link does not automatically create firewall rules; it only maps existing objects. Option C is wrong because linking two separate ADOMs is not a function of Auto-Link; ADOMs are administrative domains and cannot be linked this way. Option D is wrong because VPN tunnel creation is unrelated to Auto-Link, which deals with object mapping for policy consistency.

Practice this question →

32

MCQeasy

What is the primary function of the 'Object' menu within the Policy & Objects tab?

A.To manage administrator accounts.

B.To create reusable entities like IP addresses, services, and address groups.

C.To configure system interfaces.

D.To monitor log traffic.

AnswerB

The Object menu holds reusable configuration entities — IP addresses, services, address groups and similar — that policies reference. Defining them once here avoids duplication and satisfies the stem's requirement for creating reusable entities rather than policies themselves.

Why this answer

The Object menu under Policy & Objects is the central repository for reusable configuration entities such as firewall addresses, IP ranges, FQDNs, services, service groups, address groups, VIPs, and IP pools. These objects are defined once and then referenced by firewall policies, NAT rules, and other features, which simplifies administration and reduces configuration errors. This is distinct from system-level or monitoring functions found elsewhere in the GUI.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse the Object menu (reusable entities) with System or Network menus that hold administrator accounts and interface settings.

How to eliminate wrong answers

Option A is wrong because administrator accounts are managed under System > Administrators (or System > Admin Profiles), not the Object menu. Option C is wrong because interface configuration lives under Network > Interfaces, not Policy & Objects. Option D is wrong because log traffic monitoring is handled by Log & Report or the FortiView dashboards, not the Object menu.

Practice this question →

33

MCQmedium

What is the primary benefit of using a 'Device Group' in FortiManager?

A.They are required for ADOM creation.

B.They provide better firewall performance.

C.They allow for easier organization and bulk actions on devices.

D.They enable automatic failover.

AnswerC

Device Groups bundle FortiGate devices so administrators can push policy packages, objects and firmware to many devices at once rather than individually. This delivers easier organisation and bulk actions on devices, which is the primary benefit over managing each device separately.

Why this answer

A Device Group in FortiManager is a logical container that lets administrators organize managed FortiGates and apply bulk operations — such as installing policy packages, pushing configuration, or running scripts — to all members at once. It is purely an organizational and operational convenience, not a functional or performance feature.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Device Groups (organizational/bulk-action containers) with ADOMs (administrative partitions) — the trap is picking an answer that describes ADOM functionality.

How to eliminate wrong answers

Option A is wrong because ADOM creation does not require device groups; ADOMs are created independently and devices are added directly or via groups. Option B is wrong because FortiManager is out-of-band and has no effect on firewall throughput. Option D is wrong because automatic failover is a FortiGate HA (FGCP/FGSP) function, not something FortiManager device groups provide.

Practice this question →

34

MCQhard

What is the result of 'Retrieve Config' when the FortiGate has local changes not yet in the FortiManager database?

A.All policies are deleted.

B.The FortiGate resets to factory settings.

C.The FortiGate goes offline.

D.The FortiManager database is updated with the device configuration.

AnswerD

Retrieve Config pulls the FortiGate's running configuration into FortiManager, overwriting the database copy with the device's local changes. This satisfies the stem's scenario: unsynchronised local edits are imported, making the FortiManager database match the device rather than the reverse.

Why this answer

'Retrieve Config' pulls the running configuration from the managed FortiGate and imports it into the FortiManager database, overwriting the FortiManager copy. If the FortiGate has local changes not yet reflected in FortiManager, those changes are captured and the FortiManager database is updated to match the device. This makes the device the source of truth for that operation.

Exam trap

The trap here is confusing the direction of synchronization — candidates often assume FortiManager always overwrites the device, but Retrieve Config does the opposite.

How to eliminate wrong answers

Option A is wrong because Retrieve Config does not delete policies — it imports them, including any locally added policies. Option B is wrong because factory reset is a device-side operation, not something FortiManager triggers via Retrieve Config. Option C is wrong because the FortiGate remains online and connected; Retrieve Config is a read/import operation, not a disconnect action.

Practice this question →

35

MCQeasy

A network administrator needs to back up the FortiManager configuration, including all managed device configurations and policy packages. Which method should be used to ensure a complete backup that can be restored to a new FortiManager appliance if necessary?

A.Use the 'Backup' option in the Device Manager for each managed FortiGate.

B.Use the 'Backup' option in the FortiManager GUI under System Settings > Dashboard.

C.Use the 'Export' option in the Policy & Objects tab to export all policy packages.

D.Use the 'Backup' option in the FortiManager GUI under System Settings > Configuration > Backup/Restore.

AnswerD

The correct location for backing up the FortiManager configuration is under System Settings > Configuration > Backup/Restore. This backup includes the FortiManager configuration, the device database, and policy packages. It can be restored to a new FortiManager appliance with the same firmware version. This method ensures a complete backup that includes all managed device configurations and administrative settings, which is essential for disaster recovery.

Why this answer

A complete FortiManager backup is performed via System Settings > Configuration > Backup/Restore. This backup includes the FortiManager configuration, the device database, and all policy packages. It can be restored to a new FortiManager appliance, ensuring a full recovery of the management environment.

Other methods, such as exporting policy packages or backing up individual FortiGates, do not capture the entire FortiManager state and are not suitable for disaster recovery.

Exam trap

The trap here is assuming that exporting policy packages or backing up individual devices is sufficient for a full FortiManager backup, when only the System Settings backup captures the complete configuration.

Practice this question →

36

MCQmedium

What is the purpose of 'Policy Package' import?

A.To backup policies.

B.To share policies between ADOMs.

C.To push policies to a new device.

D.To add existing FortiGate policies to the FortiManager.

AnswerD

Policy Package import pulls existing policy configurations from a managed FortiGate into FortiManager, adding those policies to the ADOM's policy packages. This satisfies the stem by describing the mechanism that brings existing FortiGate policies under centralised FortiManager management.

