Free Fortinet NSE6_FMG_AD-7.6 Practice Test Questions and Answers (2026)

FortiManager can function as a central local FortiGuard Distribution Server (FDS) for managed FortiGate devices. When configured, FortiManager downloads antivirus, IPS, and software updates once from Fortinet's public FortiGuard servers and stores them in its local cache. By configuring managed FortiGates with a FortiGuard server override address pointing to FortiManager's IP address (or pushing central management FortiGuard settings), FortiGate devices query FortiManager locally for update packages. This localized distribution model drastically reduces WAN bandwidth consumption across the 50 managed FortiGate devices while maintaining up-to-date threat prevention capabilities.

B: FortiManager acts as a caching distribution server for updates, not purely a non-caching query proxy.

C: Manual device bypass configurations are unnecessary; setting the override server address redirects update traffic properly.

D: Firmware caching alone does not handle dynamic antivirus and IPS database definitions without FortiGuard update settings.

- Fortinet FortiManager 7.2.0 Administration Guide

Section: "FortiGuard Management"

Subsection: "Configuring FortiManager as a local FDS"

pp. 310-315.

- Fortinet FortiManager 7.4.0 Study Guide

Chapter: "System Settings"

Section: "Local FortiGuard Server Configuration"

pp. 205-209.

Based on the error message in the fourth exhibit (image_f64afd.png), the installation fails because "Mobile FortiToken FTKMOB4A9AC5C56D... could not be found at device." The third exhibit (image_f64b16.png) reveals that this specific FortiToken is actually registered to a different FortiGate device named BR1-FGT-1. FortiToken Mobile licenses are cryptographically bound to the specific FortiGate serial number to which they are imported. FortiManager cannot successfully push a user configuration requiring a token to HQ-NGFW-1 if the referenced token is physically licensed to BR1-FGT-1. To resolve this, the administrator must assign a FortiToken that has been validly imported into and exists on HQ-NGFW-1.

A: Meta fields are utilized for dynamic object and policy mappings, not for assigning or resolving missing hardware-locked FortiToken licenses on a target device.

C: A single FortiToken (hardware or mobile) can strictly be assigned to only one user at a time; assigning the same token to multiple users is unsupported.

D: While per-device mapping allows dynamic object values across devices, it cannot bypass the strict hardware-level licensing requirement of a FortiToken tied to a specific FortiGate chassis.

Fortinet, Inc. FortiManager 7.6 Administration Guide. "AP-FortiToken Management" and "Object Configuration". Section: FortiToken assignments and device binding.

Fortinet, Inc. FortiOS 7.6 Administration Guide. "Two-factor authentication". Section: FortiToken Mobile provisioning.

Based on the provided exhibits, "image_f652d5.jpg" shows that the FortiGate is running an older IPS Definitions database (Version 6.00741). Conversely, "image_f652ba.jpg" indicates the FortiManager is utilizing significantly newer Signature Meta Data (Version 29.00906). When configuring policies, FortiManager uses its own signature metadata to populate the available IPS signatures in its GUI. If an administrator selects a newly released IPS signature from the FortiManager's updated database and pushes this policy, the FortiGate will fail to recognize the configuration because the specific signature ID does not exist in its older, mismatched local IPS database.

A: FortiGate uses the update server-type specifically for downloading IPS definitions, whereas rating is strictly reserved for real-time query services like Web Filtering and DNS Filtering.

C: There is no requirement to enable IPv6 connections to resolve a database mismatch; the current IPv4-mapped IPv6 address is completely valid for management and update traffic.

D: In a closed network using FortiManager as a local FDS, fortiguard-anycast must remain disabled to ensure the FortiGate queries the local server rather than external public servers.

Fortinet, Inc. FortiManager 7.6 Administration Guide. "FortiGuard Management" (Section: Signature and Database Updates).

Fortinet, Inc. FortiOS 7.6 Administration Guide. "System FortiGuard" (Section: Overriding default FortiGuard servers / Update vs. Rating).

The FortiManager process responsible for downloading the web filter and email filter databases from public FortiGuard Distribution Network (FDN) servers is the FortiGuard link daemon (fgdlinkd). This daemon maintains the secure connections to public FortiGuard servers to pull these specific database updates, whereas a separate daemon (fgdupd) handles Antivirus and IPS updates. By analyzing the execute top command output provided in the exhibit, the fgdlinkd process (PID 1463) is shown in the %MEM column to be utilizing exactly 2.9% of the available RAM. Therefore, 2.9 is the correct percentage of memory used by the database-downloading process in this scenario.

