nerdexam
Fortinet

NSE4 · Question #395

You have created a new administrator account, and assign it the prof_admin profile. Which is false about that account's permissions?

The correct answer is C. It can reset forgotten passwords for other administrator accounts such as "admin". The prof_admin account, a VDOM-scoped administrative profile, lacks the necessary global privileges to reset passwords for other administrator accounts, especially those with super_admin rights.

Submitted by akirajp· Apr 18, 2026FortiGate Deployment and System Configuration

Question

You have created a new administrator account, and assign it the prof_admin profile. Which is false about that account's permissions?

Options

  • AIt cannot upgrade or downgrade firmware.
  • BIt can create and assign administrator accounts to parts of its own VDOM.
  • CIt can reset forgotten passwords for other administrator accounts such as "admin".
  • DIt has a smaller permissions scope than accounts with the "super_admin" profile.

How the community answered

(20 responses)
  • A
    5% (1)
  • C
    90% (18)
  • D
    5% (1)

Why each option

The prof_admin account, a VDOM-scoped administrative profile, lacks the necessary global privileges to reset passwords for other administrator accounts, especially those with super_admin rights.

AIt cannot upgrade or downgrade firmware.

It is true that a prof_admin account cannot upgrade or downgrade firmware, as these are global system-level operations typically reserved for super_admin profiles.

BIt can create and assign administrator accounts to parts of its own VDOM.

A prof_admin account is typically able to create and manage administrator accounts within the VDOMs it has been assigned access to.

CIt can reset forgotten passwords for other administrator accounts such as "admin".Correct

The prof_admin profile, while having significant privileges within its assigned VDOM, does not possess the global permissions required to reset forgotten passwords for other administrator accounts, particularly those with super_admin scope.

DIt has a smaller permissions scope than accounts with the "super_admin" profile.

The prof_admin profile is designed with a VDOM-specific scope, which is inherently smaller and more restricted than the device-wide, comprehensive permissions of a super_admin profile.

Concept tested: FortiGate administrator profiles and permissions

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/597341/default-admin-profiles

Topics

#Administrator profiles#FortiGate permissions#System administration#Firmware management

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full NSE4 Practice