NSE7 Enterprise Firewall and VDOMs Practice Test 10 — 15 Questions

Question 1

A FortiGate is running in multi-VDOM mode. The administrator notices that the root VDOM is consuming a high amount of CPU. To isolate resource usage, the administrator wants to limit the number of sessions that a specific VDOM can create. Which feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the VDOM resource limits feature to set a maximum number of sessions for the VDOM.. To limit the number of sessions a VDOM can create, use the per-VDOM resource limits feature. This allows setting a maximum session count, ensuring one VDOM cannot consume all available session resources. It is configured globally and applies to the specified VDOM, providing the required isolation.

Answer

Enable session-ttl and set a low timeout value for the VDOM.

Answer

Apply a traffic shaper to the VDOM to limit bandwidth and indirectly limit sessions.

Answer

Configure per-VDOM session limits using the session-limit setting under config vdom.

Question 2

A FortiGate is deployed with multiple VDOMs. The administrator needs to apply a global security profile that enforces the same web filtering policy across all VDOMs without duplicating the profile in each VDOM. What should the administrator do?

Accepted Answer

Enable 'global' object creation for security profiles in the VDOM settings, then create the profile once and assign it to policies in each VDOM.. FortiGate supports global objects for certain configuration items, including security profiles. By enabling global object creation for security profiles, the administrator can define a profile once in the global scope and then reference it in firewall policies across multiple VDOMs. This ensures consistent enforcement without duplicating the profile in each VDOM.

Answer

Create the profile in the root VDOM and use inter-VDOM links to share it with other VDOMs.

Answer

Configure the security profile in the global VDOM and reference it in each VDOM's firewall policies.

Answer

Use the 'global' settings in the FortiGate to create a security profile that is available to all VDOMs.

Question 3

A FortiGate is configured with multiple VDOMs. The administrator wants to restrict a specific administrator account so that it can only manage and view configuration within a particular VDOM. Which configuration step should the administrator take?

Accepted Answer

Create a new administrator account and assign it the 'prof_admin' profile, then set the VDOM to the desired VDOM in the administrator's configuration.. Restricting an administrator to a single VDOM requires assigning a profile that permits management within a VDOM and setting the administrator's VDOM field to that specific VDOM. The 'prof_admin' profile is designed for this purpose, providing full access within the assigned VDOM. Other profiles either grant too much access or none at all.

Answer

Create a new administrator account and assign it the 'super_admin' profile, then set the VDOM to 'all'.

Answer

Create a new administrator account and assign it a custom profile that denies access to all VDOMs except the desired one, but leave the VDOM field as 'all'.

Answer

Create a new administrator account and assign it the 'no_access' profile, then set the VDOM to the desired VDOM.

Question 4

A FortiGate is configured with multiple VDOMs. The administrator has enabled virtual clustering in an active-passive HA setup. The administrator wants to ensure that VDOM-1 is active on the primary unit and VDOM-2 is active on the secondary unit. Which configuration is required to achieve this?

Accepted Answer

Configure VDOM-specific HA priorities for each VDOM, setting VDOM-1's priority higher on the primary unit and VDOM-2's priority higher on the secondary unit.. Virtual clustering allows different VDOMs to be active on different units within the same HA cluster. To achieve this, you configure VDOM-specific HA priorities. By setting a higher priority for VDOM-1 on the primary unit and a higher priority for VDOM-2 on the secondary unit, VDOM-1 becomes active on the primary and VDOM-2 becomes active on the secondary. This provides active-active VDOM distribution for load sharing and redundancy.

Answer

In the HA configuration, set the priority of VDOM-1 higher on the primary unit and the priority of VDOM-2 higher on the secondary unit.

Answer

Enable HA override on the primary unit and set the secondary unit's HA priority to a higher value than the primary unit's for all VDOMs.

Answer

Create a separate HA cluster for each VDOM by assigning different cluster IDs, and then set the primary unit for each cluster accordingly.

Question 5

An administrator has a FortiGate 600E running FortiOS 7.4 with multiple VDOMs enabled in NAT mode. The administrator wants to configure a new VDOM named 'DMZ' and ensure that traffic from the DMZ VDOM to the Internet can be inspected by the root VDOM's security profiles without using a VDOM link. The administrator plans to use the 'set vdom-type' command. Which VDOM type should be configured for the DMZ VDOM to allow it to inherit the root VDOM's UTM profiles?

Accepted Answer

lan-extension. The lan-extension VDOM type is designed to allow a VDOM to share the root VDOM's security profiles and policies. This enables the DMZ VDOM to route traffic to the Internet while still being inspected by the root VDOM's UTM features, avoiding the need for inter-VDOM links or duplicate profiles. The other VDOM types do not provide this inheritance.