Why this answer

Policy Package import in FortiManager is used to bring existing firewall policies from a managed FortiGate into FortiManager so they can be centrally managed, versioned, and deployed. This is typically done during initial onboarding of a device that was previously managed locally.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse Policy Package import (onboarding existing device policies into FortiManager) with backup, ADOM sharing, or policy installation.

How to eliminate wrong answers

Option A is wrong because backing up policies is a separate operation (backup/restore), not the purpose of import. Option B is wrong because sharing policies between ADOMs is done via policy package assignment or export/import between ADOMs, not the primary purpose of importing from a device. Option C is wrong because pushing policies to a new device is an install operation, not an import.

Practice this question →

37

MCQeasy

An administrator needs to quickly distribute a CLI command to fifty managed FortiGate devices. Which feature should they use to automate this task efficiently?

A.Device Groups

B.Policy Packages

C.Scripts

D.Provisioning Templates

AnswerC

Scripts run CLI commands or templates across selected managed devices in one operation, so a single script executes on all fifty FortiGates simultaneously. This satisfies the efficiency constraint, whereas per-device installation or manual CLI entry would require fifty separate actions.

Why this answer

FortiManager Scripts allow an administrator to run CLI command scripts against multiple managed devices simultaneously, making it the ideal tool for pushing a single command to fifty FortiGates at once. Scripts can be executed on selected devices or device groups, providing efficient bulk automation.

Exam trap

The trap is confusing Device Groups (a grouping construct) with the actual execution mechanism — candidates may assume grouping devices enables command distribution, when only Scripts (or templates) actually push commands.

How to eliminate wrong answers

Option A is wrong because Device Groups are organizational containers used to group devices for policy assignment and provisioning — they do not themselves execute commands. Option B is wrong because Policy Packages contain firewall policies and objects installed to devices; they manage security policy, not arbitrary CLI execution. Option D is wrong because Provisioning Templates are used to define initial device setup (e.g., system settings, interface config) applied during onboarding, not for ad-hoc command distribution to already-managed devices.

Practice this question →

38

MCQmedium

Which 'Install Wizard' option ensures that configuration changes on the FortiManager are synchronized back to the device's configuration file?

A.Install Policy Package & Device Settings.

B.Install Policy Package only.

C.Device Settings only.

D.Retrieve Config.

AnswerA

Install Policy Package & Device Settings pushes both policy and device-level configuration to the managed FortiGate, then retrieves the resulting configuration so FortiManager's copy matches the device. This satisfies the stem's requirement for changes synchronised back to the device's configuration file, unlike policy-only installs that omit device settings.

Why this answer

'Install Policy Package & Device Settings' pushes both the policy package and the device-level settings (interfaces, routing, system config) from FortiManager to the managed FortiGate, ensuring the device's configuration file is synchronized with what FortiManager has stored. This is the option that covers full config synchronization back to the device.

Exam trap

The trap is direction confusion — candidates pick 'Retrieve Config' thinking it synchronizes, but retrieval pulls from device to manager, while the question asks about pushing manager config back to the device.

How to eliminate wrong answers

Option B is wrong because 'Install Policy Package only' pushes firewall policies and objects but leaves device-level settings (interfaces, static routes, system config) untouched, so the device config is not fully synchronized. Option C is wrong because 'Device Settings only' pushes device-level configuration without the policy package, again leaving the device out of sync with the full intended state. Option D is wrong because 'Retrieve Config' pulls the configuration FROM the device TO FortiManager — the opposite direction of what the question asks.

Practice this question →

39

MCQhard

An administrator wants to ensure that a specific policy is always included in all policy packages within an ADOM. What feature should be used?

A.Script.

B.Provisioning Template.

C.Global Policy.

D.Standard Policy.

AnswerC

A global policy resides above all ADOM policy packages, so it is inherited automatically by every package without manual insertion. This satisfies the requirement that the policy always be included, whereas normal policies apply only within the single package where they are created.

Why this answer

Global Policies in FortiManager are objects created at the ADOM level that are automatically inherited by every policy package within that ADOM. This ensures a consistent baseline policy (for example, a deny-all or management-access rule) is always present regardless of which package an administrator installs. Because they are enforced at the ADOM scope, they cannot be accidentally omitted from a package.

Exam trap

FORTINET-NSE56 often tests the distinction between ADOM-level inherited objects (Global Policies) and package-level objects (Standard Policies), so candidates who pick 'Standard Policy' confuse a normal rule with an inherited one.

How to eliminate wrong answers

Option A is wrong because a Script is a CLI/CLI-template automation mechanism used to run commands on managed devices, not a policy-inheritance feature. Option B is wrong because a Provisioning Template is used to push initial device settings (such as system, interface, or VPN configuration) to a device, not to inject a firewall policy into every package. Option D is wrong because a Standard Policy is simply a normal policy object created inside a single policy package; it has no cross-package inheritance behavior and must be manually added to each package.

Practice this question →

40

MCQhard

In FortiManager, what is the result of using the 'Re-install Policy' option instead of the 'Install Wizard'?

A.It forces a factory reset of the FortiGate.

B.It deletes all objects not in use.

C.It uses the last saved installation parameters to re-push the configuration.

D.It performs an automatic firmware update.

AnswerC

Re-install Policy re-pushes the policy package using the installation parameters stored from the previous install, without prompting for target device or scope. This satisfies the scenario's requirement to repeat a deployment quickly, whereas the Install Wizard forces you to reselect devices and options each time.

Why this answer

'Re-install Policy' in FortiManager re-pushes the last successfully installed policy package and configuration to the managed FortiGate using the saved installation parameters (target device, ADOM, and revision). It does not run the full Install Wizard again, so it is faster and preserves the prior install scope. This is useful when a device was restored or a config drift needs to be corrected without re-selecting targets.

