Pass Your Fortinet FCP_FMG_AD-7.4 Exam with Correct 63 Questions and Answers [Q12-Q30]

admin -

December 19, 2025

4.3/5 - (3 votes)

Pass Your Fortinet FCP_FMG_AD-7.4 Exam with Correct 63 Questions and Answers

Latest [Dec 19, 2025] 2025 Realistic Verified FCP_FMG_AD-7.4 Dumps

Fortinet FCP_FMG_AD-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	Advanced Configuration: This domain explains FortiManager’s high availability (HA), configures FortiGuard services and works with the global database ADOM.
Topic 2	Policy and Objects: This section deals with how to manage policies and objects, oversee ADOM revisions, configure workspace mode, and conduct policy imports and installations.
Topic 3	Administration: This section covers how to understand FortiManager capabilities, perform initial configurations, and set up administrative domains (ADOMs).
Topic 4	Troubleshooting: This section covers how to fmiliarize with FortiManager deployment scenarios and troubleshoot issues related to imports, installations, device-level, ADOM-level, and system-level concerns.
Topic 5	Device Manager: In this domain, the focus is on how to register devices within ADOMs, implement configuration changes using scripts, and troubleshoot using the revision history.

NEW QUESTION 12
Refer to the exhibit.

Which two results occur if the script is run using the Device Database option? (Choose two.)

You must install these changes on a managed device using the Install Wizard.

The successful execution of a script on the Device Database creates a new revision history.

The script history shows successful installation of the script on the remote FortiGate device.

The device Config Status is tagged as Modified.

If the script is run using the “Device Database” option on FortiManager, the following occurs:
* A.You must install these changes on a managed device using the Install Wizard.
* Running the script on the Device Database updates only the configuration in the FortiManager’s database, not on the actual FortiGate device. To apply the changes, you need to use the Install Wizard to push these configurations to the managed device.
* D.The device Config Status is tagged as Modified.
* After running the script on the Device Database, FortiManager tags the device’s configuration status as “Modified,” indicating that there are pending changes that have not yet been installed on the device.
Options B and C are incorrect because:
* Bsuggests a new revision history is created, but this only happens when changes are actually installed on the managed device.
* Cimplies the script is directly executed on the FortiGate, which is not the case when using the Device Database option.
FortiManager References:
* Refer to FortiManager 7.4 Administrator Guide: Scripting and Configuration Management.

NEW QUESTION 13
Refer to the exhibit.

What can you conclude from the failed installation log shown in the exhibit?

Policy ID 2 is installed in the disabled state.

Policy ID 2 is installed without the remote user student.

Policy ID 2 will not be installed.

Policy ID 2 is installed without a source address.

NEW QUESTION 14
When using the FortiManager JSON API, what is the purpose of the session ID received after successful authentication?

It is used to identify the FortiManager metadata on the client.

It includes a hash to check the integrity of the JSON response sent by FortiManager.

It contains information about the HTTP request method used.

It serves as an authentication token for subsequent API requests.

NEW QUESTION 15
Which configuration setting for FortiGate is part o an ADOM-level database on FortiManager?

NSX-T Service Template

Routing

SNMP

Security profiles

* Option B: Routingis the correct answer. The ADOM-level database in FortiManager stores configuration settings such as routing, firewall policies, and objects that are shared across multiple devices in the ADOM.
Explanation of Incorrect Options:
* Option A: NSX-T Service Templateis incorrect as it is not a FortiGate-specific setting managed at the ADOM level.
* Option C: SNMPis incorrect because SNMP settings are typically managed on a per-device basis.
* Option D: Security profilesis incorrect because security profiles are generally device-level configurations, not ADOM-level.
FortiManager References:
* Refer to “FortiManager Administration Guide” for further details on ADOM-level and device-level configurations.

NEW QUESTION 16
Which two statements about Security Fabric integration with FortiManager are true? (Choose two.)

The Fabric View module enables you to generate the Security Fabric ratings for Security Fabric devices.

The Security Fabric settings are part of the device-level settings.

The Fabric View module enables you to view the Security Fabric ratings for Security Fabric devices.