A: 1.5% is the memory used by fclinkd, which manages FortiClient endpoint connections, not the process responsible for downloading FortiGuard web or email filter databases.

B: 3.1% corresponds to fwmsvrd, the primary FortiManager server daemon that manages device communication via the FGFM protocol. It does not download FortiGuard databases.

C: 4.1% is utilized by fgdsvr. This daemon responds to web and email filtering rating requests from managed FortiGate clients; it does not download the databases from public servers.

Fortinet NSE 6 - FortiManager 7.6 Study Guide, Chapter 6: FortiGuard, Section "FortiGuard Daemons". This document details the distinct roles of fgdlinkd (downloading web/email databases), fgdsvr (handling client filtering requests), and fwmsvrd (device management).

FortiManager 7.6 CLI Reference Guide, Fortinet Document Library, Section "diagnose debug application". This officially outlines the daemon functionalities and their respective application names (fgdlinkd, fclinkd, fgdsvr, etc.) mapped to system processes.

Exhibit "image_e8baf7.png": The provided execute top CLI output demonstrating the real-time memory (%MEM) allocation where fgdlinkd consumes 2.9%.

Based on the diagnose dvm device list output in the exhibit, the device with OID 262 (HQ-NGFW) has a TYPE of fmgfaz-model and lacks both a serial number and an IP address. A model device in FortiManager is a pre-provisioned, offline placeholder used for staging configurations before the physical device is brought online. The diagnose test deploymanager reloadconf <device_id> command actively attempts to connect to a live FortiGate to retrieve its current configuration. Because the model device has no active IP address or live connection to poll, the FortiManager cannot reach it, resulting in the "Configuration file import error".

A: The proper syntax for this CLI command explicitly requires the device ID (OID), not the device name.

C: The command is correctly formulated using the device ID (OID); it does not require or accept the FortiGate serial number as the argument.

D: FortiManager versions (including v7.6.1) maintain backward compatibility and fully support managing devices running FortiOS version 7.0.

Fortinet Document Library: FortiManager 7.4 Administration Guide (Section: Provisioning devices > Adding model devices).

Fortinet Document Library: FortiManager 7.4 CLI Reference (Section: diagnose test deploymanager).

Upgrading FortiManager firmware updates the core operating system and management engine, but it does not automatically upgrade the version of existing Administrative Domains (ADOMs). ADOM versions represent the supported FortiOS firmware version for managed devices, policy packages, and object definitions within that specific domain. Upgrading ADOM versions is an independent administrative task that must be performed manually after completing the FortiManager system upgrade. This design ensures that policy packages, object schemas, and device definitions remain stable and compatible with currently deployed FortiGate units until the administrator explicitly chooses to upgrade the ADOM version to match new FortiOS capabilities.

A: Database integrity checks validate database structure but do not trigger automatic ADOM version upgrades.

C: A stuck process task does not cause ADOM versions to remain unchanged after firmware upgrades.

D: Locking ADOMs in workspace mode prevents editing configuration objects, not system-level firmware upgrades.

- Fortinet Documentation Library

FortiManager 7.2 Administration Guide: "ADOM versions and FortiManager firmware upgrades" (Section: System Settings > Administrative Domains).

- Fortinet Training Institute

FortiManager Infrastructure Study Guide: "Administrative Domains (ADOMs)" & "Firmware Upgrade Considerations".

Based on the provided exhibits, the conflict window for the Firewall Profile-Protocol-Options object named default reveals that the only discrepancy between the FortiGate and FortiManager configurations is the comment field ("All default services." versus "All services."). Because comments are purely administrative metadata, this discrepancy does not influence traffic processing, policy enforcement, or operational behavior. Therefore, it is the only profile among the conflicts that does not significantly affect the actual functional configuration. In contrast, the other profile conflicts involve critical traffic-handling differences, such as changing a web filter action from block to monitor, or altering the QUIC protocol action from inspect to bypass.

A: The blank value under FortiGate merely indicates an unconfigured, default, or inherited port setting, not a hardware or software inability to support HTTPS on port 443.

B: Object conflicts occur when object names match but settings differ between the device and ADOM database. They are resolved by selecting which value to keep, not by altering firmware.