Exam trap

FORTINET-NSE56 often tests the confusion between 'Re-install Policy' (replay last install) and 'Install Wizard' (new install with target selection), tricking candidates into thinking re-install resets or upgrades the device.

How to eliminate wrong answers

Option A is wrong because 'Re-install Policy' does not factory-reset a FortiGate; factory reset is a separate device action and would wipe the config, which is not what re-install does. Option B is wrong because unused object cleanup is a separate FortiManager feature (e.g., 'Delete Unused Objects' or ADOM cleanup), not part of re-install. Option D is wrong because firmware upgrades are handled by FortiManager's firmware management or FortiGuard upgrade features, not by re-installing a policy package.

Practice this question →

41

MCQhard

When using 'VPN Manager', what is the main benefit compared to manual VPN configuration?

A.It automates the creation of complex VPN topologies.

B.It automatically updates the ISP routing.

C.It increases encryption strength.

D.It removes the need for IPsec.

AnswerA

VPN Manager automates the creation of complex VPN topologies such as hub-and-spoke and full mesh, generating the required Phase 1 and Phase 2 settings across managed devices. This satisfies the requirement by removing the manual per-device configuration effort.

Why this answer

VPN Manager in FortiManager automates the creation and deployment of VPN topologies (hub-and-spoke, full mesh, etc.) across multiple FortiGates. Instead of manually configuring IPsec on each device, you define the topology once and VPN Manager generates and pushes the configuration, reducing errors and effort.

Exam trap

The trap is assuming VPN Manager does more than it does — candidates pick options about routing or encryption, but VPN Manager's core value is topology automation, not routing or crypto changes.

How to eliminate wrong answers

Option B is wrong because VPN Manager does not manage ISP routing — routing is handled by the FortiGate's routing configuration and SD-WAN, not by VPN Manager. Option C is wrong because VPN Manager does not change encryption strength; encryption algorithms are set in the IPsec phase1/phase2 proposals, which VPN Manager can template but does not inherently strengthen. Option D is wrong because VPN Manager still uses IPsec; it automates IPsec configuration, it does not eliminate the need for it.

Practice this question →

42

Multi-Selectmedium

Which TWO of the following are allowed in an ADOM?

Select 2 answers

A.Multiple policy packages.

B.Multiple administrative domains.

C.Multiple FortiManager units.

D.Multiple firmware versions per device.

E.Multiple FortiGate devices.

AnswersA, E

An ADOM can hold multiple policy packages, satisfying the requirement that several independent sets of firewall policies coexist within one administrative domain. Each package binds to its own managed devices and installation targets, so distinct policy scopes remain isolated without requiring separate ADOMs.

Why this answer

Option A is correct because an ADOM (Administrative Domain) is a logical container in FortiManager that can hold multiple policy packages, allowing different sets of firewall policies to be managed and assigned to different managed devices within that domain. Option E is correct because an ADOM is designed to group and manage multiple FortiGate devices (or other supported Fortinet devices) under a single administrative boundary, which is the core purpose of an ADOM. Option B is incorrect because ADOMs are the top-level administrative domains themselves; nesting multiple administrative domains inside one ADOM is not supported.

Option C is incorrect because FortiManager units are separate management appliances, not objects contained within an ADOM. Option D is incorrect because an ADOM does not permit multiple firmware versions per device; each managed device runs its own firmware, and ADOM-level firmware management does not allow a single device to hold multiple firmware versions.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse what an ADOM contains (policy packages, devices) with what it cannot contain (other ADOMs, multiple FortiManagers, mixed firmware versions).

Practice this question →

43

MCQhard

An administrator is attempting to move a device from one ADOM to another. Which condition must be met for this to succeed?

A.The device must not be assigned to any policy package.

B.The device must be in an 'Unregistered' state.

C.The device must be placed in a 'Group' folder first.

D.The device must be running the latest firmware version.

AnswerA

Moving a device between ADOMs requires it to be unassigned from any policy package, because policy packages are bound to a specific ADOM and cannot span administrative domains. FortiManager blocks the move while such an assignment exists, so removing the device from its policy package satisfies the prerequisite for the transfer to succeed.

Why this answer

A device cannot be moved between ADOMs while it is still referenced by a policy package, because the package and its objects belong to the source ADOM and would create dangling references. FortiManager therefore requires that the device be unassigned from any policy package before the move. Once unassigned, the device can be moved to the target ADOM and re-assigned to packages there.

Exam trap

FORTINET-NSE56 often tests the prerequisite for ADOM migration, and candidates incorrectly assume firmware or registration state matters when the real blocker is an active policy package assignment.

How to eliminate wrong answers

Option B is wrong because an 'Unregistered' state is not required — a device can be registered and managed yet still be moved, provided it is not bound to a policy package. Option C is wrong because placing a device in a Group folder is an organizational convenience for grouping devices, not a prerequisite for ADOM migration. Option D is wrong because firmware version has no bearing on ADOM membership; FortiManager can manage devices on different firmware branches within supported ranges.

Practice this question →

44

MCQmedium

An administrator notices that the 'Device Manager' status is 'Unsynchronized'. What is the recommended first step to resolve this?

A.Retrieve Config.

B.Change the ADOM version.

C.Reboot the FortiGate.

D.Re-install the firmware.

AnswerA

Retrieving the configuration pulls the managed device's current config into FortiManager, re-establishing the synchronisation baseline. This directly resolves the 'Unsynchronized' state, which occurs when FortiManager's stored revision diverges from the device's running config, so it is the recommended first step.

Why this answer

When the Device Manager status shows 'Unsynchronized', it means the FortiManager's configuration database is out of sync with the managed FortiGate. The recommended first step is to retrieve the configuration from the FortiGate ('Retrieve Config') to update FortiManager with the current device configuration, which resolves the synchronization issue.

Exam trap

The trap is overcomplicating the issue by rebooting or changing ADOM version, when the simple and correct first step is to retrieve the configuration from the device.

