The command set workspace-mode normal enables Workspace (ALL ADOMs) . The study guide states that in this mode “All ADOMs can be locked” and workspace mode lets administrators lock ADOMs, devices, policy packages, and objects. The lab guide then gives the exact behavior for ungraceful session closure: “If a session is not closed gracefully … FortiManager does not close the administrator session until it times out or the session is deleted. Until this time, the ADOM remains in a locked state.” That directly proves A .

C is also verified by the lab guide statement: “If an administrator locked one or more ADOMs, and then logs out of FortiManager, all of those ADOMs are unlocked.” The phrase “one or more ADOMs” confirms the same administrator can lock multiple ADOMs at once.

D is a workflow mode approval concept, not workspace normal.

The correct answer is C . The FortiManager 7.6 Administrator Study Guide states that after adding the root FortiGate of a Security Fabric, all downstream devices in the fabric are automatically added as Unauthorized in the root ADOM . That directly matches option C.

This is important because the administrator created a FortiGate-only ADOM named Training, not a Fabric ADOM. The lab guide explains that a FortiGate ADOM is intended for FortiGate devices, while the Fabric type is the special ADOM type that allows FortiGate and other device types together.

So the downstream members are not automatically authorized, and they do not immediately appear as managed devices inside the Training ADOM. They first appear as unauthorized devices in the root ADOM , where the administrator can review and authorize them.

=========

The correct answer is D . The exact extract from the study guide says a revert operation “Reverts only the device database to the previous revision” and “Does not revert policies and objects—you must import them.” It further states: “Performing a revert operation followed by an installation only reverts device-level changes and does not revert policy packages.”

That exactly matches the CLI output. The device shows the device manager portion as installed and synchronized, while the policy package appears as unknown, which indicates the revert and installation affected the device-level configuration only . It did not reinstall or synchronize the policy package. Therefore B is incorrect. A is unsupported by the source, and C is unrelated because the firmware version is already shown in the device list output. The study guide also states that after revert you must use Import Configuration to synchronize policy information.

The correct answers are A and C . The FortiManager 7.6 Administrator Study Guide gives the exact extract: “FortiManager creates a configuration revision when: FortiGate is added to FortiManager, Device changes are installed from FortiManager, FortiGate configuration is retrieved from FortiManager, A local change on FortiGate causes an automatic update” .

This exactly proves A , because device changes are installed from FortiManager , and C , because a local change on FortiGate causes an automatic update . The guide also states: “By default, all changes made on a managed FortiGate device are automatically updated on FortiManager and reflected in revision history” .

B and D only modify the FortiManager device-level database status to Modified . They do not, by themselves, create a new revision history until an install, retrieve, or auto-update occurs.

The correct answer is D . The FortiManager 7.6 Administrator Study Guide gives the exact extract under Web Filter and Email Filter : “fgdlinkd — Responsible for downloading web filter and email filter databases” . The same study guide section explains that the execute top command displays real-time CPU and RAM usage, and the %MEM column shows the memory percentage used by each process.

In the exhibit, the line for fgdlinkd shows %MEM 2.9 . Therefore, the process responsible for downloading the web and email filter databases is using 2.9% of RAM. That matches option D exactly. The other values belong to different processes, such as fgdsvr and other FortiGuard-related daemons, but not the downloader process identified in the study guide.

=========

The command set workspace-mode normal enables Workspace (ALL ADOMs) . In this mode, FortiManager uses ADOM locking to prevent configuration conflicts. The study guide explains that workspace mode is used to prevent concurrent ADOM access , and once an ADOM is locked, only the administrator who locked it has read-write access while all others have read-only access. That makes D correct.

B is also correct because locking is applied per ADOM, so different administrators can work at the same time on different ADOMs without conflicting with each other. This is consistent with the design goal of workspace mode and ADOM locking.

C describes workflow mode , not workspace normal. Approval before installation is required only with set workspace-mode workflow.

=========

FortiManager global policies and objects are shared across ADOMs, but they are not applied automatically to every package . The study guide states that when you create a global policy package, you can choose the ADOMs you want to apply it to, and you can even pick specific policy packages in individual ADOMs . That directly validates B .

A is also correct because the lab guide explicitly says you can promote ADOM objects to global objects by right-clicking an ADOM object and selecting Promote to Global .

C is incorrect because when Automatically Install Policies to ADOM Devices is enabled, FortiManager installs without giving you a preview/accept step first; the lab warns to use it only when you are sure of the changes.

D is incorrect because FortiManager imports device policies into an ADOM policy package, not into the global package for synchronization.