An administrator would like to review, approve, or reject all the firewall policy changes made by the junior administrators. How should the workspace…

FortiManager's Workflow mode is specifically designed to meet the requirement of reviewing and approving changes. It is an extension of Workspace mode that enforces a structured change management process. In this mode, a junior administrator's changes are not committed directly. Instead, they are submitted as a "workflow session." A senior administrator with approval permissions can then review this session, and either approve the changes to commit them to the ADOM database or reject them with comments. This provides the necessary oversight and control over policy modifications.

A. Set to workspace and using the policy locking feature: Workspace mode with policy locking only prevents concurrent editing of the same policy package; it does not include a mandatory approval/rejection process.

B. Set to read/write and using the policy locking feature: Read/write is an administrative permission level, not a distinct operational mode for ADOMs like Normal or Workspace mode.

D. Set to normal and using the approval group feature: Normal mode locks the entire ADOM for a single administrator at a time and lacks a built-in mechanism for submitting changes for approval.

1. FortiManager Administration Guide 7.4.1

Chapter: "ADOMs"

Section: "Workspace"

Sub-section: "Workflow mode"

Page 168.

The document states: "Workflow mode is an extension of workspace mode that provides a mechanism for submitting and tracking configuration changes for approval. When workflow mode is enabled

administrators must submit their changes for approval. The changes are saved in a workflow session that can be reviewed

approved

or rejected by another administrator." This directly supports the correct answer.

2. FortiManager Administration Guide 7.4.1

Chapter: "ADOMs"

Section: "Workspace"

Sub-section: "Normal mode"

Page 167.

This section explains: "In normal mode

only one administrator can make changes in an ADOM at a time. When an administrator is logged into an ADOM

the ADOM is locked." This confirms that Normal mode does not support the required collaborative approval workflow.