Nse7 Enterprise Firewall Central Management practice questions

System settings under 'Network' tab

Why it fails: System settings under the Network tab govern interface and routing parameters, not log storage thresholds. Log aggregation and purging are handled by FortiAnalyzer features, configured under the Logging & Reporting section. The Network tab would be the right place to adjust interface addressing or DNS, which is unrelated to this scenario.

Global Policy settings

Why it fails: Global policy manages security rules, not log storage.

ADOM management settings

Why it fails: ADOM management settings govern administrative scope, not log storage. Log aggregation and threshold-based purging are configured in FortiAnalyzer's device log settings, where retention and disk-usage limits apply. ADOM settings would be the right place to partition devices or administrators into separate management domains, which is unrelated to this requirement.

Creating multiple ADOMs for every branch

Why it fails: Separate ADOMs partition devices and objects, so branch offices would no longer share one common policy structure. It is tempting because ADOMs isolate administrative domains, but the requirement is shared policy structure with differing profiles, which policy packages deliver.

Manual copy-paste of rules

Why it fails: Manual copy-paste duplicates rules per device, breaking the shared policy structure and creating drift whenever the base changes. It is tempting as a quick fix for a few branches, but FortiManager policy packages assign different profiles to one common rule set.

Using CLI templates exclusively

Why it fails: CLI templates push device-level configuration, not security profiles bound within shared firewall policies. It is tempting because templates script repetitive settings, but they cannot vary profiles across branches while retaining one common policy structure; policy packages do that.

Set the FortiGate to 'Read-Only' mode

Why it fails: Read-Only mode prevents the FortiGate from accepting configuration changes, so it cannot receive pushed policy updates at all — synchronisation stops rather than being ensured. It is tempting because read-only sounds like a safe managed state, and it would suit a device you want to freeze for auditing or troubleshooting, not one receiving automatic updates.

Enable ADOM-level scheduling

Why it fails: ADOM-level scheduling controls when automatic installs or backups run; it does not itself reconcile device configuration with the policy database. The tempting appeal is that scheduling sounds like the automation mechanism, and it would be the right answer if the question asked how to time recurring policy installs across many devices.

Configure a manual CLI script to push updates

Why it fails: A manual CLI script is operator-triggered, so it cannot keep configuration synchronised during an automatic update; the stem specifies automatic. It is tempting because scripts can push configuration and are useful for one-off bulk changes or unsupported settings, but they bypass the FortiManager policy database rather than syncing with it.

Policy Testing Mode

Why it fails: No such FortiManager feature exists; policy changes are validated through the install wizard's preview and revision history rather than a named testing mode. It tempts administrators wanting pre-deployment validation, which FortiManager delivers via policy package installation preview against managed devices.

Global Policy Lockdown

Why it fails: Global Policy Lockdown is not a FortiManager sandbox feature; it governs concurrent editing of shared policy objects to prevent conflicting changes. It would be the correct control when multiple administrators edit the same ADOM objects, not when validating policy behaviour before production deployment.

Device Manager Simulation

Why it fails: Device Manager Simulation does not exist in FortiManager; the Device Manager simply organises managed FortiGate objects and install targets. It tempts those seeking sandbox validation, which FortiManager provides through installation preview and revision comparison rather than any simulated device manager.

HTTPS

Why it fails: HTTPS is used for the Web GUI, not device management.

SSH

Why it fails: SSH is for command-line access, not centralized policy management.

SNMP

Why it fails: SNMP is for monitoring, not management.

System Settings

Why it fails: System Settings holds administrative configuration such as administrators, HA and FortiAnalyzer device registration, not report output. Aggregated log reports are viewed under the Log View pane, which queries the connected FortiAnalyzer; System Settings is where the integration itself is configured, not where reports appear.

Device Manager

Why it fails: Device Manager displays managed FortiGate devices, their provisioning status and configuration, not log data. Aggregated reports from the integrated FortiAnalyzer appear under Log View, so Device Manager is the wrong pane; it would be relevant for pushing configuration or checking device inventory instead.