How to eliminate wrong answers

Option B is wrong because changing the ADOM version is a drastic step that can cause compatibility issues and is not the first troubleshooting step for unsynchronized status. Option C is wrong because rebooting the FortiGate does not address the configuration mismatch and may cause unnecessary downtime. Option D is wrong because re-installing firmware is unrelated to configuration synchronization and is not a recommended first step.

Practice this question →

45

MCQhard

When using the Workflow mode for policy management, what happens immediately after a policy change request is submitted?

A.The policy is pushed to the device automatically.

B.The policy is locked and sent to the approval queue.

C.The device immediately reboots.

D.The policy is applied to the 'Staging' ADOM.

AnswerB

Submitting a change request in Workflow mode immediately locks the policy, preventing concurrent edits, and places it in the approval queue for a designated approver. This satisfies the stem's constraint that the action occurs straight after submission, before any approval or deployment takes place.

Why this answer

In Workflow mode, FortiManager enforces a change-control process: when an administrator submits a policy change request, the policy is locked so no other changes can be made to it, and it is placed into the approval queue. It is not installed on the device until an approver reviews and approves the request. This ensures separation of duties and prevents unauthorized or unreviewed policy changes from reaching production devices.

Exam trap

FORTINET-NSE56 often tests the confusion between Normal mode (immediate install) and Workflow mode (approval queue), tricking candidates into choosing automatic push or a nonexistent staging ADOM.

How to eliminate wrong answers

Option A is wrong because automatic push happens in Normal (direct) mode, not Workflow mode; Workflow mode deliberately inserts an approval step before installation. Option C is wrong because a policy change request never triggers a device reboot — reboots are unrelated to policy workflow. Option D is wrong because there is no 'Staging' ADOM concept in FortiManager workflow; the policy remains in the ADOM's policy package in a locked/pending state, not moved to a separate staging ADOM.

Practice this question →

46

MCQmedium

Which method is the most efficient way to apply a specific set of CLI commands to 50 FortiGate devices simultaneously in FortiManager?

A.Using the Script Manager.

B.Updating the firmware.

C.Manual CLI access to each device.

D.Modifying the Provisioning Template.

AnswerA

Script Manager runs CLI scripts across managed devices in one operation, satisfying the requirement to apply identical commands to 50 FortiGates simultaneously. Scripts are stored centrally and executed per device or device group, eliminating 50 individual SSH sessions. This delivers the efficiency the stem demands, unlike manual per-device configuration.

Why this answer

The Script Manager in FortiManager allows administrators to create and run CLI scripts on multiple managed FortiGate devices simultaneously. It is the most efficient method to apply a specific set of CLI commands to many devices at once, as it supports scheduling, targeting device groups, and executing scripts in parallel. This avoids manual CLI access and is more direct than modifying provisioning templates for ad-hoc changes.

Exam trap

FORTINET-NSE56 often tests the distinction between Script Manager (ad-hoc CLI execution) and Provisioning Templates (baseline configuration), so candidates must recognize that Script Manager is the tool for running specific commands on many devices simultaneously.

How to eliminate wrong answers

Option B is wrong because updating firmware is a separate operation for upgrading device software, not for applying arbitrary CLI commands. Option C is wrong because manual CLI access to each device is time-consuming and error-prone, and does not scale to 50 devices. Option D is wrong because modifying a Provisioning Template is used for baseline system settings and is not the most efficient way to run a specific set of CLI commands on demand; it also requires re-provisioning or re-applying the template.

Practice this question →

47

MCQmedium

When utilizing the 'Install Preview' feature before pushing a policy package, what is the primary benefit to the administrator?

A.To update the FortiManager revision history database.

B.To view the CLI commands that will be pushed to the device.

C.To automatically correct syntax errors in the policy.

D.To bypass the approval workflow.

AnswerB

Install Preview parses the pending policy package and renders the exact CLI syntax FortiManager will push, letting the administrator verify interface names, addresses and ordering before committing. This satisfies the stem's requirement to inspect the change set in advance, catching syntax or object errors without touching the live device.

Why this answer

The Install Preview feature in FortiManager shows the administrator the exact CLI commands that will be pushed to the managed device before committing the policy package. This allows verification of the configuration changes, detection of unintended modifications, and validation that the policy will apply as expected, reducing the risk of service disruption.

Exam trap

The trap is assuming Install Preview performs validation or correction — candidates may pick 'automatically correct syntax errors' because it sounds like a safety feature, but preview is purely informational and does not modify or fix configurations.

How to eliminate wrong answers

Option A is wrong because Install Preview does not update the revision history database — revision history is updated only after an actual install is performed, not during preview. Option C is wrong because Install Preview displays commands but does not automatically correct syntax errors; it is a read-only preview, and syntax issues must be fixed manually in the policy configuration. Option D is wrong because Install Preview does not bypass the approval workflow — if approval is required, it still applies regardless of whether preview was used.

Practice this question →

48

Multi-Selectmedium

Which TWO of the following are valid methods to back up a FortiManager configuration?

Select 2 answers

A.Copying files via USB drive.

B.Manual backup via the System Settings GUI.

C.Using the 'Backup' button on the FortiGate.

D.Scheduled backup to an FTP or SCP server.

E.Automatic cloud sync to FortiCloud.

AnswersB, D

FortiManager's System Settings GUI includes a backup function that exports the full configuration database to a local file, satisfying the requirement for a valid backup method. This manual export captures device manager settings, policy packages and ADOM configuration, making it a legitimate, supported approach alongside scheduled backups.

Why this answer

Option B is correct because FortiManager's System Settings GUI includes a Backup/Restore page where an administrator can manually export the full configuration (including ADOMs and device databases) to a local file. Option D is correct because FortiManager supports scheduled backups that push configuration backups to an FTP, SFTP, or SCP server via the 'set backup-mode' and related CLI/GUI scheduling settings. Option A is not a native FortiManager backup method, as USB copy is not a supported configuration backup mechanism on FortiManager.