D: The discrepancy for QUIC is clearly shown under the SSL-SSH profile as an action setting (inspect versus bypass), which is a localized configuration, not a FortiGuard database mismatch.

Fortinet, Inc. FortiManager 7.6 Administration Guide. Device and Policy Management: Importing Policy Packages and Resolving Object Conflicts.

Fortinet Training Institute. Fortinet NSE 6 - FortiManager 7.6 Study Guide. Chapter: Policy and Objects (Object Conflicts).

During the device import process in FortiManager, the Interface Mapping & Policy step allows administrators to map local device interfaces to ADOM-level normalized interfaces. Based on the provided exhibit, the device interfaces port2, port4, and port6 are being mapped to the normalized interfaces LAN, Port4, and port6 respectively. When this import wizard is completed, FortiManager will automatically generate these normalized interfaces at the ADOM layer if they do not already exist, ensuring that the imported policies reference the correct logical objects within the ADOM database.

Option A: Interface mappings can use either Per-Device (as seen with port2) or Per-Platform types; forcing all to Per-Platform is not required for interface detection.

Option B: The import wizard automatically creates the specified normalized interfaces in the ADOM layer during the import process, rendering manual creation unnecessary.

Option D: Selecting "Import only policy dependent objects" is a recommended best practice to prevent ADOM database bloat and does not cause operational failures on the FortiGate.

Fortinet, Inc. FortiManager 7.6 Administration Guide. Section: Policy & Objects > Importing policies and objects. Document ID: FMG-76-Admin-Guide.

Fortinet Training Institute. NSE 6 FortiManager Study Guide. Chapter 4: Policies and Objects, "Importing Device Policies" (Pages 124-128).

To dynamically assign different source interfaces for FortiAnalyzer logging across multiple devices using a single system template, administrators must use meta fields. By creating a meta field of type "Device" under FortiManager System Settings, a unique interface name (e.g., port1, wan1) can be assigned to each individual FortiGate's properties. This meta field variable is then referenced within the system template's advanced options (as seen in the "image_e9116f.png" exhibit). When the template is deployed, FortiManager resolves the variable, replacing it with the specific interface value configured for that targeted device, enabling highly scalable provisioning.

A: Dynamic objects are utilized to map logical firewall addresses to device-specific IP addresses within policy packages, not for defining system-level template configurations like logging interfaces.

B: Meta fields (variables) must be created globally under FortiManager System Settings, not at the ADOM level, before they can be mapped to individual devices and templates.

C: Creating separate templates for every device is highly inefficient and defeats the purpose of using centralized, scalable provisioning templates for enterprise management.

Fortinet, Inc. FortiManager 7.6 Administration Guide. Section: "System Settings" -> "Advanced" -> "Meta fields". (Details the creation of Device-type meta fields for dynamic variable substitution).

Fortinet, Inc. FortiManager 7.6 Administration Guide. Section: "Device Manager" -> "Provisioning Templates" -> "System Templates". (Explains the application of meta variables within template configurations to accommodate device-specific variations).

Based on the provided "Managed FortiGate devices" exhibit, the device named Local-FortiGate* is a member of the Training Security Fabric group and has an asterisk (*) appended to its name. In FortiManager, this asterisk acts as a status indicator signifying that the device's configuration is out-of-sync with the FortiManager's device-level database. To resolve this discrepancy and ensure that the Security Fabric topology, settings, and group synchronizations are accurate, the administrator must retrieve the configuration from the Local-FortiGate device.

Option B: The Install On column for Policy sequence #1 explicitly lists ISFW (root) and ISFW (Student), completely omitting the Trainer VDOM.

Option C: Selecting Installation Targets in the Install On column is a valid, standard FortiManager configuration that dynamically applies policies to the package's targets without causing errors.

Option D: The exhibit strictly displays a local ADOM policy package named Shared_Package; it does not provide any evidence of a global policy package being merged or applied.

Fortinet, Inc. FortiManager 7.6 Administration Guide. "Device Manager: Device Status and Synchronization." (Details the use of the asterisk * for out-of-sync device databases).

Fortinet, Inc. FortiManager 7.6 Administration Guide. "Policy & Objects: Policy Packages and Installation Targets."

Fortinet NSE 6 - FortiManager 7.x Official Courseware. "Managing Device Configurations and Security Fabric."