Policy & Objects

Why it fails: Policy & Objects defines firewall policies, addresses and services pushed to managed devices; it holds no log or report data. Aggregated FortiAnalyzer reports are viewed in Log View, so Policy & Objects is the wrong pane; it would be the correct place to author a security policy, not to read reports.

CLI scripts

Why it fails: CLI scripts run on managed FortiGate devices, not on FortiManager itself. It is tempting because FortiManager stores and distributes them, so it would be correct when you need to push configuration commands to managed devices rather than execute logic locally on the manager.

Configuration scripts

Why it fails: Configuration scripts are pushed to managed FortiGates to apply CLI settings, so they execute on the device, not FortiManager. They are tempting because they are the standard scripting tool for bulk provisioning; they would be correct when automating device-level configuration changes across many firewalls.

Policy scripts

Why it fails: Policy scripts install firewall policy packages onto managed devices, so they run on the FortiGate rather than FortiManager. They are tempting because they automate policy deployment; they would be correct when pushing consistent security policies to multiple managed firewalls from FortiManager.

Database validation

Why it fails: Validation runs after the install begins, not first; FortiManager first locks the ADOM and policy package, then verifies the revision. It tempts because validation is a genuine install stage, and it would be the answer if the question asked which stage detects conflicting or missing object references.

Config push

Why it fails: The config push to managed FortiGates occurs after validation and the install preview, so it cannot be the first stage. It tempts because pushing configuration is the visible outcome administrators associate with installing, and it would be correct if asked which stage actually delivers policy to the device.

Reboot

Why it fails: Rebooting is never part of the FortiManager install workflow; policies take effect without restarting managed devices. It tempts because some vendors require a reload to apply configuration, and it would be relevant only if a firmware upgrade or low-memory condition demanded a restart.

Traffic shaping on routers

Why it fails: Traffic shaping on routers belongs to standard FortiGate interface and shaper configuration, not to the Enterprise Firewall workflow's centralised management scope. That workflow targets policy packages, ADOMs and installation targets. It tempts administrators who conflate router-level QoS with firewall policy orchestration, but the workflow does not manage router shaping.

Web filter database updates

Why it fails: Web filter database updates are handled by FortiGuard services on the FortiGate itself, not by the Enterprise Firewall management workflow. That workflow centres on policy packages, provisioning templates and installation targets. It tempts administrators who associate all security profiles with centralised management, yet database distribution is a FortiGuard function, independent of workflow.

Registration-only mode

Why it fails: Registration-only mode lets a FortiGate appear in FortiManager for licensing or visibility but blocks policy and configuration pushes; central management requires the unit to be in normal mode. It tempts as a lightweight onboarding step, yet it deliberately withholds configuration control.

Backup mode

Why it fails: Backup mode is not a FortiGate operation mode; it describes FortiManager acting as a backup for another FortiManager in HA. A FortiGate must be in NAT or transparent mode, with central management enabled, for FortiManager to push configuration and policies. Backup mode is tempting because FortiManager does support HA backup roles, but that applies to managers, not managed devices.

Read-only mode

Why it fails: Read-only mode lets FortiManager retrieve the FortiGate's configuration and monitor status, but it cannot push policy or configuration changes, so central management fails. Full management requires the FortiGate to be in NAT or transparent mode with central management enabled. Read-only is tempting because it is a genuine FortiManager provisioning setting, correct when you only want monitoring or backup of device configuration.

Create 50 separate ADOMs

Why it fails: Fifty ADOMs fragment the estate, so the change must be repeated per ADOM and consistency across devices is not guaranteed; ADOMs partition administrative domains, not bulk deployment. They are tempting for separating tenants or regions, which is their genuine purpose, but a shared policy package pushed from one ADOM is needed here.

Connect to each FortiGate via SSH and run scripts

Why it fails: Per-device SSH scripting bypasses FortiManager's revision control and policy packages, so configuration drift and inconsistent results across the 50 FortiGates are likely. It is tempting for quick one-off commands, where it is genuinely useful, but simultaneous consistent deployment requires FortiManager policy packages and install wizard.

