FCP_FMG_AD-7.4 Exam Dumps : FCP - FortiManager 7.4 Administrator

The objects highlighted in the image (DMZ_SUBNET, ISP1_SUBNET, LAN_SUBNET) aremetadata variables.

C.They can be used as variables in scripts.

These metadata variables are placeholders that can be used in FortiManager scripts to dynamically insert specific values, enabling script flexibility and scalability across multiple devices or ADOMs.

Options A, B, and D are incorrect because:

Asuggests optional or required settings, which do not apply to metadata variables.

Bimplies they are available across all ADOMs by default, which is not always the case.

Dstates they cannot be created in the global database ADOM, but metadata variables are typically managed within ADOMs and can be utilized globally based on specific configurations.

FortiManager References:

Refer to FortiManager 7.4 Administrator Guide: Using Metadata Variables and Script Management.

When operating in workspace mode on FortiManager 7.4, the administrator must understand how object references and deletions work:

Option C- "FortiManager will not allow the administrator to delete a referenced address object until they lock the ADOM":In workspace mode, all changes are managed within an Administrative Domain (ADOM) scope. When an object (like an address object) is referenced in a policy, FortiManager prevents its deletion to maintain configuration integrity. The ADOM must be locked by the administrator to make changes to any referenced objects. This locking mechanism ensures that no unintended deletions or changes occur that could disrupt the policies or configuration.

FortiManager Reference: "In workspace mode, changes to objects or policies require the ADOM to be locked. If an object is referenced, you must lock the ADOM before deleting or modifying the object." (FortiManager 7.4 Administration Guide, Section on Workspace Mode and ADOM Management)

Option D- "FortiManager will replace the deleted address object with the none address object in the referenced firewall policy":If the administrator attempts to delete an address object that is currently referenced by a firewall policy, FortiManager will replace the deleted object with the 'none' address object. This is done to maintain the policy structure and avoid policy corruption due to a missing reference. This behavior ensures that the firewall policy remains syntactically correct, even though the specific address object is no longer in use.

FortiManager Reference: "When a referenced object is deleted, FortiManager will replace it with a 'none' object in the policy. This behavior is to ensure the integrity and continuity of the policy configurations." (FortiManager 7.4 Administration Guide, Object Management and Policy Handling in Workspace Mode)

Based on the exhibit, the FortiManager administrator is setting up three ADOMs (Administrative Domains) that correspond to different departments (Financial, HR, and IT). Each ADOM has specificFortiGate devices or VDOMs (Virtual Domains) assigned to it, with different administrators managing the ADOMs.

Explanation of Options:

A. The FortiManager administrator must set the ADOM device mode to Advanced.

This istrue. In FortiManager, when there areVDOMs(Virtual Domains) involved, you must set the ADOM toAdvanced modeto manage VDOMs properly. The IT department ADOM includes different VDOMs from FortiGate 4 (VDOM 2 and VDOM 3), which means the ADOM mode must be inAdvancedto support managing VDOMs separately from other ADOMs.

B. Policies and objects databases can be shared between the Financial and HR ADOMs.

This isfalse. By default, ADOMs are separate, and policies and objects cannot be shared between them unless they are specifically designed to do so. The exhibit shows distinct ADOMs for each department, implying no direct sharing of policies and objects between Financial and HR ADOMs.

C. An administrator with the super user profile can access all the VDOMs.

This istrue. A FortiManager administrator with thesuper userprofile hasfull accessto all ADOMs and VDOMs, regardless of how access is restricted for individual administrators. In this case, an admin with the super user profile could access Financial, HR, and IT ADOMs, including all the VDOMs from FortiGate 4.

D. The administrator must configure FortiManager in workspace normal mode.

This isfalse. There is no requirement mentioned in the exhibit or scenario that mandates usingworkspace normal mode. Workspace mode is more related to how configuration changes are managed (locking, editing, etc.), but it doesn’t affect the creation or access control of ADOMs.

Conclusion:

Ais correct becauseAdvanced modeis necessary for managing VDOMs within ADOMs.

Cis correct because asuper usercan access all VDOMs and ADOMs without restrictions.