Option C is wrong because the Backup button belongs to FortiGate, not FortiManager. Option E is wrong because FortiManager does not perform automatic cloud sync of its configuration to FortiCloud.

Exam trap

The trap is mixing up FortiGate backup methods with FortiManager backup methods; candidates may think the FortiGate's backup button or USB backup applies to FortiManager, but they are distinct.

Practice this question →

49

MCQeasy

What is the purpose of the 'Add Device' wizard?

A.To update the FortiGate firmware.

B.To register a new device to be managed by FortiManager.

C.To migrate policies.

D.To configure VPN tunnels.

AnswerB

The Add Device wizard registers a FortiGate or other supported device with FortiManager, adding it to the device manager so it can be centrally managed. It does not configure interfaces or install policy; it only establishes the management relationship.

Why this answer

The 'Add Device' wizard in FortiManager is specifically designed to add and register a new FortiGate or other supported device so that it can be centrally managed by FortiManager. This process involves specifying the device's serial number, IP address, and credentials, after which FortiManager can push configuration, policies, and firmware updates to the device. It is the initial step to bring a device under FortiManager's management umbrella.

Exam trap

FORTINET-NSE56 often tests the distinction between initial device onboarding and subsequent management tasks, so candidates may confuse the 'Add Device' wizard with other wizards like firmware upgrade or policy import.

How to eliminate wrong answers

Option A is wrong because updating FortiGate firmware is done through the 'Firmware Upgrade' feature or via FortiManager's firmware management, not the 'Add Device' wizard. Option C is wrong because policy migration is typically handled through the 'Policy & Objects' section or using the 'Import Policy' wizard, not the 'Add Device' wizard. Option D is wrong because VPN tunnel configuration is performed within the FortiGate's VPN settings or via FortiManager's VPN Manager, not through the 'Add Device' wizard.

Practice this question →

50

MCQeasy

How are Revision Histories primarily used in FortiManager when a device configuration has been modified locally on the FortiGate?

A.To automatically roll back local changes without user input.

B.To perform a diff between the current device configuration and stored revisions.

C.To create new ADOMs.

D.To schedule daily firmware upgrades.

AnswerB

Revision Histories capture configuration snapshots each time FortiManager retrieves an updated configuration from the managed FortiGate, so after local edits you can diff the current device configuration against any stored revision. This satisfies the scenario's need to identify exactly which local changes were made before restoring or reconciling them.

Why this answer

Revision History in FortiManager stores snapshots of device configuration each time a change is made, whether pushed from FortiManager or detected from the FortiGate. When a device has been modified locally, the administrator can use Revision History to run a diff between the current running configuration and any stored revision, revealing exactly what changed out-of-band. This is the primary diagnostic use of the feature.

Exam trap

FORTINET-NSE56 often tests whether candidates assume Revision History performs automatic rollback — it does not; it is a comparison and manual-restore tool, and the diff is the key diagnostic capability.

How to eliminate wrong answers

Option A is wrong because Revision History does not automatically roll back local changes — rollback is a manual action an administrator must initiate after reviewing the diff. Option C is wrong because ADOMs are administrative containers created via System Settings > All ADOMs, not through Revision History. Option D is wrong because firmware upgrade scheduling is handled by FortiManager's firmware management or upgrade tools, not by Revision History.

Practice this question →

51

Multi-Selecthard

Which THREE of the following are true regarding 'Revision History'?

Select 3 answers

A.It restricts administrative access.

B.It automatically deletes old logs.

C.It stores snapshots of device configurations.

D.It facilitates reverting to a known-good state.

E.It allows comparing two different configurations.

AnswersC, D, E

Revision History retains configuration snapshots of managed devices, allowing administrators to review or revert to earlier states. This satisfies the stem's requirement for a true statement, as each revision captures the device configuration at that point.

Why this answer

Option C is correct because Revision History stores snapshots of device configurations, capturing the full configuration state at each revision so changes are preserved over time. Option D is correct because those stored snapshots enable reverting to a known-good state, letting an administrator roll back to a prior working configuration if a change causes problems. Option E is correct because Revision History supports comparing two different configurations, allowing an admin to diff revisions and identify exactly what changed between them.

Options A and B are not correct: Revision History is not an administrative access-control mechanism (that is the role of role-based access control or admin accounts), and it does not automatically delete old logs — it retains configuration revisions rather than managing or purging log data.

Exam trap

The trap is confusing Revision History with access control or log retention — candidates may pick 'restricts administrative access' or 'automatically deletes old logs' because those sound like management features, but revision history is specifically about configuration snapshots, comparison, and rollback.

Practice this question →

52

Multi-Selectmedium

Which TWO of the following are true about 'Scripts' in FortiManager?

Select 2 answers

A.They can only be run once.

B.They can be scheduled to run at specific times.

C.They automatically convert to policies.

D.They require a separate license.

E.They can be run on multiple devices simultaneously.

AnswersB, E

FortiManager script scheduling satisfies the requirement to run scripts at defined times without manual intervention. The scheduler executes scripts against managed FortiGate devices at configured intervals or fixed times, enabling automated configuration changes and compliance enforcement across device groups. This directly matches the stem's constraint of time-based execution.

Why this answer

Option B is correct because FortiManager scripts support scheduling, allowing an administrator to define when a script executes (for example, a one-time run at a future date/time or a recurring schedule) rather than only running it manually on demand. Option E is correct because FortiManager scripts can be executed against multiple managed FortiGate devices at once, either by selecting several devices or by targeting a device group, which is a core benefit of centralized script management. Option A is wrong because scripts are not limited to a single execution; they can be run repeatedly and can also be scheduled.

Option C is wrong because scripts execute CLI commands or configuration snippets on devices and do not automatically transform into policy objects or policy packages. Option D is wrong because scripting is a built-in FortiManager feature and does not require a separate add-on license.

