The correct answers are B and C. The FortiManager 7.6 Administrator Study Guide explicitly states: “Scripts that you run directly on remote devices also cause automatic updates and create a revision history.” This exact extract proves both results: FortiManager creates a new revision history and the device status becomes Auto-Updated, meaning the FortiGate change is automatically reflected in the FortiManager device-level database.

The lab guide also distinguishes this from database-targeted scripts by stating: “You must perform an installation if you run a script on a device database, policy package, or ADOM database.” That wording excludes Remote FortiGate Directly via CLI, so D is incorrect.

A is also incorrect because direct remote execution does not use the install preview workflow; preview and validation are tied to Install Wizard operations, not direct CLI execution.

=========

The exhibit shows the default value of the LAN address object as 172.16.5.0/255.255.255.0. It also shows Per-Device Mapping entries only for BR1-FGT-1 [root], HQ-NGFW-1 [root] , and Remote-Firewall [root]. There is no mapping shown for Remote-Firewall [VDOM1] .

The FortiManager 7.6 Administrator Study Guide gives the exact rule: “The devices in the ADOM that do not have a dynamic mapping for LAN have a default value.” It also states that dynamic mappings are configured per device in the Per-Device Mapping section.

Since Remote-Firewall [VDOM1] does not have its own mapping entry, it will use the object’s default value, which is 172.16.5.0/255.255.255.0.

The exhibit shows Remote-FortiGate with a green closed lock icon, which indicates a locked policy package. The FortiManager 7.6 Administrator Study Guide states: “Policy locking is available in workspace normal and per-ADOM modes” and “Policy locking allows administrators to work on and lock a single policy package instead of locking the whole ADOM.” This confirms that a package such as Local-FortiGate_root can also be locked, so A is correct.

B is incorrect because the study guide and lab guide describe snapshots as ADOM revisions, not policy package snapshots: “An ADOM revision creates a snapshot of the policy and object configuration for the ADOM.”

D is incorrect because in workflow mode, sessions and approval are required before installation. The exhibit shows a normal save/lock state, not a workflow session state.

=========

The command set workspace-mode normal enables Workspace (ALL ADOMs). In this mode, FortiManager uses ADOM locking to prevent configuration conflicts. The study guide explains that workspace mode is used to prevent concurrent ADOM access, and once an ADOM is locked, only the administrator who locked it has read-write access while all others have read-only access. That makes D correct.

B is also correct because locking is applied per ADOM, so different administrators can work at the same time on different ADOMs without conflicting with each other. This is consistent with the design goal of workspace mode and ADOM locking.

C describes workflow mode, not workspace normal. Approval before installation is required only with set workspace-mode workflow.

=========

In a FortiManager HA cluster configured with VRRP failover, the failover process is automatic and transparent to administrators. If the monitored interface on the primary device fails, the secondary device takes over without requiring manual intervention to maintain HA.

The correct answer is A. This conclusion comes from the HA settings shown in the exhibit plus Fortinet’s HA behavior. In the exhibit, HQ-NGFW-1 has memory-based-failover enabled, memory-failover-threshold 70, memory-failover-monitor-period 50, and its memory usage is about 90%, while HQ-NGFW-2 is about 48.7%. Fortinet’s official documentation states that memory-failover-threshold is the memory percentage that triggers failover, and memory-failover-monitor-period is the duration high memory must persist before failover occurs. It also states that if utilization stays above the threshold for the entire monitor period, a failover is triggered, and the peer becomes primary. (Fortinet Document Library)

Because the condition was observed for 55 seconds, which is longer than the configured 50-second monitor period, the cluster would fail over from HQ-NGFW-1 to HQ-NGFW-2 due to the memory-failover-threshold condition. The priority setting does not explain this result here, because override is disabled, and flip-timeout governs subsequent memory-based failovers, not the initial trigger. (Fortinet Document Library)

=========

The FortiManager 7.6 Administrator Study Guide states under Copying System Templates Between ADOMs: “The first step is to export the system template from the original ADOM with the execute fmprofile export-profile command” and shows the output file being written to /tmp/Training, described as “File copied in FortiManager tmp folder.”

The key point is that the command exports the system template profile from the original ADOM, while /tmp/Backup_File is only the destination path on FortiManager where the exported file is stored. The same study guide also defines system templates as a “subset of model device configuration—system-level settings”, which means they belong to the device-level side of the ADOM, not the policy database.

So the export source is the ADOM device database, and the file is saved afterward in the FortiManager /tmp folder.

The import process shows that FortiManager will create normalized interfaces named LAN, port4, and port6 at the ADOM layer, mapping them to the corresponding device interfaces based on the import settings.

When FortiManager is behind a NAT device, setting the NATed IP address (100.65.0.120) in the system admin settings causes FortiManager to use that NATed IP address for communication and configuration with FortiGate during discovery and management operations.