Working without an ADOM checkpoint can complicate restoring central policy data. That consequence is more specific to a team needs to capture the ADOM policy and object state before a large firewall rule reorganization. For this case, the most direct exposure is applying an ADOM policy snapshot to a device-only change targets the wrong configuration layer.

Unprotected old revisions can disappear before an investigation needs them. That consequence is more specific to an ADOM revision was automatically purged even though the audit team needed to preserve it. For this case, the most direct exposure is applying an ADOM policy snapshot to a device-only change targets the wrong configuration layer.

Indefinite or uncontrolled revision retention can consume resources or delete needed evidence. That consequence is more specific to a multi-tenant FortiManager contains old ADOM revisions consuming retention capacity and no retention policy. For this case, the most direct exposure is applying an ADOM policy snapshot to a device-only change targets the wrong configuration layer.

Configure a suitably licensed FortiManager as a local FortiGuard Distribution Server for managed clients. This can be appropriate when a group of isolated FortiGates should retrieve signature updates through a centrally controlled management network instead of each using the internet. It does not directly address the present situation, where the required correction is test web and email rating lookup service behavior separately from antivirus package delivery.

Configure the supported outbound proxy settings for FortiGuard network access. This can be appropriate when a FortiManager in a restricted site must download FortiGuard updates through an enterprise web proxy. It does not directly address the present situation, where the required correction is test web and email rating lookup service behavior separately from antivirus package delivery.

Enable the documented public fallback behavior only when policy allows and test the intended private-server precedence. This can be appropriate when a managed firewall is configured to query a private FortiGuard service but the local FDS is unreachable during an outage. It does not directly address the present situation, where the required correction is test web and email rating lookup service behavior separately from antivirus package delivery.

Installation preview includes the sensitive rule only on the two approved populations. That observation is relevant for the separate case a security team wants a single policy package to serve three device populations, but only two are approved for a sensitive rule. Here the decisive evidence is the relevant feature controls become available for a compatible policy or object editor.

The FortiGate running configuration and controlled traffic reflect the intended inspection behavior. That observation is relevant for the separate case a new administrator relies on the policy preview alone and fails to verify that an inspection profile is applied after installation. Here the decisive evidence is the relevant feature controls become available for a compatible policy or object editor.

Installation preview resolves the policy interfaces correctly without fallback guesses. That observation is relevant for the separate case a FortiGate's interface is renamed locally, leaving a centrally managed policy with an outdated interface mapping. Here the decisive evidence is the relevant feature controls become available for a compatible policy or object editor.

Version mismatch can prevent accurate interpretation or installation of managed configuration. That consequence is more specific to a FortiGate was upgraded to a newer FortiOS major version but its original ADOM version does not support that configuration. For this case, the most direct exposure is assuming identical capabilities across ADOM device modes can cause failed administrative actions.

Untracked device membership can let gateways miss centrally controlled security updates. That consequence is more specific to an organization operates hundreds of managed devices but cannot determine which FortiManager ADOM is responsible for an orphaned gateway. For this case, the most direct exposure is assuming identical capabilities across ADOM device modes can cause failed administrative actions.

Stale package targets can cause skipped installation or deployment to unintended devices. That consequence is more specific to an administrator expects a FortiGate moved between ADOMs to retain an old package's installation targets automatically. For this case, the most direct exposure is assuming identical capabilities across ADOM device modes can cause failed administrative actions.

Complete the initial setup workflow with the approved management address, gateway and DNS settings. This can be appropriate when a newly deployed FortiManager appliance is reachable only through an unplanned factory addressing scheme. It does not directly address the present situation, where the required correction is validate and activate the supported FortiManager VM license before relying on production management capacity.

Reconcile the restored license, network identity and registered device connectivity after migration. This can be appropriate when FortiManager configuration is migrated to replacement hardware but administrators forget to validate device entitlements and reachability. It does not directly address the present situation, where the required correction is validate and activate the supported FortiManager VM license before relying on production management capacity.

Review interface administrative access and permitted management source controls before enabling remote access. This can be appropriate when a remote FortiManager administrator cannot authenticate after an initial network setup because management services are not exposed on the intended interface. It does not directly address the present situation, where the required correction is validate and activate the supported FortiManager VM license before relying on production management capacity.

Create an eligible model device and populate a supported device blueprint for initial provisioning. This can be appropriate when an organization wants to preconfigure a FortiGate before hardware reaches a remote branch. It does not directly address the present situation, where the required correction is validate the platform and FortiOS compatibility before binding the provisioning template.