Exam trap

The trap is assuming scripts are one-time or require extra licensing; candidates may confuse scripts with other features like policies or think they are limited, but they are flexible automation tools.

Practice this question →

53

MCQhard

A FortiManager administrator attempted to install a policy package, but the installation failed due to an object conflict. Where can the administrator view the detailed reason for the installation failure?

A.Device Manager > Revision History

B.System Settings > Event Log

C.Policy & Objects > Task Monitor

D.Policy & Objects > Installation Targets

AnswerC

Policy & Objects > Task Monitor records installation tasks and exposes the detailed conflict reason, such as which object clashed and on which device. This satisfies the stem's requirement to view the specific failure cause after a policy package install fails, rather than only a generic error summary.

Why this answer

FortiManager logs all policy installation tasks in the Task Monitor, accessible under Policy & Objects > Task Monitor. When an installation fails due to an object conflict or any other reason, the Task Monitor shows the task status, the affected device, and a detailed log with the specific error message (e.g., which object conflicted and why). This is the primary place to diagnose installation failures.

Exam trap

The trap is confusing the Task Monitor (which shows installation task details) with Revision History or Event Log — candidates often pick Revision History because it sounds like it would contain change details, but it does not show install errors.

How to eliminate wrong answers

Option A is wrong because Device Manager > Revision History shows configuration revision history for a device, not the detailed error log of a failed installation task. Option B is wrong because System Settings > Event Log records system-level events (admin logins, system changes), not policy installation task details. Option D is wrong because Policy & Objects > Installation Targets only shows which devices a policy package is assigned to — it does not display installation error details.

Practice this question →

54

MCQmedium

If an administrator uses the 'Import Policy' function, what is the effect on the FortiManager ADOM?

A.It forces a firmware downgrade.

B.It automatically creates a new ADOM.

C.It deletes all existing policies in the ADOM.

D.It merges the FortiGate policies into the FortiManager policy package.

AnswerD

Import Policy pulls the FortiGate's existing policy set into the ADOM's policy package, merging those rules rather than replacing the package wholesale. This satisfies the scenario where existing FortiManager objects and the device's policies must coexist after import.

Why this answer

The 'Import Policy' function in FortiManager retrieves the policy configuration from a managed FortiGate and merges it into the FortiManager policy package for that device or ADOM. This is used when a FortiGate has been configured locally and the administrator wants FortiManager's database to reflect the device's actual policy set, enabling centralized management going forward.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse 'Import Policy' (pull device config into FortiManager) with 'Install' (push FortiManager config to device) — the direction of the operation is the key distinction.

How to eliminate wrong answers

Option A is wrong because Import Policy has no effect on firmware versions — firmware management is a separate FortiManager function. Option B is wrong because Import Policy does not create a new ADOM; ADOMs are created manually or during device onboarding, and Import Policy operates within an existing ADOM. Option C is wrong because Import Policy does not delete existing policies — it merges or adds the device's policies into the policy package, preserving existing entries unless the administrator explicitly chooses to overwrite.

Practice this question →

55

MCQmedium

When deploying a policy package, what is the function of the 'Policy Package Status' column in the Install Wizard?

A.It displays the device firmware version.

B.It indicates if the package is in sync with the device.

C.It shows the last modified date.

D.It shows the number of policies in the package.

AnswerB

The Policy Package Status column compares the policy package's revision against the revision currently installed on the target device, flagging whether they match. This satisfies the stem's requirement by showing, before installation proceeds, which packages are already in sync and which require deployment to bring the device up to date.

Why this answer

In the Install Wizard, the Policy Package Status column shows whether the policy package currently installed on the target device matches the version in FortiManager — i.e., whether the device is in sync or out of sync. This lets the administrator see at a glance which devices need a policy install. A green/consistent status means no changes are pending; a modified status means the FortiManager copy differs from the device.

Exam trap

FORTINET-NSE56 often tests whether candidates know the Install Wizard's status column reflects configuration sync state, not metadata like firmware, dates, or policy counts.

How to eliminate wrong answers

Option A is wrong because firmware version is displayed in Device Manager or the device dashboard, not in the Policy Package Status column of the Install Wizard. Option C is wrong because last-modified timestamps appear in the policy package list, not as the status column's purpose. Option D is wrong because the number of policies is shown in the policy package details, not in the status column, which reflects sync state.

Practice this question →

56

Multi-Selectmedium

Which TWO components can be included in a 'Provisioning Template' to manage device settings?

Select 2 answers

A.System Templates

B.ADOM Variables

C.CLI Templates

D.Firewall Policies

E.Firmware Images

AnswersA, C

System Templates are a provisioning component that carries system-level settings, such as DNS, NTP and administrative configuration, into a Provisioning Template. This satisfies the requirement for a component that manages device settings, complementing the other included template type.

Why this answer

In FortiManager, a Provisioning Template is used to preconfigure devices before or during onboarding, and it can contain two types of components: System Templates (option A) and CLI Templates (option C). System Templates (A) are correct because they define standardized system-level settings such as DNS, NTP, SNMP, and administrative parameters that can be applied to managed devices. CLI Templates (C) are correct because they let you push raw FortiOS CLI configuration snippets to devices, allowing granular or vendor-specific settings that system templates do not cover.

ADOM Variables (B) are not standalone provisioning template components; they are variables referenced within templates and policies, not a template type themselves. Firewall Policies (D) are managed through policy packages, not provisioning templates. Firmware Images (E) are handled via firmware management tasks or upgrade tools, not as provisioning template components.

Exam trap

FORTINET-NSE56 often tests whether candidates can distinguish between the two valid template types (System and CLI) and unrelated FortiManager features like ADOM Variables, Policy Packages, and Firmware management that sound related but serve different purposes.

Practice this question →

57

MCQmedium

What is the primary purpose of using 'Provisioning Templates' in FortiManager?

A.To manage FortiClient endpoints.

B.To create firewall policies across all devices.

C.To generate performance reports.

