The Never Installed status indicates that a policy package has been assigned to a managed device within FortiManager, but the configuration has never been pushed (installed) from FortiManager to the device. This is a common initial state after a new device is registered and associated with a policy package, but before the first deployment is executed. It signifies that no policy synchronization from FortiManager to the device has ever occurred for that specific package.

A. This state is typically represented by an Unknown status, which occurs when FortiManager cannot connect to the device to retrieve its status.

B. This describes a Modified status, indicating that the configuration was changed locally on the managed device and is now different from FortiManager's database.

D. This describes a configuration that is Modified (on FortiManager) or Out-of-Sync, meaning changes have been made in FortiManager that are pending installation on the device.

1. Fortinet FortiManager Administration Guide 7.4.1

Page 310

Table "Installation status".

Never Installed: "The policy package has never been installed to the device."

Modified: "The device has been changed. You can import the changes."

Unknown: "The installation status is unknown."

This official documentation directly defines "Never Installed" as a state where the package has not been pushed to the device

aligning with the scenario in option C where initial synchronization has not happened. It also explicitly defines the statuses described in options A

B

and D as distinct from "Never Installed".

An ADOM revision in FortiManager creates a versioned snapshot of the central management components within a specific Administrative Domain (ADOM). Its primary purpose is to save the current state of all policy packages and their associated objects. This allows administrators to create a restore point before making significant changes. If a new configuration causes issues, the administrator can revert the ADOM's policy and object database to this previously saved, known-good state.

A. This is incorrect because an ADOM revision specifically saves the policy and object database, not the entire state of the ADOM, which would include device inventory and other settings.

C. This describes an action (reverting) that can be performed using a revision, not the purpose of creating one. Also, device-level settings have their own separate revision history.

D. This is incorrect. System Checkpoints are used to save the entire FortiManager system configuration, not the configuration of a specific ADOM.

1. FortiManager Administration Guide 7.4.0

Chapter: Administrative Domains (ADOMs)

Section: Revisions

Page 131.

The guide states

"You can create a revision of an ADOM. An ADOM revision saves the policy packages and objects for that ADOM. You can revert the ADOM to a previous revision if necessary." This directly supports option B.

2. FortiManager Administration Guide 7.4.0

Chapter: System Settings

Section: Creating system checkpoints

Page 53.

This section describes System Checkpoints as a way to "back up the entire FortiManager configuration

" distinguishing it from ADOM-specific revisions and confirming that option D is incorrect.

When both FortiManager and FortiGate are behind NAT devices, the connection must be initiated from the FortiGate to the public IP of the FortiManager.

A. FortiManager discovers the FortiGate using the public IP address of the NAT device in front of the FortiGate. This IP is recorded as the device's IP address in the FortiManager's device list.

D. By default, FortiManager advertises its own private IP address to the FortiGate for management. When FortiManager is behind NAT, this private IP is unreachable. The administrator must manually configure the FortiManager's public (NATed) IP address on the FortiManager itself so it can provide the correct, reachable IP to the FortiGate. Therefore, the NATed IP is not configured by default.

B. The FortiGate must be configured with the FortiManager's public (NATed) IP address to establish a connection, as its private (non-NATed) IP is not routable from the FortiGate's network.

C. Because the FortiGate initiates the connection from behind its NAT device, it is also responsible for re-establishing the FGFM management tunnel if the connection is torn down.

1. FortiManager Administration Guide 7.4

Device Manager > Adding devices > Adding a FortiGate to FortiManager when FortiGate is behind NAT

Page 131: "FortiManager automatically adds the FortiGate device to its device list using the FortiGate NAT device's public IP address." This supports answer A.

2. FortiManager Administration Guide 7.4

Device Manager > Adding devices > Adding a FortiGate to FortiManager when both are behind NAT

Page 132: "When a FortiGate is behind a NAT device

and it is connecting to a FortiManager that is also behind a NAT device

you must configure the FortiManager with its public IP address... Use the config system admin setting and set fmg-source-ip command." This supports answer D

as it shows the NATed IP is not used by default and requires manual configuration.

3. FortiManager Administration Guide 7.4

Device Manager > About the FGFM protocol

Page 118: "If the connection is lost

the FortiGate unit attempts to re-establish the connection." This confirms that the FortiGate

not the FortiManager

re-establishes the tunnel

making option C incorrect.

The exhibit displays a dynamic firewall address object configured in FortiManager. This feature allows an object to have different values depending on the target FortiGate. The object Internal-LAN has a "Default Value" of 192.168.1.0/24. A specific "Per-Device Mapping" is set for the device FGTA to use 192.168.1.0/28. For any FortiGate device that is not explicitly listed in the Per-Device Mapping table, FortiManager will use the configured "Default Value" when installing the policy package. Therefore, devices without a specific mapping will receive the IP/netmask 192.168.1.0/24.

A. An error is not generated because the default value is specifically designed to be used as a fallback for devices without a custom mapping.

C. 192.168.1.0/28 is the mapped value for the specific device FGTA, not for devices that lack a per-device mapping.

D. The object is not set to none; it is populated with the default value, ensuring policy integrity on the target device.

1. FortiManager Administration Guide 7.4.1

Page 388

Section: "Dynamic objects".

The guide states: "When you create a dynamic firewall object

you can define a default value for the object

and then define per-device mapping for the object... When you install the policy package to a device that is not in the mapping list

the default value is used." This directly supports the use of the default value for unmapped devices.

A FortiManager backup file (.dat) is designed to save the essential configuration data required to restore the system's operational state. This includes the FortiManager's own system settings, such as network interfaces, administrator accounts, and logging configurations (often referred to as the flash configuration). Crucially, it also contains the entire database of managed devices, including their configurations, policies, and objects. Items that are large, dynamic, or easily re-downloaded, such as firmware images and the FortiGuard database, are intentionally excluded to ensure the backup process is efficient and the file size is manageable.

B. Firmware images: Firmware images are explicitly excluded from the backup. They must be manually re-imported to the FortiManager appliance after a system restore.

C. FortiGuard database: The FortiGuard database is dynamic data downloaded from Fortinet's services. It is not included in the backup and is re-downloaded after a restore.

1. Fortinet FortiManager Administration Guide 7.4.0

System Settings > Backup and Restore > Backing up the configuration

Page 138: "The backup file is a .dat file that contains the FortiManager configuration

including the device list

and device configuration. The backup file does not include firmware images saved on the FortiManager unit

the FortiGuard database

or logs." This reference directly confirms that device configurations (A) and the FortiManager's own configuration (D) are included

while explicitly stating that firmware images (B) and the FortiGuard database (C) are not.