The Security Fabric license, group name, and password are required for the FortiManager Security Fabric integration.

NEW QUESTION 17
Refer to the exhibit.

An administrator has created a firewall address object that is used in multiple policy packages for multiple FortiGate devices in an ADOM.
After the installation operation is performed, which IP/netmask will be installed on Local-FortiGate for theLOCAL_SUBNETfirewall address object?

192.168.1.0/24

Local-FortiGate automatically chooses an IP/netmask based on its network interface settings.

It will create two firewall address objects on Local-FortiGate with 192.168.1.0/24 and 10.0.5.0/24 values.

10.0.5.0/24

In the exhibit, there is aPer-Device MappingforLocal-FortiGatewith an IP/Netmask of192.168.1.0/24. This means that when the firewall address objectLOCAL_SUBNETis installed onLocal-FortiGate, the per-device mapping will override the general address object value of10.0.5.0/24. Therefore, the IP/Netmask installed onLocal-FortiGatewill be192.168.1.0/24.

NEW QUESTION 18
An administrator has assigned a global policy package to a new ADOM called ADOM1.
What will happen if the administrator tries to create a new policy package in ADOM1?

When creating a new policy package, the administrator can select the option to assign the global policy package to the new policy package.

When a new policy package is created, the administrator must assign the global policy package from the global ADOM.

When a new policy package is created, the administrator must import the global policy package to ADOM1.

When the new policy package is created, FortiManager automatically assigns the global policy package to the new policy package.

Supposing when the global pp is assigned to ADOM, the default option assign to all PP in the ADOM is let checked.

NEW QUESTION 19
Refer to the exhibit.

Which two results occur if the script is run using the Device Database option? (Choose two.)

You must install these changes on a managed device using the Install Wizard.

The successful execution of a script on the Device Database creates a new revision history.

The script history shows successful installation of the script on the remote FortiGate device.

The device Config Status is tagged as Modified.

NEW QUESTION 20
An administrator, Trainer, who is assigned the Super_User profile, is trying to approve a workflow session that was submitted by another administrator, Student. However, Trainer is unable to approve the workflow session.
What can prevent an admin account that has Super_User rights over the device from approving a workflow session?

Trainer is not a part of workflow approval group.

Trainer must close Student’s workflow session before approving the request.

Trainer must first create their own workflow session to approve student session.

Trainer does not have full rights over this ADOM.

An administrator must be part of an approval group, and have rights over the ADOM in which the session was created.

NEW QUESTION 21
Refer to the exhibit.

You are using the Quick Install option to install configuration changes on the managed FortiGate.
Which two statements correctly describe the result? (Choose two.)

It installs provisioning template changes on the FortiGate device.

It provides the option to preview only the policy package changes before installing them.

It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate device.

It installs device-level changes on the FortiGate device without launching the Install Wizard

NEW QUESTION 22
Refer to the exhibit.

An administrator is about to add the FortiGate device to FortiManager using the discovery process.
FortiManager is operating behind a NAT device, and the administrator configured the FortiManager NATed IP address under the FortiManager system administration settings.
What is the expected result?

During discovery. FortiManager uses only the FortiGate serial number to establish the connection.

During discovery, FortiManager sets both the FortiManager NATed IP address and NAT device IP address on FortiGate.

During discovery. FortiManager sets the NATed device IP address on FortiGate.

During discovery, FortiManager sets the FortiManager NATed IP address on FortiGate.

NEW QUESTION 23
An administrator configures a new OSPF area on FortiManager and has not yet pushed the changes to the managed FortiGate device. In which database will the configuration be saved?