Answer

admin

Answer

transparent

Answer

traffic

Question 6

An administrator is configuring a FortiGate with multiple VDOMs. They want to ensure that each VDOM has its own separate routing table and firewall policies. Which VDOM mode should they use?

Accepted Answer

NAT mode. NAT mode VDOMs are independent Layer 3 instances, each with its own routing table, interfaces, and firewall policies. This satisfies the requirement for separate routing and policy domains. Transparent mode VDOMs share a routing table, and management/split-task VDOMs serve specialized roles, so NAT mode is the correct choice.

Answer

Management VDOM mode

Answer

Multi-VDOM mode with split-task VDOMs

Answer

Transparent mode

Question 7

A FortiGate 1800F is deployed in multi-VDOM mode with VDOMs: root, Engineering, and Finance. The administrator has configured inter-VDOM links between root and Engineering, and between root and Finance. The administrator wants to enable inter-VDOM routing between Engineering and Finance without adding additional VDOM links. Which configuration step is required?

Accepted Answer

Configure static routes in Engineering and Finance pointing to the root VDOM's inter-VDOM link interfaces.. Inter-VDOM routing between two non-root VDOMs can be achieved by routing through the root VDOM using existing VDOM links. This requires adding static routes in Engineering and Finance that point to the root VDOM's inter-VDOM link interfaces as the next-hop. No additional VDOM links are needed, satisfying the administrator's constraint.

Answer

Create a VDOM link between Engineering and Finance directly.

Answer

Assign the same VDOM ID to Engineering and Finance.

Answer

Enable 'inter-vdom-routing' under the root VDOM's system settings.

Question 8

An administrator has a FortiGate in multi-VDOM mode. The administrator needs to verify which VDOM a given physical interface is currently assigned to and confirm the operational status of that interface. Which command provides this information?

Accepted Answer

show system interface. The show system interface command, executed from the global configuration context, enumerates every interface along with its VDOM assignment, addressing, and up or down state. It is the standard way to confirm both which VDOM owns a physical interface and whether that interface is currently operational, satisfying both parts of the request in one view.

Answer

diagnose netlink interface list

Answer

diagnose hardware deviceinfo nic

Answer

get system vdom-property

Question 9

An administrator is configuring inter-VDOM routing between two VDOMs, VDOM-A and VDOM-B, using a VDOM link. The administrator wants to ensure that traffic from VDOM-A to VDOM-B is inspected by firewall policies in both VDOMs. Which TWO statements about inter-VDOM link traffic are correct? (Choose two.)

Accepted Answer

By default, inter-VDOM link traffic is denied unless there are firewall policies allowing it in both VDOMs.. The correct statements are that firewall policies must be configured in both VDOMs to allow traffic over the inter-VDOM link, and that by default such traffic is denied unless policies exist. Inter-VDOM link traffic is always inspected, and policies are required in each VDOM to permit the flow. This ensures that inter-VDOM communication is subject to security controls.

Answer

Traffic traversing an inter-VDOM link is not inspected by firewall policies by default; you must explicitly enable inspection on the inter-VDOM link interface.

Answer

Inter-VDOM link traffic is only inspected by the VDOM that initiates the connection; the receiving VDOM does not apply firewall policies.

Answer

You can use a single firewall policy in the root VDOM to control traffic between VDOM-A and VDOM-B if the inter-VDOM link is assigned to the root VDOM.

Question 10

An administrator is configuring a FortiGate in multi-VDOM mode. They want to allow a management VDOM to manage other VDOMs and the global settings. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used to manage all other VDOMs and global settings.. A management VDOM is a special VDOM that provides administrative access to the entire FortiGate, including all other VDOMs and global settings. Only one VDOM can be designated as the management VDOM at a time. It does not require a dedicated physical interface, and it can contain firewall policies, though its primary role is management.

Answer

The management VDOM cannot contain firewall policies for user traffic.

Answer

The management VDOM automatically receives all global routing entries.

Answer

The management VDOM must be assigned to a physical interface that is dedicated solely to management traffic.

Question 11

A network administrator is setting up a FortiGate with VDOMs. The administrator wants to allow the management VDOM to access all other VDOMs for centralized management tasks, such as firmware upgrades and log retrieval. Which feature should the administrator enable?

Accepted Answer

Inter-VDOM routing. To allow a management VDOM to access other VDOMs, inter-VDOM routing must be configured. This involves creating inter-VDOM links between the management VDOM and each target VDOM, assigning IP addresses, configuring routes, and adding firewall policies to permit the desired traffic. Once in place, the management VDOM can reach other VDOMs for tasks like firmware upgrades and log retrieval.

