I85PREP
⌘ K
FCP FortiManager 7.4 study materials
FCP FortiManager 7.4 study resources

FCP FortiManager 7.4 practice questions

One question at a time. Build your FCP FortiManager 7.4 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1System Setup and Administration

In FortiManager 7.4, which administrative setting determines whether a newly created administrator account must change its password at first login?

  1. The 'Change Password' enforcement flag on the admin user record Correct answer.
  2. The LDAP server's pwdLastSet attribute mapped in the remote profile
  3. The FortiGate local user password policy inherited over FGFM
  4. The global 'password-policy' profile assigned to the ADOM

Explanation

FortiManager stores per-administrator settings on the admin user record, and the 'Change Password' option forces a password reset at the next login for that specific account. Password policy profiles control complexity and expiry rules, not the first-login reset flag.

Question 2System Setup and Administration

An administrator wants FortiManager 7.4 to authenticate GUI logins against an external LDAP directory while still keeping a local break-glass account. What is the correct configuration approach?

  1. Convert the admin account to a RADIUS user and enable wildcard admin matching only
  2. Disable the local admin database by setting 'allow-local-admin' to disable in the CLI
  3. Delete all local admins and rely on the LDAP server's own account lockout policy
  4. Create a remote LDAP admin user and retain at least one local admin with super_user profile Correct answer.

Explanation

FortiManager supports remote administrator authentication by creating an admin user of type LDAP (or RADIUS/TACACS+/PKI) and assigning profiles, while a local super_user account remains available for recovery. Removing all local admins risks lockout if the external server is unreachable.

Question 3System Setup and Administration

Which FortiManager 7.4 feature allows multiple physical FortiManager units to be managed as a single logical appliance for configuration and policy deployment?

  1. FGFM keepalive tuning
  2. Workspace lock mode
  3. FortiManager HA cluster Correct answer.
  4. ADOM version rollback

Explanation

FortiManager high availability groups units into a cluster with a primary and secondaries so administrators manage one logical system and changes replicate to peers. Workspace locking and FGFM keepalives are unrelated to clustering.

Question 4System Setup and Administration

A FortiManager HA cluster's primary unit fails. Which statement describes the expected behavior of the secondary units in FortiManager 7.4?

  1. All secondaries become read-only and devices must be re-added manually to a new primary
  2. The cluster enters split-brain mode and each secondary manages a separate copy of every ADOM
  3. One secondary is promoted to primary and continues managing devices with the replicated configuration Correct answer.
  4. Devices automatically fall back to local FortiGate mode until an administrator re-registers them

Explanation

FortiManager HA promotes a secondary to primary so management continues using the replicated database, and managed devices reconnect to the new primary address. Manual re-registration of devices is not required in a properly configured cluster.

Question 5System Setup and Administration

Which ADOM mode in FortiManager 7.4 should be selected when the managed FortiGates run different FortiOS versions and require version-specific object sets?

  1. Normal mode Correct answer.
  2. Sync mode
  3. Global Database mode
  4. Backup mode

Explanation

Normal ADOM mode supports multiple FortiOS versions and stores version-specific objects, allowing devices on different firmware releases to be managed in one ADOM. Backup mode is intended for configuration backup only and does not provide full policy management.

Question 6System Setup and Administration

What is the purpose of the Global Database ADOM in FortiManager 7.4?

  1. To store encrypted backups of every managed device configuration
  2. To host the FortiGuard license repository for the organization
  3. To hold global objects and policies that can be assigned to multiple ADOMs Correct answer.
  4. To aggregate logs forwarded from all managed FortiGates

Explanation

The Global Database ADOM centralizes objects and header/footer policies that are then assigned to regular ADOMs, reducing duplication across policy packages. Log aggregation and license storage are handled elsewhere.

Question 7System Setup and Administration

An administrator needs every policy package in an ADOM to include a mandatory logging policy at the top. Which FortiManager 7.4 mechanism enforces this without editing each package manually?

  1. ADOM revision diff
  2. Device-level provisioning template
  3. Per-package installation target
  4. Global policy package assigned to the ADOM Correct answer.

