NSE6_FMG_AD-7.6 Fortinet NSE 6 - FortiManager 7.6 Administrator Free Practice Exam Questions (2026 Updated)

The exhibit shows diagnose fmupdate view-serverlist fds with Server Override Mode: Strict and the active entry marked with *0 as 10.0.1.50 on port 8890, with source CLI. In FortiManager, Strict override mode means the system can communicate only with the configured override server list and cannot fall back to public FDS servers. Therefore, FortiManager gets antivirus and IPS updates from 10.0.1.50, making B correct.

The study guide also explains that antivirus and IPS override addresses are specifically used when a downstream FortiManager must download updates from an upstream FortiManager or another designated server.

So even though FDNI and DEFAULT entries are listed, Strict mode prevents fallback, and only the CLI-defined override server is actually used.

=========

The correct answers are B and C. The FortiManager 7.6 Administrator Study Guide explicitly states: “Scripts that you run directly on remote devices also cause automatic updates and create a revision history.” This exact extract proves both results: FortiManager creates a new revision history and the device status becomes Auto-Updated, meaning the FortiGate change is automatically reflected in the FortiManager device-level database.

The lab guide also distinguishes this from database-targeted scripts by stating: “You must perform an installation if you run a script on a device database, policy package, or ADOM database.” That wording excludes Remote FortiGate Directly via CLI, so D is incorrect.

A is also incorrect because direct remote execution does not use the install preview workflow; preview and validation are tied to Install Wizard operations, not direct CLI execution.

=========

The command set workspace-mode normal enables Workspace (ALL ADOMs). In this mode, FortiManager uses ADOM locking to prevent configuration conflicts. The study guide explains that workspace mode is used to prevent concurrent ADOM access, and once an ADOM is locked, only the administrator who locked it has read-write access while all others have read-only access. That makes D correct.

B is also correct because locking is applied per ADOM, so different administrators can work at the same time on different ADOMs without conflicting with each other. This is consistent with the design goal of workspace mode and ADOM locking.

C describes workflow mode, not workspace normal. Approval before installation is required only with set workspace-mode workflow.

=========

The correct answer is B. The LAN address object shown in the exhibit has a default value of 10.0.0.0/255.255.255.0, and it has per-device mappings only for BR1-FGT-1, HQ-NGFW-1, and Local-Firewall. There is no per-device mapping entry for Remote-Firewall.

The FortiManager 7.6 Administrator Study Guide gives the exact rule for this behavior: “The devices in the ADOM that do not have a dynamic mapping for LAN have a default value”. The same page also explains that dynamic objects let you map one logical object to unique values per device, but devices without a mapping use the object’s default definition.

Since Remote-Firewall is not listed in the Per-Device Mapping table, it inherits the default LAN value: 10.0.0.0/255.255.255.0.

=========

The correct answer is C. The FortiManager 7.6 Administrator Study Guide gives the exact extract: “If you need to move a device from one ADOM to another, run the Import Configuration wizard to import the policy package into the new ADOM.” It also states: “When you move devices from one ADOM to another ADOM, shared policy packages and objects do not move to the new ADOM. You will need to import policy packages from managed devices.”

That is exactly why the administrator cannot see the policy and object configuration after the move: the device itself moved, but its shared policy package and objects did not automatically move with it. The required corrective action is to manually import the policy package into the new ADOM using Import Configuration. Options A, B, and D are not the documented remedy in the uploaded FortiManager sources.

=========

The exhibits are directly supported by the lab guide’s troubleshooting section. It states: “The only profile that can be replaced is the Firewall Profile-Protocol-Options profile, because the only difference is a change in the comment field.” It then explains that for the other two profiles, “Whether you accept the value from BR1-FGT-1 or FortiManager, it will cause changes on different devices.”

That exactly matches C. The conflict window is not primarily showing a firmware mismatch, and the guide does not say BR1-FGT-1 lacks HTTPS 443 support. It also does not describe this as a FortiGuard database mismatch for QUIC. Instead, the key point is that only the default Firewall Profile-Protocol-Options conflict is minor enough to safely take from FortiManager because the difference is only in the comment field. The web filter and SSL/SSH profiles would cause real configuration differences if replaced.

The FortiManager 7.6 Administrator Study Guide states that global policies must be explicitly assigned: “You must explicitly assign global policy packages to specific ADOMs,” and FortiManager can also target specific policy packages in individual ADOMs. The lab guide confirms that assignment is performed from the Global Database ADOM: the administrator selects Global Database ADOM, clicks Assignment, adds the ADOM, chooses Specify Policy Packages To Assign, selects the target package, and then clicks Assign.

So creating a new policy package inside ADOM1 does not automatically inherit the existing global package assignment. It also does not automatically install policies. The administrator must go back to the global ADOM and assign the global policy package to that new local policy package.