Enable 'Auto-Push' for every change

Why it fails: Auto-Push installs each policy change to assigned devices immediately, so an unfinished or erroneous edit propagates without review, risking downtime across all 50 FortiGates. It is tempting for keeping devices continuously synchronised, which suits stable environments, but controlled bulk rollout needs an explicit install of a validated policy package.

To provide high availability for the FortiGate

Why it fails: ADOMs partition administrative domains for policy and device grouping, not redundancy. High availability is delivered by FortiManager HA clustering, which is the correct answer when the requirement is failover of the manager itself rather than logical separation of managed devices.

To allow external API access to the FortiGate

Why it fails: ADOMs segment policy, objects and devices into separate administrative domains; they expose no API endpoint on FortiGates. External API access is provided by the FortiGate REST API or FortiManager JSON API, which would be the correct answer when programmatic configuration is required.

To increase the storage capacity of the FortiManager

Why it fails: An ADOM is a logical container for policies, objects and devices, so it consumes rather than expands disk. Storage capacity is addressed by FortiManager disk sizing or logging configuration, which would be correct when the requirement is retention volume rather than administrative partitioning.

Force an 'Import Policy' operation

Why it fails: Import Policy overwrites FortiManager's database with the device's configuration, potentially destroying the conflicting objects needed for diagnosis. It is tempting because it resynchronises a drifted device, but that scenario requires identifying the mismatch, which the policy-diff or revision-comparison tool reveals.

Reboot the FortiManager

Why it fails: Rebooting discards volatile state and interrupts every managed device's tunnel, yet the conflict persists because it lives in the policy package and device-level object database, not in runtime memory. It is tempting as a generic first-line fix, and would be reasonable for a hung daemon or memory leak, not for object mismatch diagnosis.

Disable the policy package entirely

Why it fails: Disabling the package removes it from installation scope, so the conflicting objects are never compared and the mismatch stays unidentified. It is tempting because it stops the failed install and restores service, and would be valid when you deliberately want to halt all policy pushes to affected FortiGates during maintenance.

IP Pool

Why it fails: An IP pool supplies NAT source addresses for outbound traffic; it holds no interface membership, so SD-WAN cannot draw members from it. It is tempting because SD-WAN rules do reference address objects, but grouping WAN links requires the SD-WAN interface member object itself, not a NAT pool.

Virtual Wire Pair

Why it fails: A virtual wire pair binds exactly two interfaces into a transparent inline path, so it cannot present multiple WAN links as selectable SD-WAN members. It is tempting because it does group interfaces, but its purpose is bump-in-the-wire filtering between two ports, not multi-link WAN selection.

Interface Group

Why it fails: An interface group bundles interfaces for administrative convenience, such as shared firewall policy references, but FortiManager assigns SD-WAN members through the SD-WAN interface object, which carries per-member gateway, cost and priority. Interface groups are tempting because they visibly collect WAN ports, yet they expose no SD-WAN member attributes.

Manually copy objects to each ADOM

Why it fails: Manual copying creates independent duplicates per ADOM, so later edits do not propagate and drift accumulates. It is tempting for a small, static set of objects, but that is a one-off scenario; sharing requires global objects referenced across ADOMs.

Use the API to script the creation in every ADOM

Why it fails: API scripting still creates separate objects in each ADOM, so updates must be re-run everywhere and drift persists. It is tempting for automating bulk provisioning, but that is a deployment scenario; genuine sharing needs global objects defined once and referenced by each ADOM.

Enable 'Object Sharing' in system settings

Why it fails: Global objects are shared by assigning them to a global ADOM and then per-ADOM policy packages, not by a system setting; no such toggle exists. It tempts because ADOM-level object reuse sounds like a simple checkbox, and it would fit a single-ADOM deployment consolidating duplicate address objects.

They are moved to a 'Disabled' state

Why it fails: Imported policies are added to FortiManager and remain enabled; they are not disabled during import. It is tempting because administrators expect a safety hold before pushing configuration, but FortiManager imports the policy set intact, and any disabled state results from later manual action.