Explanation

A global policy package assigned to an ADOM is automatically prepended or appended to the ADOM's policy packages, so the shared rules apply everywhere without manual edits. Revision diffs and provisioning templates do not inject policy rules.

Question 8System Setup and Administration

Which FortiManager 7.4 object is used to predefine device-level settings such as DNS servers and NTP so that newly registered FortiGates are configured consistently?

  1. Threat weight profile
  2. Address group
  3. Policy package
  4. Provisioning template Correct answer.

Explanation

Provisioning templates define system-level and interface settings that FortiManager pushes to devices, giving consistent baseline configuration on registration. Policy packages and address groups operate at the firewall policy layer.

Question 9System Setup and Administration

A FortiGate is registered to FortiManager 7.4 but shows as 'Unregistered' in Device Manager. Which action most directly resolves the management tunnel state?

  1. Authorize the device request on FortiManager and verify the FGFM pre-shared key matches Correct answer.
  2. Change the FortiManager admin password policy to strict
  3. Delete the ADOM and recreate it with the same name
  4. Reinstall the FortiGate firmware to regenerate certificates

Explanation

An unregistered device typically awaits authorization, and the FGFM tunnel requires matching pre-shared keys on both sides. Authorizing the request and confirming the key re-establishes the management connection.

Question 10System Setup and Administration

Which protocol and port does FortiManager 7.4 use by default for the management tunnel to FortiGate devices?

  1. SNMP over UDP 161
  2. FGFM over TCP 541 Correct answer.
  3. CAPWAP over UDP 5246
  4. FortiTelemetry over UDP 8013

Explanation

FortiManager communicates with managed FortiGates over the FortiGate-FortiManager (FGFM) protocol on TCP port 541 by default. The other ports serve wireless, monitoring, and telemetry functions respectively.

Question 11System Setup and Administration

Which FortiManager 7.4 feature lets an administrator stage configuration changes in a private workspace and review them before committing to the live ADOM?

  1. Policy package installation preview
  2. ADOM revision auto-archive
  3. Device-level script scheduling
  4. Workspace mode with commit and lock workflow Correct answer.

Explanation

Workspace mode gives each administrator a private view of the ADOM; changes are committed to the live database only when the workspace is saved and locked/unlocked appropriately. This provides review and conflict control for concurrent editing.

Question 12System Setup and Administration

An administrator must restore a previous ADOM configuration after a bad policy change. Which FortiManager 7.4 capability provides this?

  1. ADOM revision history with the ability to revert to a prior revision Correct answer.
  2. FortiGuard update rollback in the license center
  3. Global database object import wizard
  4. FGFM tunnel reset from Device Manager

Explanation

FortiManager records ADOM revisions, and an administrator can revert the ADOM to an earlier revision to undo configuration changes. The other options do not restore ADOM configuration state.

Question 13System Setup and Administration

Which FortiManager 7.4 administrative profile setting controls whether an admin can install policy packages to managed devices?

  1. The ADOM mode assigned to the admin's default ADOM
  2. The 'Policy & Objects' and 'Install' permissions in the admin profile Correct answer.
  3. The FGFM keepalive interval configured globally
  4. The device's firmware version in Device Manager

Explanation

Admin profiles grant granular read/write permissions per area, and installation rights come from the Policy & Objects and Install permissions. ADOM mode, keepalives, and firmware version do not grant or restrict installation rights.

Question 14System Setup and Administration

What is the effect of assigning an administrator a profile with read-only access to the Device Manager but read-write access to Policy & Objects?

  1. The admin can only view logs forwarded from managed devices
  2. The admin is denied all access because profiles must be uniform across modules
  3. The admin can create and install policies but cannot modify device-level settings Correct answer.
  4. The admin can modify device settings but cannot create policies

Explanation

FortiManager admin profiles are granular per module, so read-write on Policy & Objects allows policy creation and installation while read-only on Device Manager blocks device-level changes. Mixed permissions across modules are supported.

Question 15System Setup and Administration

Which FortiManager 7.4 setting controls how long the system retains ADOM revisions before archiving or discarding them?

  1. The FortiGuard update schedule
  2. The FGFM heartbeat timeout
  3. The ADOM revision retention settings in the ADOM configuration Correct answer.
  4. The device's log retention policy

Explanation

ADOM revision retention is configured per ADOM and determines how many revisions are kept and for how long. FortiGuard scheduling, tunnel timeouts, and device log retention are separate concerns.

