In FortiManager with workspace mode enabled, any attempt to modify the configuration, including deleting an object, requires the administrator to first lock the Administrative Domain (ADOM). This prevents concurrent changes and ensures administrative control. Therefore, the system will not permit the deletion until the ADOM is locked.

Once the ADOM is locked and the administrator deletes an address object that is referenced in a firewall policy, FortiManager automatically replaces the deleted object within that policy with the none address object. This action maintains the structural integrity of the firewall policy while removing the specific reference, preventing validation or installation errors.

A. FortiManager will temporarily change the status of the referenced firewall policy to disabled.

This is incorrect. FortiManager modifies the policy's content by replacing the object, but it does not change the enabled/disabled status of the policy itself.

B. FortiManager will disable the status of the address object until the changes are installed.

This is incorrect. Address objects in FortiManager do not have an enabled or disabled status; they are either present in the database or they are not.

1. FortiManager Administration Guide 7.4.1

Page 218

"Workspace mode": "When workspace mode is enabled

you must lock an ADOM before you can make changes to it." (Supports answer C)

2. FortiManager Administration Guide 7.4.1

Page 381

"Deleting objects": "If you delete an object that is used by other objects

such as a firewall policy

the deleted object is replaced by the none object." (Supports answer D)