They are deleted to ensure a clean slate

Why it fails: Importing a standalone FortiGate into FortiManager preserves its existing firewall policies; they are not deleted. Deletion occurs only when you explicitly remove them or overwrite with a policy package. The clean-slate idea tempts administrators who assume FortiManager enforces its own baseline, but that applies to managed devices provisioned from scratch.

They are merged into the Global Policy

Why it fails: Global Policy is a shared policy package applied across multiple managed FortiGates, not a merge target for imported local policies. Imported policies remain in the device's own policy package. The merge idea tempts those familiar with ADOM-level global objects, but global policy assignment is a deliberate administrative action, not an import side effect.

Automated patch management

Why it fails: FortiManager has no automated patch management feature; firmware is deployed through the Firmware Upgrade task, which stages images and supports per-device rollback. Patch management describes endpoint tools, correct when remediating OS vulnerabilities rather than upgrading FortiOS images.

Manual script pushing

Why it fails: Manual script pushing executes CLI commands but provides no firmware image staging, reboot orchestration or rollback. Scripts suit bulk configuration changes; the Firmware Upgrade task is correct when upgrading FortiOS across many devices with per-device rollback.

Global Policy upgrade task

Why it fails: Global Policy governs firewall policy packages across ADOMs; it does not distribute firmware images. The Firmware Upgrade task performs staged image deployment with rollback, and is correct whenever FortiOS versions must be changed across managed FortiGates.

Scripting

Why it fails: Scripting executes CLI or Tcl commands against devices already managed by FortiManager; it cannot pre-configure a device that has never connected. Pre-configuration before connection is done through provisioning templates applied to a model device. Scripting is tempting because it genuinely automates repetitive configuration tasks across existing managed FortiGates.

Device Registration Key

Why it fails: A device registration key authenticates a FortiGate to FortiManager during initial add, but it carries no configuration; the unit arrives with only its factory defaults. Pre-configuration requires a provisioning template assigned to a model device. The key is tempting because it is genuinely part of automated onboarding, correctly used to authorise and register new units securely.

Policy cloning

Why it fails: Policy cloning duplicates an existing firewall policy within FortiManager, typically for reuse across managed devices or ADOMs. It cannot pre-configure a FortiGate that has never connected, since no policy package is bound to it. Cloning is tempting because it genuinely speeds policy creation, and it is correct when replicating similar rules across already-managed FortiGates.

The FortiGate policy is sent to the FortiManager

Why it fails: Pushing sends the policy package from FortiManager down to the FortiGate, installing it there; this option reverses the direction, describing retrieval or import. It is tempting because FortiManager does receive policy information during import or retrieve operations, which is the correct answer when the question asks how device policy reaches the manager.

The policy is saved in a draft state on the FortiGate

Why it fails: A push installs the policy package directly on the FortiGate as the active configuration; draft state applies to policy packages edited within FortiManager before installation, not to the device after a push. It is tempting because FortiManager does hold uninstalled changes in a draft-like workflow, but that is manager-side, not device-side.

The FortiManager policy is appended to the existing FortiGate policy

Why it fails: A push replaces the FortiGate's policy package with the FortiManager version rather than appending to it; FortiManager is the authoritative source for managed policy. It is tempting because some configuration objects merge on install, but policy packages are overwritten, so appending would duplicate or conflict with existing rules.

The FortiManager license

Why it fails: A FortiManager licence governs management scale and features, not whether an individual FortiGate forwards logs; a licensed manager still receives nothing if the device's log settings are off. It is tempting because licensing failures do disable services, but the first check is the FortiGate's remote logging configuration.

The device's physical connection

Why it fails: Physical cabling affects all traffic, so management and other connectivity would also fail, not logs alone. It is tempting because link faults are a classic first diagnostic, but when a FortiGate is reachable in FortiManager yet silent in logs, the FortiGate's log-forwarding settings are the cause.

The firmware version of the FortiGate

Why it fails: Firmware version affects feature availability and compatibility, but mismatched versions do not stop an otherwise reachable FortiGate from sending logs. It is tempting because version drift causes many integration faults, yet the first check is whether the FortiGate's remote logging to FortiManager is enabled.