Question 16System Setup and Administration

An administrator wants to back up the entire FortiManager 7.4 configuration including all ADOMs and device records. Which action accomplishes this?

  1. Export each ADOM's policy package as a CSV file
  2. Use the FortiGuard license export function
  3. Copy the /var/log directory from the FortiManager CLI
  4. Run a full system backup from System Settings > Backup Correct answer.

Explanation

A full system backup from System Settings captures the FortiManager configuration, ADOMs, and device database in a restorable archive. CSV exports and log copies do not produce a restorable configuration backup.

Question 17System Setup and Administration

Which statement about restoring a FortiManager 7.4 configuration backup to a different FortiManager unit is accurate?

  1. The backup can only be restored after deleting all ADOMs manually
  2. The backup is hardware-locked and can never be restored elsewhere
  3. The backup can be restored on another unit running the same or a compatible firmware version Correct answer.
  4. The backup restores logs but not configuration objects

Explanation

FortiManager backups are portable across units when the firmware version is the same or compatible, which supports migration and replacement. They are not hardware-locked.

Question 18System Setup and Administration

Which FortiManager 7.4 interface is used to configure the administrative timeout that logs out idle GUI sessions?

  1. The device-level provisioning template
  2. The per-ADOM advanced properties
  3. The admin settings under System Settings > Admin > Settings Correct answer.
  4. The FortiGuard distribution settings

Explanation

Idle timeout for administrative sessions is a global admin setting found under System Settings > Admin > Settings. ADOM properties, provisioning templates, and FortiGuard settings do not control GUI session timeout.

Question 19System Setup and Administration

An administrator needs to limit which IP addresses can reach the FortiManager 7.4 GUI and CLI. Which configuration achieves this?

  1. Trusted hosts configured on the administrator account Correct answer.
  2. The FGFM keepalive threshold
  3. A provisioning template applied to FortiManager itself
  4. A firewall policy in the global ADOM

Explanation

Trusted hosts on an admin account restrict that administrator's login source addresses for GUI and CLI access. Global ADOM policies apply to managed FortiGates, not to FortiManager's own management access.

Question 20System Setup and Administration

Which FortiManager 7.4 component is responsible for storing and indexing logs received from managed FortiGates?

  1. The FGFM tunnel manager
  2. The provisioning template engine
  3. The global database ADOM
  4. The FortiAnalyzer features enabled on FortiManager Correct answer.

Explanation

FortiManager can enable FortiAnalyzer features to receive, store, and index logs, or forward them to a dedicated FortiAnalyzer. The global database and provisioning engine do not handle log storage.

Question 21System Setup and Administration

A managed FortiGate's configuration drifts from the FortiManager policy package after a local change. Which FortiManager 7.4 capability helps identify the difference?

  1. Configuration and installation preview showing the diff between the device and the policy package Correct answer.
  2. The admin audit log export
  3. The FortiGuard update status page
  4. The ADOM mode selector

Explanation

FortiManager can preview the differences between the device's running configuration and what the policy package would install, revealing drift before deployment. The other options do not compare device configuration to policy packages.

Question 22System Setup and Administration

Which FortiManager 7.4 feature allows an administrator to run CLI commands on multiple managed FortiGates from a single interface without creating a policy package?

  1. Provisioning templates
  2. Scripts executed against device groups Correct answer.
  3. Global policy packages
  4. ADOM revisions

Explanation

FortiManager scripts contain CLI commands that can be run against selected devices or device groups, useful for bulk operational changes. Global policies and provisioning templates push declarative configuration, not ad hoc CLI execution.

Question 23System Setup and Administration

Which statement best describes the difference between a device-level install and an ADOM-level install in FortiManager 7.4?

  1. A device-level install requires FortiAnalyzer, while an ADOM-level install does not
  2. A device-level install ignores the policy package, while an ADOM-level install uses it
  3. A device-level install targets one device, while an ADOM-level install can deploy to all mapped devices in the ADOM Correct answer.
  4. A device-level install only pushes VPN settings, while an ADOM-level install pushes all settings

Explanation

Installation scope determines the targets: a device-level install pushes to a single FortiGate, whereas an ADOM-level install deploys to the devices mapped to the policy package in that ADOM. Both use the same policy package content.