Device-level database

ADOM-level database

Configuration-level database

Revision history database

When an administrator configures a new OSPF area on FortiManager but has not yet pushed the changes to the managed FortiGate device, the configuration is saved in theDevice-level database.
Explanation of Options:
* A. Device-level database:
* This istrue. When changes are made to a device’s configuration on FortiManager, they are saved in theDevice-level database. This database stores the configuration for individual managed devices. The configuration changes remain here until they are pushed to the actual FortiGate device.
* B. ADOM-level database:
* This isfalse. The ADOM-level database holds configurations related to the entire ADOM (Administrative Domain), such as global settings that apply to all devices within the ADOM, rather than configurations specific to individual devices.
* C. Configuration-level database:
* This isfalse. The term “Configuration-level database” is not typically used in FortiManager terminology. Changes are stored in the device-level database and are applied when pushed to the FortiGate.
* D. Revision history database:
* This isfalse. The revision history database keeps track of previous versions of configurations after they have been pushed to the FortiGate device. It does not store unsaved or pending configurations that have not yet been applied to the device.

NEW QUESTION 24
Which statement about the upgrade of ADOMs on FortiManager is true?

To ensure database consistency, you must upgrade an ADOM before you upgrade the devices in it.

Upgrading the FortiManager version upgrades all existing ADOMs automatically.

You cannot import policies from a device until its FortiOS version matches the ADOM version.

ADOMs using global objects can be upgraded before or after upgrading the global database ADOM.

* Option A: To ensure database consistency, you must upgrade an ADOM before you upgrade the devices in it.This is the correct answer. When upgrading ADOMs on FortiManager, the ADOM must be upgraded first to match the FortiOS version of the devices it manages. This is necessary to ensure compatibility and consistency between the ADOM’s database schema and the FortiGate’s configuration.
Explanation of Incorrect Options:
* Option B: Upgrading the FortiManager version upgrades all existing ADOMs automaticallyis incorrect because the ADOMs must be upgraded manually or individually after upgrading the FortiManager.
* Option C: You cannot import policies from a device until its FortiOS version matches the ADOM versionis incorrect because while version matching is important, it is not strictly necessary for policy import.
* Option D: ADOMs using global objects can be upgraded before or after upgrading the global database ADOMis incorrect as the order of upgrade matters to maintain compatibility.
FortiManager References:
* Refer to “FortiManager Upgrade Guide” for detailed procedures on upgrading ADOMs and devices.

NEW QUESTION 25
If both FortiManager and FortiGate are behind NAT devices, what are the two expected results? (Choose two.)

FortiGate is discovered by FortiManager through the FortiGate NATed IP address.

FortiGate can announce itself to FortiManager only if the FortiManager non-NATed IP address is configured on FortiGate under central management.

If the FGFM tunnel is torn down, FortiManager will try to re-establish the FGFM tunnel.

During discovery, the FortiManager NATed IP address is not set by default on FortiGate.

NEW QUESTION 26
Refer to the exhibit.

How will FortiManager try to get updates tor antivirus and IPS?

From the list of configured override servers or public FDN servers

From the configured override server IP address 10.0.1.50 only

From the default server fds1.fortinet.com

From public FDNI server IP address with the fourth highest octet only

The exhibit shows thatServer Override Modeis set toStrict, which means FortiManager will use only the override server specified at index 0 (in this case, the server with IP address 10.0.1.50 on port 8890) for updates. It will not attempt to use any other servers unless this server is unreachable.

NEW QUESTION 27
Refer to the exhibit.

What can you conclude from the failed installation log shown in the exhibit?

Policy ID 2 is installed in the disabled state.

Policy ID 2 is installed without the remote user student.

Policy ID 2 will not be installed.

Policy ID 2 is installed without a source address.