Review copied template values and target membership before applying them in the destination ADOM. This can be appropriate when a provisioning engineer copies a system template from a retail ADOM into a finance ADOM without checking environment differences. It does not directly address the present situation, where the required correction is validate the platform and FortiOS compatibility before binding the provisioning template.

Apply a supported system template to the correct managed devices or device group. This can be appropriate when a fleet of branch appliances requires identical DNS and NTP settings but is being configured by hand on every unit. It does not directly address the present situation, where the required correction is validate the platform and FortiOS compatibility before binding the provisioning template.

Inspect restored ADOM revision contents and verify that the intended revision was selected. This can be appropriate when an ADOM backup was restored but some custom objects appear missing from the active policy view. It does not directly address the present situation, where the required correction is apply an appropriately limited administrator profile and test system-level access restrictions.

Recognize Backup mode as read-only central storage and use a supported device-side change workflow. This can be appropriate when an administrator attempts to modify a managed FortiGate through an ADOM configured in Backup mode. It does not directly address the present situation, where the required correction is apply an appropriately limited administrator profile and test system-level access restrictions.

Follow FortiManager's supported device move procedure and review destination ADOM objects and policy assignment. This can be appropriate when a device needs to move from one customer ADOM to another due to a contract transfer. It does not directly address the present situation, where the required correction is apply an appropriately limited administrator profile and test system-level access restrictions.

Create a reusable FortiManager policy package and assign the approved installation targets. This can be appropriate when a company needs a consistent internet-access rule set across six FortiGate branches with distinct device addresses. It does not directly address the present situation, where the required correction is confirm the installed target policy includes the specified security profile and effective inspection action.

Create or reconcile the appropriate supported security profile reference before policy installation. This can be appropriate when a managed firewall requires IPS protection but the policy package references a profile missing from the ADOM object inventory. It does not directly address the present situation, where the required correction is confirm the installed target policy includes the specified security profile and effective inspection action.

Define supported ADOM metadata variables and map approved values for affected devices. This can be appropriate when a multi-site policy uses one object placeholder for location-specific DNS hosts. It does not directly address the present situation, where the required correction is confirm the installed target policy includes the specified security profile and effective inspection action.

The managed device database reflects the current approved interface configuration. That observation is relevant for the separate case an operations engineer expects changes to FortiGate interfaces to appear in Policy & Objects without maintaining the device database. Here the decisive evidence is policy & Objects lists the authorized gateway among eligible targets for the intended package.

The replacement device is managed under the authorized record with current configuration restored. That observation is relevant for the separate case a FortiGate was replaced after hardware failure, and the new unit is still associated with a stale device identity. Here the decisive evidence is policy & Objects lists the authorized gateway among eligible targets for the intended package.

Finance devices receive only reviewed settings consistent with their own network requirements. That observation is relevant for the separate case a provisioning engineer copies a system template from a retail ADOM into a finance ADOM without checking environment differences. Here the decisive evidence is policy & Objects lists the authorized gateway among eligible targets for the intended package.

The automation records the operation-specific result and confirms completion through task evidence. That observation is relevant for the separate case an API client treats every HTTP success response as proof that an installation operation completed successfully. Here the decisive evidence is administrators see only their assigned device groups and package objects.

The client stops on nonretryable errors and logs the rejected operation without repeating changes. That observation is relevant for the separate case a FortiManager API integration sees a JSON-RPC application error but retries the identical destructive request indefinitely. Here the decisive evidence is administrators see only their assigned device groups and package objects.

The expected managed nodes and links are visible and discrepancies are investigated. That observation is relevant for the separate case a central administrator cannot see network connectivity among managed devices needed for a security review. Here the decisive evidence is administrators see only their assigned device groups and package objects.

Investigate management data synchronization status and underlying connectivity or load. This can be appropriate when a secondary FortiManager reports a large pending module synchronization backlog during peak network usage. It does not directly address the present situation, where the required correction is confirm the peer has current synchronized modules before initiating the approved failover procedure.

Investigate peer network reachability and HA configuration before relying on failover. This can be appropriate when a FortiManager HA secondary has stopped receiving heartbeat packets but the primary remains online. It does not directly address the present situation, where the required correction is confirm the peer has current synchronized modules before initiating the approved failover procedure.

Use the supported `get system ha` diagnostic command on the relevant appliance. This can be appropriate when a new administrator needs a CLI confirmation of FortiManager HA state when the graphical interface cannot load. It does not directly address the present situation, where the required correction is confirm the peer has current synchronized modules before initiating the approved failover procedure.