Question 24System Setup and Administration

Which FortiManager 7.4 setting must be configured so managed FortiGates use FortiManager as their local FortiGuard server for updates?

  1. Enable the FortiGuard service on FortiManager and point devices to it as the update server Correct answer.
  2. Set the ADOM mode to Backup
  3. Configure a global policy package for updates
  4. Enable CAPWAP on the FortiManager interface

Explanation

FortiManager can act as a local FortiGuard distribution server when the service is enabled, and managed devices are configured to use it as their update source. CAPWAP, ADOM mode, and global policies do not provide update distribution.

Question 25System Setup and Administration

An administrator is troubleshooting why a newly registered FortiGate appears in FortiManager 7.4 but cannot receive policy installs. Which check is most relevant first?

  1. Confirm the FortiManager license covers FortiAnalyzer storage
  2. Confirm the device is added to an ADOM and mapped to the policy package being installed Correct answer.
  3. Confirm the device's NTP server is reachable
  4. Confirm the FortiGate's log disk is enabled

Explanation

Policy installation requires the device to belong to the correct ADOM and to be mapped to the policy package as an installation target. Log disk, storage licensing, and NTP do not block policy installation.

Question 26System Setup and Administration

Which FortiManager 7.4 object defines a reusable set of provisioning settings that can be applied to multiple managed FortiGates during or after registration?

  1. Device profile Correct answer.
  2. ADOM revision
  3. Policy package
  4. Installation target

Explanation

A device profile bundles provisioning settings such as system attributes, interface settings, and security fabric options so they can be applied consistently to many devices. It is applied from Device Manager rather than being a policy container or a version snapshot.

Question 27System Setup and Administration

Which FortiManager 7.4 administrative domain object determines which ADOMs and devices an administrator can see after logging in?

  1. Administrator user Correct answer.
  2. Administrative profile
  3. ADOM mode
  4. Workspace mode

Explanation

The administrator user record binds a login to an administrative profile and to the set of ADOMs the user may access. The profile defines permitted actions, while the user record defines scope.

Question 28System Setup and Administration

In FortiManager 7.4, which mode must an ADOM be in to serve as the source for policy and object synchronization to other ADOMs?

  1. Global Database mode
  2. Root mode
  3. Normal mode
  4. Backup mode Correct answer.

Explanation

An ADOM in backup mode cannot be edited directly and is intended to receive synchronized configuration from a normal-mode ADOM. This lets a central ADOM push shared policy and objects outward.

Question 29System Setup and Administration

An administrator wants FortiManager 7.4 to automatically assign newly registered FortiGates to a specific ADOM based on a model prefix. Which configuration should be used?

  1. A provisioning template with a model filter
  2. A device group with a static member list
  3. A registration rule in the FortiManager settings Correct answer.
  4. An ADOM with the default assignment flag

Explanation

Registration rules match attributes such as model or serial number patterns and place matching devices into a designated ADOM automatically. This avoids manual moves after each device registers.

Question 30System Setup and Administration

Which FortiManager 7.4 feature should an administrator use to push a consistent set of firewall addresses and policies to multiple ADOMs from one central ADOM?

  1. Policy and object synchronization Correct answer.
  2. Configuration revision diff
  3. Script scheduling
  4. FortiGuard update service

Explanation

Policy and object synchronization copies selected policies and objects from a normal-mode ADOM to backup-mode ADOMs. It centralizes maintenance of shared security content across administrative domains.

Question 31System Setup and Administration

Which FortiManager 7.4 capability lets an administrator compare a managed FortiGate's current configuration against the last installed revision to identify local changes?

  1. Configuration diff in Device Manager Correct answer.
  2. ADOM revision history
  3. Policy package installation preview
  4. FortiView device console

Explanation

Device Manager provides a configuration diff that shows differences between the device's running configuration and the revision FortiManager last installed. This is the standard way to detect out-of-band local edits.

Question 32System Setup and Administration

An administrator wants to schedule a recurring backup of managed FortiGate configurations to FortiManager 7.4. Which setting controls this behavior?

