Fortinet FCP_FMG_AD-7.6 Exam Dumps

The FortiManager 7.6 Administrator Study Guide is explicit for the scenario where both FortiManager and FortiGate are behind NAT. It states that FortiManager can discover FortiGate through the FortiGate NATed IP address, which makes A correct. It also explains that in this scenario, the FortiManager NATed IP address is not configured on FortiGate by default under central management, which makes B correct.

C is incorrect because FortiGate must use the FortiManager NATed IP address, not the non-NATed IP, if it needs to announce itself or reestablish the FGFM tunnel. D is also incorrect because in this NAT scenario, if the tunnel is torn down, only FortiGate attempts to reestablish the connection; FortiManager does not automatically do so.

=========

The correct answer is D. The lab guide explains that when an installation fails, the installation log shows the commands that the managed device received and accepted, as well as the commands that the managed device did not accept.

From the exhibit, FortiGate accepted the policy creation commands for policy ID 2 such as set srcintf port3, set dstintf port1, set srcaddr all, set dstaddr all, set action accept, and set schedule always. However, the line set users student failed with ''entry not found in datasource'' and ''value parse error before 'student'''. That shows the user reference was not accepted, while the rest of the policy commands were processed. Therefore, policy ID 2 is still created, but without the remote user student. This rules out A, B, and C.

=========

The correct conclusion is D. The FortiManager 7.6 Administrator Study Guide defines Never Installed as a state where the policy package was never created and was never imported for a managed device. That means FortiManager may already know the device itself at the device layer, but the firewall policy layer has not yet been built for that device.

The lab guide confirms this behavior directly: when you choose Import Later in the Add Device wizard, the policy package status becomes Never Installed because there is still no policy package created for the added FortiGate devices.

So this is not a revision-history issue, and it does not mean ADOM policy changes are merely waiting for first install. It means the policies still exist only on the managed device side until they are imported into a FortiManager policy package.

=========

The exhibit shows a FortiManager HA cluster with one primary and one secondary member. The FortiManager 7.6 Administrator Study Guide clearly states that if FortiAnalyzer features are enabled, you cannot configure FortiManager HA, so in an HA environment like the one shown, FortiAnalyzer features are not enabled. That makes D the correct answer.

A is incorrect because the study guide explicitly says you do not need to reboot a device when promoting it from secondary to primary.

C is incorrect because the failover mode shown is Manual, not VRRP automatic failover, so failover does not occur automatically based on heartbeat loss.

B is not the best answer here because FortiGuard packages are downloaded separately rather than synchronized as HA data, but the exhibit's key provable conclusion is the HA restriction on FortiAnalyzer features.

=========

The global policy package is managed only from the global ADOM by the service provider administrator. Customer administrators with access solely to their ADOM (My_ADOM) cannot edit the global header policy; such changes must be made by the service provider administrator in the global ADOM.