FCP_FMG_AD-7.4 FCP - FortiManager 7.4 Administrator Questions and Answers

The import report indicates that the "firewall service category" namedGeneralwasSKIPPEDdue to being aDUPLICATE. This means FortiManager did not update its database with this value since it already exists. It simply ignored the duplicate without making any changes to the database for that object.

From the log provided in the exhibit, several conclusions can be drawn regarding the installation of Policy ID 2:

The installation process fails when attempting to set theLDAP user "student". The log shows:

"Attribute 'ldap-server' MUST be set.": This error indicates that when setting up the LDAP user configuration, a mandatory field (ldap-server) is missing. As a result, the configuration could not be completed for the user.

"entry not found in datasource"and"value parse error before 'student'": These errors confirm that the user "student" could not be properly added due to a configuration issue (such as the missing LDAP server).

Because of these errors, while other configuration elements (such as source and destination interfaces, actions, and services) are properly set, the user configuration for"student"isnot applied.

Evaluation of the answer options:

A. Policy ID 2 is installed in the disabled state.

This isfalse. There is no indication in the log that Policy ID 2 is disabled.

B. Policy ID 2 is installed without the remote user student.

This istrue. Due to the failure in setting the"student"user (as indicated by the errors), the policy will be installedwithoutthat user being properly configured.

C. Policy ID 2 will not be installed.

This isfalse. The policy is installed, but the user configuration failed. The rest of the policy configuration appears to have proceeded without critical errors that would prevent the installation.

D. Policy ID 2 is installed without a source address.

This isfalse. The log shows that the source address is properly set to "all" (set srcaddr all), so this is not the cause of the issue.

From the log exhibit, we see errors related to the "ldap-server" attribute not being set and an error with the entry "student" not being found in the datasource. This indicates that Policy ID 2 will not be installed due to missing or incorrect data required for successful installation. The "Command fail. Return code -3" confirms the installation failure, so the correct answer is C.

Options A, B, and D are incorrect because:

A suggests the policy is installed in a disabled state, which isn't supported by the log.

B and D suggest partial installation, but the error messages indicate a complete failure to install Policy ID 2.

FortiManager References:

Refer to FortiManager 7.4 Troubleshooting Guide: Common Errors and Log Interpretation.

FortiManager backups include:

A. All devices— This includes all device configurations managed by FortiManager, such as firewall policies, objects, and other settings.

D. Flash configuration— This consists of local FortiManager configurations stored in flash memory, such as system settings, scripts, and other locally-stored configurations.

Options B and C are incorrect because:

B (Firmware images)are not typically included in a FortiManager backup. Firmware images are usually stored separately and managed through a different process.

C (FortiGuard database)is incorrect as the FortiGuard database, which contains threat intelligence and security signatures, is not part of the standard FortiManager backup.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Backup and Restore Processes.

Two statements about Security Fabric integration with FortiManager that are true are:

A. The Fabric View module enables you to generate the Security Fabric ratings for Security Fabric devices.

The Fabric View module in FortiManager allows administrators to generate Security Fabric ratings, which assess the security posture of the entire Security Fabric environment.

C. The Fabric View module enables you to view the Security Fabric ratings for Security Fabric devices.

In addition to generating ratings, the Fabric View module provides visibility into the Security Fabric ratings for all connected devices, offering a consolidated view of security across the fabric.

Options B and D are incorrect because:

Bis misleading as the Security Fabric settings are generally configured and managed separately from other device-level settings.

Dis incorrect as there is no specific requirement for a Security Fabric license, group name, and password solely for FortiManager integration.

FortiManager References:

Refer to FortiManager 7.4 Security Fabric Integration Guide: Managing Security Fabric and Generating Security Fabric Ratings.

Security profiles (such as antivirus, web filtering, application control, etc.) are stored in the ADOM-level database because they can be shared across multiple devices within the same ADOM.