D.To standardize system settings like NTP, DNS, and logging on multiple devices.

AnswerD

Provisioning Templates in FortiManager push consistent system-level configuration—NTP, DNS, and logging—to managed FortiGate devices, satisfying the requirement to standardise these settings across multiple devices simultaneously. Unlike policy packages, which handle firewall rules, they target device-wide parameters, ensuring uniform baseline configuration without manual repetition per device.

Why this answer

Provisioning Templates in FortiManager are used to standardize and automate the configuration of system-level settings such as NTP, DNS, logging, and other device-wide parameters across multiple FortiGate devices. They ensure consistency and reduce manual configuration errors when onboarding or managing many devices. They are not used for firewall policies, endpoint management, or reporting.

Exam trap

FORTINET-NSE56 often tests the confusion between Provisioning Templates (system settings) and Policy Packages (firewall policies), so candidates must distinguish device-level baseline configuration from security policy management.

How to eliminate wrong answers

Option A is wrong because FortiClient endpoint management is handled by FortiClient EMS, not FortiManager Provisioning Templates. Option B is wrong because firewall policies are created and managed through Policy Packages, not Provisioning Templates. Option C is wrong because performance reports are generated by FortiAnalyzer or FortiManager's reporting features, not by Provisioning Templates.

Practice this question →

58

MCQmedium

What is the function of the 'Check for Updates' feature in FortiManager's FortiGuard settings?

A.To check for new FortiGate hardware models.

B.To update antivirus, IPS, and application control signatures.

C.To verify the license key.

D.To update the FortiManager firmware.

AnswerB

Check for Updates pulls the latest FortiGuard antivirus, IPS and application control signature packages from the distribution server into FortiManager, which then pushes them to managed devices. This satisfies the stem's question about the feature's function.

Why this answer

The 'Check for Updates' feature in FortiManager's FortiGuard settings queries the FortiGuard Distribution Network (FDN) to retrieve the latest antivirus, IPS, application control, web filter, and other security service signature packages. These signatures are then distributed to managed FortiGate devices so their security profiles can detect current threats. It does not touch hardware inventory, licensing, or FortiManager's own firmware.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse FortiGuard signature updates with firmware upgrades or license checks — the trap is picking 'update the FortiManager firmware' because the word 'update' appears in the feature name.

How to eliminate wrong answers

Option A is wrong because FortiGate hardware model discovery is handled through device discovery/adding devices, not FortiGuard signature updates. Option C is wrong because license validation is performed via FortiCare registration and license status checks, not the FortiGuard 'Check for Updates' button. Option D is wrong because FortiManager firmware upgrades are performed through the System Settings > Firmware Upgrade path, not through FortiGuard settings.

Practice this question →

59

MCQmedium

If an administrator wants to perform a 'Config Check' to see what changes will be deployed during an installation, which option should they select in the 'Install Wizard'?

A.Policy Check

B.Install Config

C.Install Preview

D.Sync Device

AnswerC

Install Preview runs a dry-run comparison between the running configuration and the pending policy package, listing exactly which objects and rules would change without committing them. This satisfies the administrator's requirement to see what changes will be deployed during installation, before any actual deployment occurs.

Why this answer

The 'Install Preview' option in the FortiManager Install Wizard generates a diff showing exactly what configuration changes will be pushed to the target device before the install actually runs. This lets administrators review the delta and catch unintended changes before deployment.

Exam trap

The trap is confusing 'Policy Check' (semantic validation) with 'Install Preview' (config diff) — both are pre-install steps, but only one shows the actual changes to be deployed.

How to eliminate wrong answers

Option A is wrong because 'Policy Check' validates policy consistency and conflicts but does not show the full config diff that will be deployed. Option B is wrong because 'Install Config' actually performs the installation rather than previewing it. Option D is wrong because 'Sync Device' is not the preview function — it relates to synchronizing device state, not showing a pre-install diff.

Practice this question →

60

MCQmedium

What is the consequence of deleting a device from an ADOM in FortiManager?

A.The FortiGate is automatically rebooted.

B.The FortiGate will stop passing traffic.

C.The FortiGate configuration is wiped.

D.The FortiGate is no longer managed by that ADOM.

AnswerD

Deleting a device removes its entry from the ADOM's device list, so FortiManager stops pushing policy packages and configuration to it. The FortiGate keeps running its last-installed configuration, but that ADOM no longer manages it, satisfying the scenario's consequence.

Why this answer

Deleting a device from an ADOM in FortiManager only removes the management association between that FortiGate and the ADOM. The FortiGate itself keeps running with its current configuration and continues passing traffic; it simply is no longer managed within that ADOM.

Exam trap

The trap is assuming FortiManager deletion has a destructive effect on the FortiGate — candidates may pick 'configuration wiped' or 'stops passing traffic,' but the correct answer is simply loss of management association.

How to eliminate wrong answers

Option A is wrong because FortiManager does not reboot managed FortiGates when they are removed from an ADOM. Option B is wrong because removing management does not stop the FortiGate from forwarding traffic — its local config remains active. Option C is wrong because FortiManager does not wipe the FortiGate configuration on ADOM removal; the device retains its running config.

Practice this question →

61

MCQhard

When configuring 'Global Objects' in FortiManager, what happens to the specific objects in the ADOM-level database?

A.They are hidden from the administrator.

B.They are deleted.

C.They are referenced by the ADOM.

D.They are converted to CLI commands.

AnswerC

Global objects are stored once in the global database, and each ADOM holds only a reference pointer to them rather than a duplicate copy. This satisfies the question's constraint: the ADOM-level database does not own the object, it merely references the global definition, so edits propagate everywhere.

Why this answer

When an object is configured as a Global Object in FortiManager, it is stored in the Global Database (ADOM) and can be referenced by policies and objects within individual ADOMs. The ADOM-level database does not duplicate or delete the object; instead, it maintains a reference to the global object, allowing centralized management while still being usable in ADOM-specific policies.