  1. The FortiManager system backup schedule
  2. The log retention policy
  3. The device's central management backup schedule Correct answer.
  4. The ADOM revision auto-archive interval

Explanation

FortiManager can be configured to retrieve and store configuration backups from managed devices on a defined schedule. This is separate from FortiManager's own system backup and from ADOM revision archiving.

Question 33System Setup and Administration

Which FortiManager 7.4 administrative profile permission is required for an operator to approve or reject changes staged in a workspace?

  1. Read-only access to the Device Manager
  2. Approve/reject permission for workflow Correct answer.
  3. Install permission for policy packages
  4. Read-write access to the workspace-enabled objects

Explanation

Workspace workflow uses a separate approve/reject permission so that reviewers can be distinct from authors. Holding read-write on the objects alone does not authorize approving another user's staged changes.

Question 34System Setup and Administration

Which FortiManager 7.4 interface should be used to configure high availability between two FortiManager units?

  1. The FortiGate Device Manager HA widget
  2. The CLI command config system ha Correct answer.
  3. The ADOM-level HA settings
  4. The GUI System Settings > HA page

Explanation

FortiManager HA is configured through the CLI using config system ha, where the mode, group name, and peer addresses are set. The GUI does not provide a dedicated HA configuration page for FortiManager.

Question 35System Setup and Administration

In a FortiManager 7.4 HA cluster, which unit is responsible for processing configuration changes and installing policy?

  1. The primary unit Correct answer.
  2. Any unit that holds the HA management IP
  3. The unit with the most ADOMs
  4. The backup unit with the lowest serial number

Explanation

Only the primary unit in a FortiManager HA cluster actively processes configuration and installation tasks. Backup units maintain synchronized state and take over if the primary fails.

Question 36System Setup and Administration

Which FortiManager 7.4 log setting determines where log messages generated by FortiManager itself are stored?

  1. The FortiGate log forwarding configuration
  2. The ADOM log retention policy
  3. The FortiManager local log settings under System Settings Correct answer.
  4. The FortiAnalyzer remote log server list

Explanation

FortiManager generates its own event logs, and where those are stored or forwarded is controlled by FortiManager's local log configuration. Managed device logs are a separate concern handled by log forwarding and FortiAnalyzer.

Question 37System Setup and Administration

An administrator must ensure that FortiManager 7.4 uses a specific NTP server for time synchronization. Which configuration location is correct?

  1. Device Manager provisioning template
  2. CLI config system ntp Correct answer.
  3. ADOM-level system settings
  4. System Settings > Dashboard > Time

Explanation

FortiManager time synchronization is configured with the CLI command config system ntp, where servers and authentication can be specified. Accurate time is important for log correlation and certificate validation.

Question 38System Setup and Administration

Which FortiManager 7.4 object is used to define a reusable CLI script that can be run against multiple managed devices?

  1. Provisioning template
  2. Script Correct answer.
  3. Policy package
  4. Device group

Explanation

A script stores CLI commands that can be executed on one or many managed devices from FortiManager. Scripts are organized by type and can be scheduled or run on demand.

Question 39System Setup and Administration

Which FortiManager 7.4 feature allows an administrator to view and manage the configuration of a managed FortiGate without leaving the FortiManager GUI?

  1. The device console Correct answer.
  2. The FortiGuard page
  3. The ADOM revision viewer
  4. The policy package editor

Explanation

The device console opens a CLI session to the managed FortiGate from within FortiManager. It is useful for verification and troubleshooting without a separate login.

Question 40System Setup and Administration

Which FortiManager 7.4 setting controls the maximum number of concurrent administrative sessions allowed per administrator account?

  1. The administrator user's concurrent session setting Correct answer.
  2. The HA session synchronization setting
  3. The administrative profile session limit
  4. The system global admin timeout

Explanation

FortiManager allows limiting concurrent sessions per administrator user as part of the user record. This is distinct from the idle timeout, which ends inactive sessions.

Question 41System Setup and Administration

Which FortiManager 7.4 action is required before a newly created ADOM becomes available for policy configuration?

