Fortinet NSE 5 Practice Test

NSE 5 practice test: what's covered

• FortiManager + FortiAnalyzer Specialist

Free NSE 5 sample questions

1. An administrator wants to manage 200 FortiGates across three business units that must NOT see each other's policies, objects, or logs in FortiManager. What is the BEST design?

   • A. Create three FortiManager VDOMs, one per business unit
   • B. Create three ADOMs in FortiManager, assign devices and admin profiles per ADOM
   • C. Create three separate Global Databases
   • D. Use three policy packages but a single Default ADOM
   Show answer

   Correct: B. ADOMs (Administrative Domains) are the multi-tenancy boundary in FortiManager — devices, policy packages, objects, and admin RBAC are scoped per ADOM. FortiManager itself has no VDOMs (that's a FortiGate construct), and Global Database is a single shared header/footer policy layer, not a tenant boundary. Three policy packages under one ADOM would still expose objects across business units.

2. After enabling ADOM mode for the first time on FortiManager, which device shows up where?

   • A. All managed devices land in the Global Database
   • B. Devices are auto-distributed to ADOMs matching their FortiOS major version (e.g. FortiGate 7.2 → ADOM "FortiGate 7.2")
   • C. All devices land in the Default ADOM "root"
   • D. Devices remain unmanaged until admin manually assigns each one
   Show answer

   Correct: B. When ADOM mode is first enabled, FortiManager auto-creates version-specific ADOMs (FortiGate 7.0, 7.2, 7.4, etc.) and places each managed device into the ADOM matching its OS major.minor version. This is why mixing FortiOS versions can result in devices "disappearing" from where an admin expected them. Global Database is a separate construct (header/footer policies and shared objects), not a parking lot.

3. Which TWO statements are TRUE about FortiManager HA in 7.x? (Choose 2)

   • A. A FortiManager HA cluster supports up to 5 nodes — 1 primary + 4 secondaries
   • B. Configuration sync between HA members is unidirectional from primary to secondaries
   • C. Both primary and secondaries can be used to push policy installs to FortiGates
   • D. HA in FortiManager requires identical hardware models for both nodes
   • E. FortiAnalyzer features built into FortiManager are NOT synchronised across HA members
   Show answer

   Correct: A and B. FortiManager HA (7.x) is up to 5 nodes (1 primary + 4 secondaries) with unidirectional config sync from primary to secondaries. Only the primary handles policy installs. Hardware does not have to be identical (just same model family is recommended). The integrated FortiAnalyzer logging features ARE synced between HA members in modern releases — that's the most common trap (the old "logs are not synced" myth from earlier 5.x days).

4. An admin profile has "Read-Write" access to ADOM "Branch-EU" only. The admin logs in and tries to edit a shared firewall address object that exists in the Global Database. What happens?

   • A. The change succeeds — ADOM admins inherit Global Database write rights
   • B. The change is rejected — Global Database edits require Super_User or an admin profile with explicit Global Database privilege
   • C. The change is saved but only takes effect in ADOM Branch-EU
   • D. The change is queued for approval
   Show answer

   Correct: B. Global Database contains header/footer policies and shared dynamic objects that all ADOMs can reference. ADOM-scoped admins can only READ these objects in their ADOM context. To modify Global Database, the profile must explicitly grant Global Database read-write or the admin must be Super_User. This RBAC boundary is one of the most-tested NSE 5 concepts.

5. You run on FortiManager CLI: <pre>FMG # diagnose dvm adom list ADOMs: name=root ver=7.2 type=fos state=normal device_count=42 name=Branch ver=7.2 type=fos state=normal device_count=18 name=DC ver=7.4 type=fos state=normal device_count=6</pre> Which statement is correct?

   • A. There are three FortiGate ADOMs across two different FortiOS versions
   • B. Only the "root" ADOM is active; the others are in read-only mode
   • C. All three ADOMs share the same Global Database revision history
   • D. Devices in the DC ADOM cannot be managed because version mismatch with root
   Show answer

   Correct: A. The output shows three FortiOS-type ADOMs (root and Branch on 7.2; DC on 7.4). FortiManager handles per-ADOM versioning natively, so a 7.4 device in its own ADOM is fully manageable alongside 7.2 devices in others. State=normal means each ADOM is fully active, not read-only. Global Database has its own revision history independent of ADOM versions.

Last updated: 2026-10-19

NSE 5 practice test FAQ

Related practice tests

• FortiGate FCP_FGT_AD-7.4 practice test
• Fortinet FCSS_EFW_AD-7.6 practice test
• Fortinet NSE4 practice test
• Fortinet NSE7-EFW practice test
• Fortinet NSE 8 practice test