Fortinet FCP_FMG_AD-7.6 Exam Dumps

FortiManager must have the NAT device's IP address and correct ports configured to communicate properly with the FortiGate behind NAT.

The NAT device must have the correct virtual IP address and ports configured to allow push updates to reach the FortiGate device.

The correct answers are B and C. The FortiManager 7.6 Administrator Study Guide explicitly states: ''Scripts that you run directly on remote devices also cause automatic updates and create a revision history.'' This exact extract proves both results: FortiManager creates a new revision history and the device status becomes Auto-Updated, meaning the FortiGate change is automatically reflected in the FortiManager device-level database.

The lab guide also distinguishes this from database-targeted scripts by stating: ''You must perform an installation if you run a script on a device database, policy package, or ADOM database.'' That wording excludes Remote FortiGate Directly via CLI, so D is incorrect.

A is also incorrect because direct remote execution does not use the install preview workflow; preview and validation are tied to Install Wizard operations, not direct CLI execution.

=========

The correct answer is B. The FortiManager 7.6 Administrator Study Guide gives the exact extract: ''Also note when you upgrade the FortiManager firmware version the existing ADOMs are not automatically upgraded.'' This directly explains why the administrator saw the FortiManager upgrade complete while the ADOM versions remained unchanged.

The same section also explains that ADOM upgrades are a separate action: ''You can upgrade an ADOM in System Settings > ADOMs'' and ''Can upgrade to one version higher at a time.'' In addition, the guide recommends: ''upgrade all devices first, and then upgrade the ADOM.''

So the issue is not workspace mode, locked ADOMs, or a stuck task. The ADOMs simply require their own manual upgrade step after the FortiManager firmware upgrade.

The FortiManager 7.6 Administrator Study Guide is explicit for the scenario where both FortiManager and FortiGate are behind NAT. It states that FortiManager can discover FortiGate through the FortiGate NATed IP address, which makes A correct. It also explains that in this scenario, the FortiManager NATed IP address is not configured on FortiGate by default under central management, which makes B correct.

C is incorrect because FortiGate must use the FortiManager NATed IP address, not the non-NATed IP, if it needs to announce itself or reestablish the FGFM tunnel. D is also incorrect because in this NAT scenario, if the tunnel is torn down, only FortiGate attempts to reestablish the connection; FortiManager does not automatically do so.

=========

Right after moving the ISFW device to a new ADOM, the status typically shows the policy package as never-installed, indicating that the device has been assigned to the new ADOM but no policy package has yet been installed in that ADOM.