  1. It must be created with a valid mode and then selected as the current ADOM Correct answer.
  2. It must be synchronized from the Global Database
  3. It must be assigned to an administrator
  4. It must be installed to a device

Explanation

Creating an ADOM with a supported mode makes it available in the ADOM selector, after which policies and devices can be managed within it. Assignment to an administrator controls access, not existence.

Question 42System Setup and Administration

An administrator wants FortiManager 7.4 to send an alert when a managed device goes offline. Which configuration should be used?

  1. An event handler with a device-down trigger Correct answer.
  2. A log forwarding filter to FortiAnalyzer
  3. A scheduled script with a timeout
  4. A policy package with a logging action

Explanation

Event handlers in FortiManager monitor conditions such as device connectivity and can trigger alerts or actions. This provides proactive notification of device state changes.

Question 43System Setup and Administration

Which FortiManager 7.4 feature should be used to verify that a policy package will install cleanly before pushing it to production devices?

  1. Script validation
  2. Device configuration diff
  3. Policy check Correct answer.
  4. ADOM revision restore

Explanation

Policy check analyzes a policy package for issues such as unused objects, shadowed rules, and conflicts before installation. It helps prevent failed or unintended installs.

Question 44System Setup and Administration

Which FortiManager 7.4 object is used to group managed devices so that policy packages can be installed to them together?

  1. Meta-field
  2. Device group Correct answer.
  3. Provisioning template
  4. ADOM

Explanation

Device groups collect devices within an ADOM so that installation and other operations can target the group as a unit. This simplifies management of large device fleets.

Question 45System Setup and Administration

An administrator needs to grant a help-desk user the ability to view device status and logs but not change configuration. Which FortiManager 7.4 approach is correct?

  1. Place the user in the super_user profile
  2. Create a script that restricts the user's commands
  3. Assign the user full admin rights and rely on audit logs
  4. Assign the user a read-only administrative profile scoped to the relevant ADOMs Correct answer.

Explanation

A read-only administrative profile limits the user to viewing permitted objects within the ADOMs assigned to their account. This follows least-privilege practice without relying on after-the-fact auditing.

Question 46System Setup and Administration

Which FortiManager 7.4 setting controls whether FortiManager itself can be reached over HTTPS on a non-default port?

  1. The ADOM web filter profile
  2. The device provisioning template
  3. The FortiGuard update port
  4. The system global admin-port setting Correct answer.

Explanation

The administrative HTTPS port for FortiManager is set in the system global settings. Changing it affects how administrators reach the GUI and API.

Question 47System Setup and Administration

Which FortiManager 7.4 capability allows an administrator to roll back only the objects and policies of a single ADOM without affecting other ADOMs?

  1. ADOM revision restore Correct answer.
  2. HA failover
  3. Full system backup restore
  4. Device configuration restore

Explanation

ADOM revisions snapshot the configuration of a single ADOM, so restoring one revision affects only that ADOM. This is more granular than restoring a full FortiManager backup.

Question 48System Setup and Administration

Which FortiManager 7.4 feature allows an administrator to apply metadata tags to devices and then target policy installation or scripts by tag?

  1. Workspace mode
  2. ADOM revisions
  3. Device profiles
  4. Meta-fields Correct answer.

Explanation

Meta-fields store custom key-value attributes on managed devices and can be used to filter and target operations. This supports dynamic grouping without maintaining static device groups.

Question 49System Setup and Administration

Which FortiManager 7.4 process is responsible for communicating with managed FortiGates to retrieve status and configuration?

  1. The FortiGuard daemon
  2. The log daemon
  3. The FGFM daemon Correct answer.
  4. The HA daemon

Explanation

The FGFM daemon handles the management tunnel between FortiManager and managed FortiGates, carrying status, configuration, and provisioning traffic. It is central to device registration and ongoing management.

Question 50System Setup and Administration

An administrator wants to limit the number of ADOM revisions kept before older ones are automatically removed. Which FortiManager 7.4 configuration controls this?

  1. The log retention policy
  2. The ADOM revision auto-archive setting Correct answer.
  3. The device backup schedule
  4. The system global admin timeout

Explanation

ADOM revision auto-archive settings define how many revisions are retained and when they are created. This prevents unbounded growth of stored configuration snapshots.