Central Management practice questions

System settings under 'Network' tab

Why it fails: Network tab configures interfaces and routing.

Global Policy settings

Why it fails: Global policy manages security rules, not log storage.

ADOM management settings

Why it fails: ADOM settings define the scope of management, not log purging.

Creating multiple ADOMs for every branch

Why it fails: ADOMs are for administrative separation, not policy sharing.

Manual copy-paste of rules

Why it fails: Copy-paste is prone to error and does not manage structure.

Using CLI templates exclusively

Why it fails: CLI templates do not manage policy structures effectively.

Set the FortiGate to 'Read-Only' mode

Why it fails: Read-only mode prevents local changes but does not enforce policy sync.

Enable ADOM-level scheduling

Why it fails: Scheduling controls when changes are pushed but not synchronization logic.

Configure a manual CLI script to push updates

Why it fails: Manual scripts do not ensure automatic synchronization.

multiple_choice

Why it fails: FGFM is the standard protocol.

HTTPS

Why it fails: HTTPS is used for the Web GUI, not device management.

SSH

Why it fails: SSH is for command-line access, not centralized policy management.

SNMP

Why it fails: SNMP is for monitoring, not management.

Policy Testing Mode

Why it fails: Testing mode is not a specific feature name.

Global Policy Lockdown

Why it fails: Lockdown is the opposite of testing.

Device Manager Simulation

Why it fails: No simulation mode exists for policies.

System Settings

Why it fails: System settings is for FMG maintenance.

Device Manager

Why it fails: Device manager is for device config.

Policy & Objects

Why it fails: Policy & Objects is for security rules.

CLI scripts

Why it fails: CLI scripts target FGTs.

Configuration scripts

Why it fails: Configuration scripts are CLI-based.

Policy scripts

Why it fails: Not a standard script type.

Database validation

Why it fails: Validation happens concurrently with preview.

Config push

Why it fails: Push occurs after verification.

Reboot

Why it fails: Rebooting is not part of a policy push.

External RADIUS server

Why it fails: RADIUS is for user authentication.

SNMP community string

Why it fails: SNMP is not for device registration.

IP-based automatic discovery

Why it fails: Discovery still requires identification keys.

Delete the entire ADOM

Why it fails: Deleting an entire ADOM is an administrative operation performed from ADOM management, not an action available on an individual Revision History item. It is tempting because revision records belong to an ADOM, but it would be correct when decommissioning a whole administrative domain.

Export the revision to an external cloud

Why it fails: FortiManager revision history supports revert, delete, lock and compare against the running configuration; no cloud export function exists. It is tempting because exporting configuration backups off-box is a genuine requirement, but that is met by scheduled backup to FTP, SCP or FortiManager's own repository, not by a revision item action.

Modify the version permanently

Why it fails: Revision History items are immutable snapshots; FortiManager lets you view, revert to, or delete them, but never edit a version in place. It is tempting because administrators routinely modify policy versions, yet that is done in the policy package, not the revision record.

Firewall policies

Why it fails: Policies are in the policy package.

Application control databases

Why it fails: Database updates are system-wide.

Traffic shaping on routers

Why it fails: Traffic shaping is a firewall rule setting.

Web filter database updates

Why it fails: This is a system-wide update.

Enable 'Auto Update' in the ADOM revision settings.

Why it fails: ADOM revision settings control automatic revision creation, not conflict resolution during installation. Auto Update does not retry failed installations or reconcile configuration changes made directly on the FortiGate. It simply creates a new ADOM revision when changes occur, which does not address the out-of-sync condition reported during policy installation.

Configure 'Install Settings' to automatically retrieve the configuration from the FortiGate before installing.

Why it fails: Install Settings allow you to specify options such as 'Auto Retrieve' before install, but this retrieves the device configuration and may overwrite FortiManager changes, not automatically retry after resolving conflicts. It does not provide automatic retry behavior. The administrator would still need to manually reconcile and reinstall.

Enable 'Auto Retry' in the FortiManager system settings.

Why it fails: FortiManager does not have a global 'Auto Retry' setting for policy installation. While the GUI may show a retry option after a failed install, it is a manual action, not an automatic system setting. This option is a plausible-sounding but nonexistent feature in FortiManager.

Use a dynamic object that references an external IP address and assign it to all devices.

Why it fails: Dynamic objects are used for objects whose IP addresses change frequently, such as those resolved via DNS. They are not intended for static, shared objects like a corporate DNS server with a fixed IP. Using a dynamic object would add unnecessary complexity and might not meet the requirement for a consistent static address across all devices.

Configure a per-device mapping for the address object and push it to all devices.

Why it fails: Per-device mapping is used when an object needs to have different values on different devices, such as when devices are in different geographic locations. The scenario requires the same address object on all devices, so per-device mapping would introduce unnecessary complexity and potential for error. It is not the correct approach for uniform object sharing.

Create the address object in the Global Database and assign it to each device's policy package.

Why it fails: Although the Global Database allows sharing objects across ADOMs, it is not the most efficient method for sharing within a single ADOM. It requires additional steps to assign objects to each device, and it is typically used for cross-ADOM sharing, not for devices within the same ADOM. The scenario calls for a simpler, centralized approach within the ADOM.

The FortiGate is in a different ADOM than the policy, so the installation did not apply to it.

Why it fails: If the FortiGate were in a different ADOM, the administrator would not see it in the current ADOM's device list. The scenario states the administrator manages the cluster in a single ADOM, so this is not the case. This option is incorrect because it contradicts the given information and is not a likely cause.