Answer

VDOM partitioning

Answer

Management VDOM

Answer

Administrative access on all interfaces

Question 12

An administrator manages a FortiGate with several VDOMs. A security audit requires that the root VDOM never be used for user traffic and that each department VDOM have its own independent routing table. The administrator also wants to confirm that a specific department VDOM is currently using only its allocated session limit. Which approach meets these requirements?

Accepted Answer

Create each department as its own VDOM with dedicated interfaces, leave the root VDOM without traffic interfaces, and run diagnose sys vdom session list or check the VDOM's session statistics to confirm its session consumption.. Giving each department its own VDOM with dedicated interfaces yields independent routing tables, and leaving root without traffic interfaces ensures it carries no user traffic. Per-VDOM session statistics then allow precise confirmation that a specific department VDOM stays within its allocated session limit, fulfilling both the audit and verification requirements.

Answer

Assign each department a VLAN subinterface in the root VDOM and apply traffic shaping per VLAN, then check the root VDOM's session table for department sessions.

Answer

Create department VDOMs but keep a single shared routing table by enabling inter-VDOM routing globally, then verify session limits with get system session-ttl.

Answer

Keep all department interfaces in the root VDOM and apply VDOM-aware policies tagged per department, then check global session counters.

Question 13

A FortiGate 600E is running multiple VDOMs in NAT/route mode. The administrator needs to allow a server in the 'DMZ' VDOM to initiate connections to a server in the 'Internal' VDOM, but must prevent the Internal server from initiating connections to the DMZ. The administrator has already created a VDOM link named 'vlink1' with interfaces 'vlink1-0' (in DMZ) and 'vlink1-1' (in Internal). Which configuration on the VDOM link interfaces will achieve this requirement?

Accepted Answer

Configure a firewall policy on the DMZ VDOM from the DMZ server to vlink1-0, and a firewall policy on the Internal VDOM from vlink1-1 to the Internal server. Also configure a deny policy on the Internal VDOM from the Internal server to vlink1-1.. To allow one-way initiation from DMZ to Internal while blocking the reverse, you need a policy on the DMZ VDOM permitting traffic from the DMZ server to the VDOM link interface, and a policy on the Internal VDOM permitting traffic from the VDOM link interface to the Internal server. Because FortiGate policies are stateful, return traffic for established sessions is automatically allowed. To prevent the Internal server from initiating, you must explicitly deny traffic from the Internal server to the VDOM link interface on the Internal VDOM. This provides clear control and logging of blocked attempts.

Answer

Configure a firewall policy on the DMZ VDOM from vlink1-0 to the DMZ server, and a firewall policy on the Internal VDOM from vlink1-1 to the Internal server, with no reverse policies.

Answer

Configure a firewall policy on the DMZ VDOM from the DMZ server to vlink1-0, and a firewall policy on the Internal VDOM from vlink1-1 to the Internal server. Ensure that no policy exists on the Internal VDOM from the Internal server to vlink1-1.

Answer

Configure a firewall policy on the DMZ VDOM from the DMZ server to vlink1-0, and a firewall policy on the Internal VDOM from the Internal server to vlink1-1. Enable asymmetric routing on both VDOMs.

Question 14

A FortiGate is running in multi-VDOM mode. The administrator notices that the root VDOM is consuming a high amount of CPU. To isolate resource usage, the administrator wants to limit the number of sessions that a specific VDOM can create. Which feature should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create the inter-VDOM link and assign one end to VDOM-1 and the other end to VDOM-2. Inter-VDOM routing requires the virtual link that provides the path and firewall policies in each VDOM that permit the traffic. Creating the link assigns an interface to each VDOM, and per-VDOM policies authorize the flow in both directions. Routes and other tuning may be needed for full reachability but are not the two enabling tasks highlighted here.

Answer

Assign a global VDOM as the transit VDOM for the inter-VDOM link

Answer

Create a static route in each VDOM pointing the remote subnet to the local inter-VDOM link interface

Answer

Enable asymmetric routing on both VDOMs to allow return traffic through the link

Question 15

An administrator is deploying a FortiGate with multiple VDOMs and wants to use a single physical interface to carry traffic for two different VDOMs. Which TWO statements describe how this can be achieved? (Choose two.)

Accepted Answer

Create VLAN subinterfaces on the physical interface and assign each subinterface to a different VDOM.. The supported method is to create VLAN subinterfaces on the physical port and assign each subinterface to its own VDOM. Each VLAN subinterface is a distinct logical interface with independent routing and policies, so one physical link can carry tagged traffic for two VDOMs while keeping their traffic separated. Direct physical assignment and software switches cannot be shared between VDOMs.

Answer

Use VDOM links on the physical interface to bridge both VDOMs onto the same wire.

Answer

Assign the physical interface directly to both VDOMs and rely on policy matching to separate the traffic.

Answer

Configure a software switch that includes the physical interface and assign the switch to both VDOMs.