Pass the Fortinet NSE 6 Network Security Specialist NSE6_FMG_AD-7.6 Questions and answers with CertsForce

The error occurs because the FortiToken used (FTKM0B4A9AC5C56D) must already exist and be registered on the FortiGate device HQ-NGFW-1. FortiManager cannot push or create new FortiTokens on the device; the token must be valid and present on the FortiGate before it can be assigned to a user.

The correct answer is D. The FortiManager 7.6 Administrator Study Guide states: “You can revert to a previous configuration revision” and “Reverts only the device database to the previous revision”. It also states “Does not revert policies and objects—you must import them” and “You must install reverted changes on FortiGate.”

This exactly means a revert operation changes the device-level database on FortiManager, not the policy layer database. The guide further clarifies: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

So C is incorrect because both layers are not reverted together. A and B are also incorrect because the documented and verified effect is specifically a modification of the device database, followed by install and, if needed, policy re-import for synchronization.

=========

The correct answer is C. The installation log explicitly says: “Dynamic interface ‘LAN’ mapping undefined for device HQ-NGFW-1”. That means the policy is using a normalized interface, but FortiManager has no valid mapping for that device. The FortiManager 7.6 Administrator Study Guide states that “Interfaces are mapped per device, per platform, or both” and “When the normalized interface is used in a policy, the per-device mappings have higher priority than per-platform mappings.”

The lab guide also shows that during import or policy mapping fixes, the administrator can set the Mapping Type to Per-Device for interfaces.

So the correct fix is to create a per-device mapping for the normalized interface LAN for that FortiGateRugged-70F. Hardcoding lan1 in the policy is not the best FortiManager method because interface mapping is designed specifically to avoid that.

=========

The best verified answer is B. The FortiManager 7.6 Administrator Study Guide shows that the ADOM Layer contains Policy and Objects, and specifically states: “Policy & Objects: Centralize the management of firewall policies, objects, and security profiles, among others.” Because security-related policy settings belong to the Policy and Objects layer, they are part of the ADOM-level database.

By contrast, Routing and SNMP are treated as device-level settings. The lab guide shows Routing under the device/network configuration view, and SNMP as a setting in the system template that “pushes configuration changes to the device level.”

Also, provisioning templates such as NSX-T service are listed as having precedence over device-layer configurations, which further indicates they are not the Policy and Objects ADOM database answer here.

=========

ADOM revisions save the current state of all policy packages and objects within an ADOM, allowing administrators to track changes over time and revert to previous configurations if needed.

The import report shows that a new policy package named Remote-FortiGate_root will be created in the FortiManager ADOM database, but some firewall addresses and policies failed to import due to interface binding conflicts.

The exhibit shows the default value of the LAN address object as 172.16.5.0/255.255.255.0. It also shows Per-Device Mapping entries only for BR1-FGT-1 [root], HQ-NGFW-1 [root] , and Remote-Firewall [root]. There is no mapping shown for Remote-Firewall [VDOM1] .

The FortiManager 7.6 Administrator Study Guide gives the exact rule: “The devices in the ADOM that do not have a dynamic mapping for LAN have a default value.” It also states that dynamic mappings are configured per device in the Per-Device Mapping section.

Since Remote-Firewall [VDOM1] does not have its own mapping entry, it will use the object’s default value, which is 172.16.5.0/255.255.255.0.

The output shows dev-db: not modified; conf: in sync, which means the device-level database is aligned with the latest revision history, so A is false. The study guide explains that “Synchronized / Auto-update: The latest revision history configuration entry … is aligned with the configuration on FortiGate,” and dev-db: not modified indicates the device-level settings are not changed on FortiManager.

For the policy layer, the output shows pkg:[imported]BR1-FGT-1. The study guide states “Imported: indicates that a policy package was successfully imported for a managed device,” so the policy package in FortiManager matches what was imported from the managed device context, making C correct.

D is also correct because the lab guide explicitly says “All Provisioning Templates applied on FortiGate devices have precedence over any configuration you apply on the device layer of the FortiManager.”

The correct answers are A and E. The study guide explicitly states under Database Integrity that scheduled backups “Automatically executes database integrity commands” and “Does not automatically make corrections”. That exactly verifies A.

It also states in Best Practices—Database Integrity: “Always follow the proper upgrade path” and “If you don’t, it may cause inconsistencies in the database.” That exactly verifies E.

B is incorrect because diagnose dvm check-integrity verifies and corrects device manager database issues such as device states, memberships, lock statuses, and duplicate VDOM entries, not a corrupted file system. C is incorrect because locked device status issues are listed under diagnose dvm check-integrity, not diagnose cdb check adom-integrity. D is not a stated FortiManager best practice in the uploaded guide.

Using the Install Wizard is the recommended method to reinstall the central policy package on the BR1-FGT-1 firewall, ensuring all settings, installation targets, and dependencies are correctly processed during installation.