In workflow mode, changes made by junior administrators can be submitted for review. The administrator can then approve or reject these changes before they are applied. This ensures proper oversight and control over policy changes.

The characteristic of the FortiManager high availability (HA) feature is that the primary unit synchronizes all configuration revisions with the secondary units. This ensures that all devices in the HA cluster are up-to-date with the same configurations, providing redundancy and failover capabilities.

Options A, C, and D are incorrect because:

Arefers to a specific port number (5199), but FortiManager does not specifically use TCP port 5199 to update managed devices when a secondary unit is removed.

Cis incorrect as secondary units do not necessarily have to be in the same network as the primary unit; they just need to be able to communicate with each other.

Dis incorrect because HA upgrades can be automated and do not require manual upgrading, starting with the primary unit.

FortiManager References:

Refer to FortiManager 7.4 High Availability (HA) Guide: HA Synchronization and Configuration.

Option B: It allows FortiManager to respond to requests for FortiGuard services from FortiGate devices.This is the correct answer. When Service Access is enabled on FortiManager, it allows FortiManager to act as a local FortiGuard server for the managed FortiGate devices. This enables the FortiManager to respond to requests for FortiGuard services, such as updates for antivirus, web filtering, and other security services.

Explanation of Incorrect Options:

Option A: It allows administrative access to FortiManageris incorrect because Service Access is specifically for FortiGuard service communication, not for administrative access.

Option C: It allows third-party applications to gain read/write access to FortiManageris incorrect because Service Access does not provide API or third-party access capabilities.

Option D: It allows FortiManager to determine the connection status of managed devicesis incorrect because Service Access does not directly manage or check connectivity status of devices; it is used for FortiGuard service requests.

FortiManager References:

Refer to the "FortiManager Administration Guide," particularly the sections on "Service Access Settings" and "FortiGuard Services."

Option C: It will modify the device-level database.This is correct. Reverting to a previous revision version in the revision history affects the device-level database by restoring it to the state saved in the selected revision. This ensures that any changes made after the selected revision are discarded, and the device configuration is returned to the earlier state.

Explanation of Incorrect Options:

Option A: It will install configuration changes to managed devices automaticallyis incorrect because reverting a revision does not automatically push changes to the devices; it merely reverts the configuration on the FortiManager.

Option B: It will tag the device settings status as Auto-Updateis incorrect because "Auto-Update" is not a status related to the revision history mechanism.

Option D: It will generate a new version ID and remove all other revision history versionsis incorrect as reverting to a previous revision does not delete all other versions; it creates a new revision point for tracking.

FortiManager References:

Refer to the "Revision Management" section in the FortiManager Administration Guide, which provides an overview of how revisions are managed and utilized for restoring configurations.

Option B: 192.168.1.0/24is the correct answer. In FortiManager, when a firewall address object is defined and used across multiple policy packages without any Per-Device Mapping, the default value configured in the object definition (192.168.1.0/255.255.255.0) is applied to all devices. The exhibit shows that the address objectLOCAL_SUBNEThas a default IP/netmask of192.168.1.0/24. Therefore,FortiManager will use this default value for any FortiGate device that does not have a specific Per-Device Mapping configured.

Explanation of Incorrect Options:

Option A: FortiManager generates an error for each FortiGate without a per-device mapping defined for that objectis incorrect because FortiManager does not generate an error when a Per-Device Mapping is not set. Instead, it uses the default value provided in the object definition.

Option C: 192.168.1.0/28is incorrect because the default value is192.168.1.0/24, as seen in the exhibit, not/28.

Option D: FortiManager replaces the address object to noneis incorrect because FortiManager does not replace address objects to "none" when a Per-Device Mapping is missing; it uses the default value instead.

FortiManager References:

Refer to the FortiManager 7.4 Administration Guide, specifically in sections related to "Address Object Management" and "Per-Device Mapping," which detail the behavior of address objects without specific device mappings.