The FortiManager did not synchronize the configuration to the secondary FortiGate in the HA cluster.

Why it fails: In an HA cluster managed by FortiManager, the FortiManager installs configuration to the primary device, which then synchronizes to the secondary. The secondary does not receive separate installs. This option is incorrect because synchronization between HA members is automatic and not a FortiManager function. The issue is likely elsewhere, such as policy installation or revision control.

The policy was not installed to the FortiGate because the administrator did not commit the changes in the FortiManager workspace.

Why it fails: While committing changes in a workspace is necessary when workspace mode is enabled, the scenario does not mention workspace mode. The administrator could have installed directly without workspace mode. This option is plausible but not the most likely cause given the information. The key is that the policy installation process may have failed due to other reasons.

Script executed on each FortiGate via the CLI

Why it fails: A CLI script can be used to push configuration to devices, but it does not provide a centralized policy package that is automatically shared. You would have to run the script on each device or schedule it, and it would not integrate with the policy package workflow. This approach is manual and error-prone, and does not fulfill the requirement of creating the policy once and having it automatically available.

Policy package with a dynamic object for the internal subnet

Why it fails: Dynamic objects are used to resolve IP addresses at install time based on metadata variables, but they do not automatically replicate a policy across multiple FortiGates. You still need to assign the policy package to each device, and the policy itself is not shared unless you use a shared policy package. This does not meet the requirement of creating the policy once and having it automatically available to all devices.

Shared policy package in the global ADOM

Why it fails: A shared policy package in the global ADOM is used to share policies across multiple ADOMs, not within the same ADOM to multiple devices. While it can reduce duplication, it requires the global ADOM and does not automatically assign the policy to 12 devices in a single ADOM. The scenario does not mention multiple ADOMs, so this is not the intended feature.

Configure a 'Policy Package' with the 'Install on Policy Change' option enabled.

Why it fails: FortiManager does not have an 'Install on Policy Change' option within policy package settings. While you can schedule installs, there is no real-time trigger on policy change. This option is a plausible but incorrect feature name, and it would not provide the desired automation. Manual or scheduled installation remains necessary.

Enable 'Automatic Policy Deployment' in the FortiGate device settings.

Why it fails: There is no 'Automatic Policy Deployment' feature in FortiGate device settings within FortiManager. FortiManager centrally manages policies, and deployment is initiated from FortiManager, not from the FortiGate. This option incorrectly suggests a device-level setting that does not exist, and it would not fulfill the requirement.

Enable 'Auto Install' in the policy package settings.

Why it fails: Auto Install is not a feature in FortiManager policy packages. While FortiManager supports scheduled installs, there is no automatic push of changes upon modification. The administrator must manually install or schedule an install. This option misrepresents the capabilities and would not meet the requirement of automatic deployment upon change.

Enable 'Auto Update' in the FortiGate's central management settings.

Why it fails: Auto Update in the FortiGate's central management settings controls automatic firmware updates and is not used for configuration synchronization. It does not cause FortiManager to retrieve configuration changes made locally on the FortiGate. Therefore, this setting would not meet the requirement of detecting and pulling configuration changes.

Configure 'Policy & Objects' synchronization with a scheduled install.

Why it fails: Policy & Objects synchronization is a manual or scheduled action that pushes policies from FortiManager to the FortiGate. It does not automatically detect and retrieve changes made locally on the FortiGate. Scheduled installs only push configuration; they do not pull. Thus, this would not satisfy the requirement.

Enable 'Config Revision' and set it to auto-retrieve.

Why it fails: Config Revision in FortiManager allows you to view and compare configuration revisions, but it does not automatically retrieve changes from managed devices. You can manually retrieve revisions, but there is no auto-retrieve setting. Therefore, this option does not provide the automatic detection required.

Scripts

Why it fails: Scripts in FortiManager are used to execute CLI commands on managed devices, either manually or on a schedule. They can be used to retrieve configuration, but they are not a dedicated backup feature. Using scripts for backups would require custom scripting and does not provide the integrated management and versioning that Configuration Backup offers.

Revision History

Why it fails: Revision History in FortiManager tracks changes made to policies and objects within FortiManager, not backups of the FortiGate's configuration. It allows administrators to view and revert to previous versions of ADOM configurations, but it does not automatically back up the device's running configuration on a schedule.

Provisioning Templates

Why it fails: Provisioning Templates are used to define and push configuration settings to devices, not to back up existing configurations. They are applied during device provisioning or when changes are needed. They do not automatically retrieve and store device configurations on a schedule, so they are not suitable for backup purposes.

ADOMs (Administrative Domains)

Why it fails: ADOMs are used to partition the FortiManager database for administrative delegation and to group devices by region or function. While they organize devices, they do not directly provide a mechanism to apply the same policy to multiple devices. Policies are still managed per device or via policy packages within an ADOM. ADOMs are about segregation, not shared policy enforcement.

Device groups

Why it fails: Device groups are used to group FortiGates for monitoring and firmware upgrades, but they do not directly manage firewall policies. While you can install policies to a device group, the policies themselves are defined in policy packages. Device groups are more about organization and batch operations, not policy consistency. They do not provide a shared policy framework.

Revision control

Why it fails: Revision control tracks changes to configurations and allows rollback, but it does not facilitate applying the same policy across multiple devices. It is a versioning system for auditing and recovery. While important for change management, it is not a mechanism for centralized policy deployment. The focus is on history, not on consistent policy enforcement.