NSE7 Practice Exam 56 — 20 Questions

Question 1

An administrator deploys a FortiGate in transparent mode within a Layer 2 network. They apply a firewall policy with an antivirus profile to inspect traffic between two VLANs. What is a key characteristic of transparent mode that affects policy application?

Accepted Answer

Traffic is forwarded based on MAC addresses, and policies are applied transparently without changing the IP path. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

Answer

NAT is automatically applied to all traffic to preserve private IP addresses

Answer

Firewall policies are applied only to traffic entering the management interface

Answer

Each VDOM in transparent mode requires a unique IP address for management

Question 2

A FortiGate administrator wants to use FortiAnalyzer to generate reports on traffic patterns for each VDOM separately. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable per-VDOM logging on the FortiGate. Option C is correct because per-VDOM logging must be enabled on the FortiGate to allow each VDOM to generate its own independent log stream. Without this setting, all VDOMs share a single log stream, making it impossible to separate traffic patterns per VDOM on FortiAnalyzer. Option E is correct because log forwarding from each VDOM to FortiAnalyzer is required to send the per-VDOM logs to the FortiAnalyzer for reporting.

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Answer

Disable logging on the FortiGate system

Answer

Create separate ADOMs for each VDOM on FortiAnalyzer

Question 3

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. Option D is correct because FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 4

An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?

Accepted Answer

The log data is in a different datastore than the one configured for the report. Option A is correct because FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

Answer

The report schedule is not set

Answer

The FortiAnalyzer is in a different ADOM

Answer

The FortiAnalyzer license has expired

Question 5

Which of the following is a required step when enabling VDOMs on a FortiGate for the first time?

Accepted Answer

Reboot the FortiGate after enabling VDOMs. When enabling VDOMs on a FortiGate for the first time, the device must be rebooted to restructure the internal data plane and control plane to support multiple virtual domains. This reboot is mandatory because the firmware transitions from a single-VDOM mode to a multi-VDOM mode, which requires reinitializing kernel structures and memory allocation for VDOM-specific resources.

Answer

Create at least two VDOMs before enabling the VDOM feature

Answer

Disable all firewall policies

Answer

Configure inter-VDOM routing

Question 6

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

Accepted Answer

Configure static or dynamic routing. Option D is correct because routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Answer

Configure a VDOM link

Answer

Create a policy with inter-VDOM link

Answer

Enable inter-VDOM routing

Question 7

An administrator wants to ensure that all traffic from VDOM 'Guest' is logged to a FortiAnalyzer that is managed by FortiManager. What must be configured in FortiManager to achieve this?

Accepted Answer

Configure the VDOM's log settings and assign the device to an ADOM with log forwarding enabled. Option D is correct because FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

Answer

Enable FortiView on the FortiGate

Answer

Configure a log forwarding policy in the Global ADOM

Answer

Create an automation stitch to forward logs

Question 8

A network administrator needs to create a separate firewall policy for the guest network while keeping management traffic in the main VDOM. Which VDOM type should be configured for the guest network?

Accepted Answer

Traffic VDOM. Option D is correct because a Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

Answer

Root VDOM

Answer

Administrative VDOM

Answer

Management VDOM

Question 9

A FortiGate is operating in transparent mode and is deployed in an enterprise network. The administrator needs to apply a security policy to control traffic between two VLANs. What is a key consideration when configuring policies in transparent mode?

Accepted Answer

The policy is applied to the Layer 2 interface where the traffic enters. In transparent mode, the FortiGate acts as a Layer 2 bridge, and security policies are applied to the ingress interface where traffic enters the device. This allows the firewall to filter traffic between VLANs based on Layer 3 and Layer 4 criteria without requiring IP addresses on the interfaces, as the device is transparent to the network.

Answer

Transparent mode does not support firewall policies

Answer

The policy must be applied to the management IP address

Answer

Policies must be configured using MAC addresses only

Question 10

An enterprise uses multiple VDOMs on a FortiGate. The administrator needs to route traffic between VDOM-A and VDOM-B using a firewall policy. What is the correct configuration step?

