01. Workspace mode is enabled on an ADOM. An administrator opens a policy package to make a change, but the policies and objects are read-only and cannot be edited. A second administrator is working in the same ADOM at the same time.
What is the most likely cause?
a) FortiManager is operating in the HA secondary role.
b) The other administrator currently holds the lock on the ADOM or policy package.
c) The policy package has not yet been imported from the device.
d) The ADOM's revision history database has become corrupt or unreadable.
02. An ADOM is configured for workspace normal mode rather than workflow mode.
Which two statements about how normal mode controls concurrent administration are true?
(Choose two.)
a) An administrator locks an ADOM or policy package before editing, which blocks others from editing that locked scope
b) Every change must be submitted to an approver before it is saved
c) Edits are saved to the package on unlock, with no separate approval or submission step
d) Locking is unnecessary because all administrators can edit the same package simultaneously
03. How does FortiManager determine if the configuration status of a managed device is set to out of sync?
a) It compares the device-level database with the FortiGate configuration.
b) It compares the provisioning template with the FortiGate configuration.
c) It compares the ADOM-level database with the FortiGate configuration.
d) It compares the current revision history with the FortiGate configuration.
04. A newly deployed FortiGate cannot establish its management tunnel to FortiManager and remains offline in Device Manager. A firewall sits in the path between the two devices.
Which TCP port must be permitted through that firewall for the FGFM management tunnel to come up?
a) UDP 514
b) TCP 541
c) TCP 22
d) TCP 443
05. In Device Manager, a managed FortiGate is shown with a configuration status of Modified.
Which two statements correctly describe this state?
(Choose two.)
a) Changes exist in FortiManager's Device Database that have not yet been installed to the device.
b) The FortiGate's running configuration was changed directly and now differs from FortiManager.
c) The FGFM management tunnel is down and the device is unreachable.
d) The ADOM must be locked in workspace mode before the status can appear.
e) Installing the device settings deploys the staged changes and returns the device to Synchronized.
06. Every device in ADOM_A fails to install at the same time, while devices in other ADOMs install successfully.
Which two findings would point to an ADOM-level root cause rather than a device-level one?
(Choose two.)
a) A single device has an unmapped interface in its policy package.
b) One FortiGate in the ADOM is offline with a down FGFM management tunnel.
c) The ADOM database is Out of Sync or has an unresolved revision issue affecting all its packages.
d) The ADOM is locked by another administrator in workspace mode, blocking changes for the whole ADOM.
e) One device's firmware is incompatible with its assigned policy package.
07. Which command can you use to sniff the FortiGate-to-FortiManager communication protocol (FGFM) between FortiManager and FortiGate?
a) diagnose sniffer packet any "port 443" 4
b) diagnose sniffer packet any "port 541" 4
c) diagnose sniffer packet any "port 8113" 4
d) diagnose sniffer packet any "port 80" 4
08. An administrator makes device-level configuration changes in the Device Database for a FortiGate, then installs the ADOM's policy package to that device. Afterward, the firewall policies on the FortiGate are updated correctly, but the device-level settings changes are missing from the device.
Why were the device-level settings not applied?
a) A policy package install deploys only policies and objects; device-level settings need a separate device settings install.
b) The policy package install failed silently and must simply be re-run.
c) Device-level settings can be changed only by direct CLI on the FortiGate, not through FortiManager.
d) Device settings require an ADOM revision rollback before they can be installed.
09. FortiManager is acting as a local FDS for managed FortiGates, and its own access to the public FortiGuard Distribution Network is being reviewed.
Where does FortiManager itself obtain the FortiGuard packages it redistributes, and what can be adjusted if its default upstream access must change?
a) The packages are embedded in the FortiManager firmware image and never change between upgrades.
b) It generates the antivirus and IPS signatures locally by analyzing managed-device traffic.
c) It downloads from the public FortiGuard Distribution Network (FDN), which an override server can redirect.
d) It collects the packages back from the managed FortiGates and consolidates them.
10. An administrator must pre-build the configuration for a new FortiGate that has not yet been shipped or connected to the network.
Which FortiManager capability lets the administrator create and configure the device in the Device Database before the hardware is online?
a) Import the device's running configuration into the Device Database
b) Create an ADOM revision to stage the new device's configuration
c) Perform a device-level install to push the configuration to it
d) Add a model device and pre-build its Device Database configuration for later authorization