Exam trap

FORTINET-NSE56 often tests the misconception that global objects are copied or deleted at the ADOM level, when in fact they are referenced, preserving a single source of truth.

How to eliminate wrong answers

Option A is wrong because global objects are visible and usable by administrators with appropriate permissions; they are not hidden. Option B is wrong because global objects are not deleted from the ADOM-level database; they are referenced, not removed. Option D is wrong because global objects are not converted to CLI commands; they remain as objects in the FortiManager database and are pushed to managed devices as configuration.

Practice this question →

62

MCQmedium

When modifying a policy package, what does 'Lock' indicate?

A.The package is deleted.

B.The package is ready to be pushed.

C.The package cannot be edited by other admins.

D.The package is corrupted.

AnswerC

Locking a policy package takes an exclusive workspace lock, so other administrators cannot edit it until the lock is released or expires. This satisfies the constraint that concurrent modifications to the same package are prevented, avoiding conflicting changes.

Why this answer

In FortiManager, locking a policy package indicates that an administrator has taken exclusive edit control over it. While locked, other administrators cannot modify the package, preventing concurrent edits and configuration conflicts. The lock must be released before others can edit or before the package can be installed (in some workflows).

Exam trap

FORTINET-NSE56 often tests the confusion between lock status and installation readiness, tricking candidates into thinking a locked package is ready to push or is corrupted.

How to eliminate wrong answers

Option A is wrong because locking does not delete the package; it merely restricts editing. Option B is wrong because 'ready to be pushed' is not what lock indicates—a package can be locked and still not ready for installation; readiness depends on validation and workflow state. Option D is wrong because lock has nothing to do with corruption; it is an administrative control feature.

Practice this question →

63

Multi-Selecthard

When defining an Install Workflow, which THREE settings or options can be configured to manage the deployment process?

Select 3 answers

A.Change Firmware automatically

B.Set Notification Email

C.Auto-install on Approve

D.Delete Policy after Install

E.Enable Approval

AnswersB, C, E

Notification Email is an Install Workflow setting that emails nominated recipients when a deployment is submitted, approved or installed. It satisfies the stem's requirement for a configurable deployment-management option by keeping administrators informed of workflow state changes without manual polling.

Why this answer

In an Install Workflow, the option 'Set Notification Email' (B) is correct because it lets administrators specify the recipient address that receives status messages about the deployment, enabling monitoring of the install process. 'Auto-install on Approve' (C) is correct because it defines whether the installation proceeds automatically once an approval is granted, removing the need for a separate manual trigger. 'Enable Approval' (E) is correct because it turns on the approval gate in the workflow, requiring an authorized user to approve the deployment before it can continue. The remaining options do not belong: 'Change Firmware automatically' (A) is a hardware/firmware update action rather than an Install Workflow deployment setting, and 'Delete Policy after Install' (D) is a policy lifecycle/cleanup action, not a configurable option for managing the deployment process itself.

Exam trap

The trap is picking plausible-sounding but non-existent options like 'Change Firmware automatically' or 'Delete Policy after Install' — candidates must know the actual Install Workflow fields (approval, auto-install, notification) rather than guessing at lifecycle actions.

Practice this question →

64

MCQhard

An administrator wants to perform a 'Re-install Policy' on a subset of devices without changing their current configuration settings. Which install option should be selected?

A.Install Config and Policy

B.Re-install Policy

C.Factory Reset and Install

D.Install Device Settings

E.Re-install Objects Only

AnswerB

Re-install Policy pushes the existing policy package to the selected endpoints without altering any configuration values, satisfying the requirement to refresh policy on a subset of devices while preserving their current settings. It re-applies the same assigned policy rather than modifying or replacing it, so no configuration changes occur.

Why this answer

The 'Re-install Policy' option pushes the existing policy package to the target devices without altering device-level settings or object definitions, effectively re-applying the current policy configuration. It is used when policies need to be re-pushed (e.g., after a failed install or to resynchronize) while preserving the device's current configuration.

Exam trap

FORTINET-NSE56 often tests whether candidates confuse 'Re-install Policy' (policy-only push) with 'Install Config and Policy' (full push) or 'Re-install Objects Only' (objects-only push), leading them to pick an option that changes device settings.

How to eliminate wrong answers

Option A (Install Config and Policy) is wrong because it installs both device configuration and policy, which would change device settings — not what the administrator wants. Option C (Factory Reset and Install) is wrong because it wipes the device configuration before installing, which is destructive and unrelated to a simple policy re-install. Option D (Install Device Settings) is wrong because it only pushes device-level settings (interfaces, routing, etc.), not the policy package.

Option E (Re-install Objects Only) is wrong because it only reinstalls object definitions, not the full policy package.

Practice this question →

65

MCQmedium

How can you view the 'Total' number of policies in a specific policy package?

A.In the Device Manager.

B.Using a CLI script.

C.In the Policy & Objects tab list view.

D.By going to the Dashboard.

AnswerC

The Policy & Objects tab's list view displays the policy package contents with a Total counter, giving the exact policy count for the selected package. Other views, such as installation or device managers, do not present that per-package total.

Why this answer

The total number of policies in a policy package is displayed in the Policy & Objects tab list view, where FortiManager shows the policy list along with a count. This is the standard GUI location for reviewing and counting policies within a package.

Exam trap

The trap is confusing device-level or dashboard views with policy package views — candidates may look in Device Manager or the Dashboard, but the policy count lives in the Policy & Objects tab list view.

How to eliminate wrong answers

Option A is wrong because Device Manager shows device inventory and status, not policy package policy counts. Option B is wrong because a CLI script is used to automate configuration changes, not to view policy totals in the GUI. Option D is wrong because the Dashboard shows system health and alerts, not per-package policy counts.

Practice this question →

Ready to test yourself?

Try a timed practice session using only Nse5 Fortimanager Operations questions.

Start 20-question session