Accepted Answer

Configure a VDOM link between the two VDOMs and create a policy allowing traffic. Option C is correct because a VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

Answer

Place both VDOMs in the same virtual router and use regular policies

Answer

Create a static route in each VDOM pointing to the other VDOM's virtual interface

Answer

Enable inter-VDOM routing globally under system settings

Question 11

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

Accepted Answer

Reports. The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Answer

Incidents

Answer

Playbooks

Answer

FortiView

Question 12

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. After configuration, traffic from VDOM-A cannot reach VDOM-B. Which configuration step is MOST likely missing?

Accepted Answer

Create a firewall policy on VDOM-A and VDOM-B allowing traffic over the VDOM link interface. VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

Answer

Enable 'inter-vdom-routing' under system settings

Answer

Configure a static route on VDOM-A pointing to VDOM-B's subnet via the VDOM link

Answer

Assign both VDOM link interfaces to the same VDOM

Question 13

A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?

Accepted Answer

Enable inter-VDOM routing and create policies allowing traffic between the VDOMs. Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Create a VDOM link between the two VDOMs

Answer

Configure the FortiGate in transparent mode

Question 14

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 15

An administrator wants to group firewall objects by department (e.g., Sales, Engineering) and easily filter them in FortiManager policy packages. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

Answer

Tags in FortiGate

Answer

ADOM overrides

Answer

Policy package folders

Question 16

A FortiGate has two VDOMs: Root and CustomerA. The administrator wants to manage the CustomerA VDOM from FortiManager. What must be configured on FortiManager to allow management of the CustomerA VDOM?

Accepted Answer

Add the FortiGate's VDOM to an ADOM. Option D is correct because FortiManager uses Administrative Domains (ADOMs) to logically group and manage VDOMs. To manage the CustomerA VDOM, the administrator must add that specific VDOM to an ADOM on FortiManager, which then allows FortiManager to push policies, objects, and configuration to that VDOM. Without this mapping, FortiManager cannot target the VDOM for management, even if the FortiGate itself is registered.

Answer

Configure an automation stitch on FortiManager

Answer

Add the FortiGate to the global ADOM

Answer

Enable VDOM management on FortiGate

Question 17

A FortiGate admin configures automation stitches in FortiManager to trigger a script when a specific incident occurs. The script runs but does not produce the expected result. Which FortiAnalyzer feature should the admin use to verify the automation stitch executed correctly?

Accepted Answer

Incident Management. Option D is correct because Incident Management in FortiAnalyzer provides a detailed log of automation stitch execution, including trigger events, script actions, and any errors. This allows the admin to verify whether the stitch ran as expected and to diagnose why the script did not produce the intended result.

Answer

Reports

Answer

FortiView

Answer

Playbooks

Question 18

An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?

Accepted Answer

Source: all, Destination: all. In transparent mode, the FortiGate operates as a Layer 2 bridge and does not route traffic based on IP addresses. Therefore, firewall policies must use 'all' for both source and destination addresses because the FortiGate does not see the original source or destination IPs—it only sees MAC addresses and forwards frames transparently. Using specific IP subnets would break the policy as the FortiGate cannot match Layer 3 addresses in this mode.

Answer

Source: the FortiGate's management IP, Destination: the web server's IP

Answer

Source: internal subnet, Destination: external subnet

Answer

Source: internal MAC addresses, Destination: external MAC addresses

Question 19

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 20

What is the purpose of a management VDOM in a multi-VDOM FortiGate deployment?

Accepted Answer

To host the management interfaces and administrative services (GUI, SSH) while other VDOMs carry user traffic. A management VDOM is dedicated to hosting all administrative interfaces (GUI, SSH, SNMP, syslog) and management services, isolating them from user traffic VDOMs. This separation ensures that management access remains available even if a data VDOM is overloaded or compromised, and it centralizes administrative control without mixing management and data plane functions.

Answer

To route traffic between different VDOMs

Answer

To aggregate logs from all other VDOMs

Answer

To enforce inter-VDOM traffic policies centrally