The most strongly supported answer is A. The study guide explicitly states: “In the case of having multiple FortiOS firmware versions on the same ADOM, it is recommended to use separate ADOMs instead.” It also says: “When you organize managed FortiGate devices, it is highly recommended that you group them based on their FortiOS firmware version. This is because valid command syntax varies by firmware version, which affects script compatibility.”

D is the other practical fix supported by FortiManager workflow. The study guide states that FortiManager can run scripts on multiple managed devices at once, and device groups let you run scripts on multiple devices instead of a single device. Combined with the firmware-version compatibility rule above, the correct operational approach is to keep version-specific scripts and apply them only to the matching device sets. B and C are not supported by the uploaded study guide as the recommended fix.

=========

The correct answer is C. The FortiManager 7.6 Administrator Study Guide explicitly says: “You must explicitly assign global policy packages to specific ADOMs” and “you can even pick specific policy packages in individual ADOMs that you want to apply the global policies to.” The study guide also explains the assignment workflow: “This slide shows the steps to assign a global policy package to an ADOM policy package” and “First, add the required ADOMs as targets. Second, assign the global policy package to the ADOMs.”

Because Remotes is a newly created policy package, it does not inherit the earlier assignment automatically. The administrator must explicitly assign the Training global policy package to the Remotes policy package. Automatic install does not create that assignment, and unassigning all packages is unnecessary.

The exhibit shows Remote-FortiGate with a green closed lock icon, which indicates a locked policy package. The FortiManager 7.6 Administrator Study Guide states: “Policy locking is available in workspace normal and per-ADOM modes” and “Policy locking allows administrators to work on and lock a single policy package instead of locking the whole ADOM.” This confirms that a package such as Local-FortiGate_root can also be locked, so A is correct.

B is incorrect because the study guide and lab guide describe snapshots as ADOM revisions, not policy package snapshots: “An ADOM revision creates a snapshot of the policy and object configuration for the ADOM.”

D is incorrect because in workflow mode, sessions and approval are required before installation. The exhibit shows a normal save/lock state, not a workflow session state.

=========

In backup mode, FortiManager does not directly manage policy installation via the usual ADOM policy packages; instead, administrators use FortiManager scripts to push configuration changes, including policies, to FortiGate devices.

When FortiManager is behind a NAT device, setting the NATed IP address (100.65.0.120) in the system admin settings causes FortiManager to use that NATed IP address for communication and configuration with FortiGate during discovery and management operations.

FortiManager helps with mass provisioning by using templates that allow administrators to configure the same settings on multiple FortiGate devices simultaneously, streamlining deployment and management.

FortiManager global policies and objects are shared across ADOMs, but they are not applied automatically to every package. The study guide states that when you create a global policy package, you can choose the ADOMs you want to apply it to, and you can even pick specific policy packages in individual ADOMs. That directly validates B.

A is also correct because the lab guide explicitly says you can promote ADOM objects to global objects by right-clicking an ADOM object and selecting Promote to Global.

C is incorrect because when Automatically Install Policies to ADOM Devices is enabled, FortiManager installs without giving you a preview/accept step first; the lab warns to use it only when you are sure of the changes.

D is incorrect because FortiManager imports device policies into an ADOM policy package, not into the global package for synchronization.

The correct answer is B. The error occurs because the script is being run on the policy package database, but the failing command is config sys interface, which is a device-level configuration command, not a policy-layer command. The lab guide gives the exact relationship: “Because the scripts target the device database, first, you will run the scripts against the device database, and then install the scripts on the managed devices” and “The scripts contain configuration changes related to device-level settings.”

By contrast, the lab guide shows Policy Package or ADOM Database scripts being used for firewall objects and policies in a policy package.

So this NetFlow script must be run on the device database, then installed. The issue is not VDOM permissions, metadata variables, or normalized interfaces.

The correct answer is B. The FortiManager 7.6 Administrator Study Guide explicitly states: “CLI scripts use the FGFM tunnel and the FGFM tunnel is authenticated using the FortiManager and FortiGate serial numbers.” It also states: “Tcl scripts do not run through the FGFM tunnel like CLI scripts do. Tcl scripts use SSH to tunnel through FGFM and they require SSH authentication to do so.”

This is the exact reason CLI scripts can run without prompting for SSH authentication every time: they use the existing secure FGFM management tunnel, not a separate interactive SSH login. The FGFM section of the study guide also confirms that this is a secure communication tunnel established between FortiManager and managed FortiGate devices.

So the enabler is not legacy login, script location, or the “Remote FortiGate Directly” option by itself. It is the FGFM secure management tunnel.

If a BGP template is assigned to the FortiGate device on FortiManager, device-level BGP configurations made directly in the device-level database are overridden by the template settings, so the changes do not get pushed to the device.