The correct answer involves selecting the target devices and clicking 'Install', along with using the install preview to review changes before deployment. The install preview is critical because it generates a detailed diff of the policy package against each firewall’s current configuration, showing every addition, deletion, or modification—this prevents unintended disruptions by allowing the administrator to verify exactly what will be pushed. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of FortiManager’s staged deployment workflow within an ADOM, where the common trap is assuming that simply saving the policy package pushes it automatically. Remember, the install preview is your safety net, and the manual 'Install' button is the final trigger—think "Preview then Push" to avoid policy chaos.
NSE7 Enterprise Firewall and VDOMs Practice Question
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator needs to use FortiManager to deploy a new security policy to all firewalls in a specific ADOM. Which two steps are part of the installation process? (Choose two.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run the install preview to see the changes that will be applied
Option B is correct because the install preview in FortiManager allows the administrator to review the exact configuration changes (adds, deletes, modifications) that will be pushed to the target devices before committing the installation. This step is critical to avoid unintended policy disruptions, as it shows a diff of the policy package against the current device configuration. Option C is correct because selecting target devices and clicking 'Install' is the final manual step that triggers the actual deployment of the policy package to the chosen firewalls within the ADOM.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Configure revision history to track changes
Why it's wrong here
Revision history is automatic; it does not need to be manually configured for each install.
✓
Run the install preview to see the changes that will be applied
Why this is correct
Install preview shows the differences between the current and new configuration.
Related concept
Read the scenario before looking for a memorised answer.
✓
Select the target devices and click 'Install'
Why this is correct
After making changes, the admin selects devices and initiates installation.
Related concept
Read the scenario before looking for a memorised answer.
✗
Create a new ADOM for the policy package
Why it's wrong here
Policy packages exist within an ADOM; creating a new ADOM is not required.
✗
Enable automation stitches to push the policy
Why it's wrong here
Automation stitches are for event-triggered actions, not for manual policy deployment.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse the 'install preview' (a read-only verification step) with the actual 'install' action, or they mistakenly think that revision history or automation stitches are mandatory prerequisites for deploying a policy package.
Detailed technical explanation
How to think about this question
Under the hood, FortiManager uses a policy package database that stores the intended configuration, and the install preview generates a device-level CLI diff by comparing the policy package's compiled output with the current running configuration on each target FortiGate. This diff is produced via the FortiManager's internal 'config check' mechanism, which validates syntax and dependencies before any commit. In real-world scenarios, skipping the install preview can lead to silent policy conflicts or ACL order mismatches, especially when deploying to hundreds of devices in a large ADOM.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A practitioner preparing for the NSE7 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Run the install preview to see the changes that will be applied — Option B is correct because the install preview in FortiManager allows the administrator to review the exact configuration changes (adds, deletes, modifications) that will be pushed to the target devices before committing the installation. This step is critical to avoid unintended policy disruptions, as it shows a diff of the policy package against the current device configuration. Option C is correct because selecting target devices and clicking 'Install' is the final manual step that triggers the actual deployment of the policy package to the chosen firewalls within the ADOM.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiManager administrator is planning to deploy a new policy package to a FortiGate that has multiple VDOMs. To ensure the policy package is applied correctly to the target VDOM, which THREE steps should the administrator take?
hard
✓ A.Install the policy package to the FortiGate, selecting the correct VDOM
✓ B.Create a new policy package in the ADOM corresponding to the target VDOM
C.Configure a revision history to track changes
✓ D.Assign the FortiGate to the policy package
E.Enable central management on the FortiGate
Why A: Option A is correct because when installing a policy package to a FortiGate with multiple VDOMs, the administrator must select the correct target VDOM in the installation wizard. This ensures the policy package is applied to the intended VDOM and not to the global or another VDOM, which could cause policy conflicts or security gaps.
Variation 2. An administrator uses FortiManager to deploy a new security policy to a remote FortiGate. The administrator selects 'Install Preview' and sees that the policy will be created. After confirming, the installation fails with 'Device not reachable'. What is the most likely reason?
medium
A.The FortiGate has insufficient memory
B.The policy package is locked by another administrator
C.The FortiGate's configuration revision has changed since the last sync
✓ D.The FortiGate is behind a NAT device that blocks FGFM traffic
Why D: The 'Device not reachable' error during an Install Preview operation indicates that FortiManager cannot establish or maintain the FGFM (FortiGate-to-FortiManager) tunnel with the remote FortiGate. When the FortiGate is behind a NAT device, the NAT may alter the source IP or port of FGFM traffic, causing the tunnel to break or preventing the FortiManager from reaching the FortiGate's management IP. This is the most common cause of such reachability failures in remote deployments.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.