From the log provided in the exhibit, several conclusions can be drawn regarding the installation of Policy ID
2:
* The installation process fails when attempting to set theLDAP user “student”. The log shows:
* “Attribute ‘ldap-server’ MUST be set.”: This error indicates that when setting up the LDAP user configuration, a mandatory field (ldap-server) is missing. As a result, the configuration could not be completed for the user.
* “entry not found in datasource”and”value parse error before ‘student'”: These errors confirm that the user “student” could not be properly added due to a configuration issue (such as the missing LDAP server).
Because of these errors, while other configuration elements (such as source and destination interfaces, actions, and services) are properly set, the user configuration for”student”isnot applied.
Evaluation of the answer options:
* A. Policy ID 2 is installed in the disabled state.
* This isfalse. There is no indication in the log that Policy ID 2 is disabled.
* B. Policy ID 2 is installed without the remote user student.
* This istrue. Due to the failure in setting the”student”user (as indicated by the errors), the policy will be installedwithoutthat user being properly configured.
* C. Policy ID 2 will not be installed.
* This isfalse. The policy is installed, but the user configuration failed. The rest of the policy configuration appears to have proceeded without critical errors that would prevent the installation.
* D. Policy ID 2 is installed without a source address.
* This isfalse. The log shows that the source address is properly set to “all” (set srcaddr all), so this is not the cause of the issue.
From the log exhibit, we see errors related to the “ldap-server” attribute not being set and an error with the entry “student” not being found in the datasource. This indicates that Policy ID 2 will not be installed due to missing or incorrect data required for successful installation. The “Command fail. Return code -3” confirms the installation failure, so the correct answer is C.
Options A, B, and D are incorrect because:
* A suggests the policy is installed in a disabled state, which isn’t supported by the log.
* B and D suggest partial installation, but the error messages indicate a complete failure to install Policy ID 2.
FortiManager References:
* Refer to FortiManager 7.4 Troubleshooting Guide: Common Errors and Log Interpretation.

NEW QUESTION 28
An administrator wants to create a policy on an ADOM that is in backup mode and install it on a FortiGate device in the same ADOM. How can the administrator perform this task?

The administrator must use the Policy & Objects section to create a policy first.

The administrator must use a FortiManager script.

The administrator must disable the FortiManager offline mode first.

The administrator must change the ADOM mode to Advanced to bring the FortiManager online.

To create and install a policy on a FortiGate device in an ADOM (Administrative Domain) that is in backup mode, the administrator must use a FortiManager script. This is because backup mode restricts direct configuration changes, and scripts can be used to push specific configuration changes without altering the ADOM mode.
Options A, C, and D are incorrect because:
* A requires the ADOM to be in normal or advanced mode to create policies directly in the Policy & Objects section.
* C suggests disabling offline mode, which is irrelevant to the backup mode configuration.
* D implies changing the ADOM mode, which is unnecessary if using a script to perform the task.
FortiManager References:
* Refer to FortiManager 7.4 Administrator Guide: Working with ADOMs and Using Scripts for managing policies in backup mode.

NEW QUESTION 29
Refer to the exhibit. What will happen if the script is run using the Device Database option?
(Choose two.)

You must install these changes using the Install Wizard to a managed device.

The script history will show successful installation of the script on the remote FortiGate.

The successful execution of a script on the Device Database will create a new revision history.

The Device Settings Status will be tagged as Modified.

Once scripts are run on the device database, you can then install the changes on a managed device using the installation wizard.
Since the script changed the device settings in FortiManager, the Config Status shows “Modified” and needs to be installed with Installation Wizard.

NEW QUESTION 30
Refer to the exhibit.

You are using the Quick Install option to install configuration changes on the managed FortiGate.
Which two statements correctly describe the result? (Choose two.)

It installs provisioning template changes on the FortiGate device.

It provides the option to preview only the policy package changes before installing them.

It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate device.

It installs device-level changes on the FortiGate device without launching the Install Wizard

* Option B: It provides the option to preview only the policy package changes before installing them.This is correct. The Quick Install option in FortiManager provides a preview of policy changes before they are applied, allowing administrators to review and confirm the changes.
* Option D: It installs device-level changes on the FortiGate device without launching the Install Wizard.This is correct. Quick Install allows for the immediate installation of device-level changes, such as interface or routing configurations, directly onto the FortiGate without going through the full Install Wizard.
Explanation of Incorrect Options:
* Option A: It installs provisioning template changes on the FortiGate deviceis incorrect because Quick Install does not specifically deal with provisioning templates.
* Option C: It installs all the changes in the device database first and the administrator must reinstall the changes on the FortiGate deviceis incorrect because Quick Install directly applies changes to the FortiGate device, not requiring a separate reinstall step.
FortiManager References:
* Refer to “FortiManager Administration Guide” for details on “Quick Install” functionality under
“Device Management.”

Loading …