NSE7 Enterprise Firewall and VDOMs Practice Test 10 — 15 Questions

Question 1

An administrator creates a new VDOM and assigns interfaces. The VDOM is intended to operate in transparent mode. Which additional step is required?

Accepted Answer

Set the VDOM's mode to transparent under config system settings. A VDOM does not default to transparent mode; it must be explicitly configured. The command 'config system settings' with 'set vdom-type transparent' changes the VDOM's operational mode from the default NAT/route mode to transparent mode, which is required for the VDOM to function as a Layer 2 bridge.

Answer

Disable NAT on all policies

Answer

Configure a management IP for the VDOM

Answer

No additional steps; VDOMs default to transparent mode

Question 2

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Using a dedicated management VDOM is a best practice in multi-VDOM deployments. It isolates administrative traffic (e.g., HTTPS, SSH, SNMP) from data-plane VDOMs, ensuring that management access remains available even if a data VDOM fails or is misconfigured. This also simplifies auditing and RBAC by centralizing admin access without exposing production traffic.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode

Question 3

An administrator configures FortiManager automation stitches to respond to high CPU usage on a FortiGate. The stitch should trigger a script to run diagnostics. Which THREE components are required in an automation stitch?

Accepted Answer

Trigger (e.g., event type). An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch, such as a high CPU usage event. The trigger specifies the event type (e.g., 'CPU Usage High') that the FortiGate reports, which then activates the stitch. Without a trigger, the automation stitch has no starting point to respond to the condition.

Answer

Condition (e.g., severity threshold)

Answer

Result (e.g., email notification)

Question 4

A FortiGate administrator wants to use FortiAnalyzer to view traffic logs from multiple VDOMs. Which TWO steps must the administrator perform on FortiAnalyzer?

Accepted Answer

Add the FortiGate as a device in FortiAnalyzer. FortiAnalyzer must have the FortiGate added as a managed device in order to receive and process logs from it. This registration establishes the trust relationship and log-receiving configuration between the two systems.

Answer

Install a security profile on FortiAnalyzer

Answer

Create a separate ADOM for each VDOM

Answer

Enable FortiAnalyzer's built-in firewall

Question 5

An administrator configures inter-VDOM routing between VDOMs A and B using a VDOM link. The administrator can ping from VDOM A to an interface in VDOM B, but traffic from VDOM B to VDOM A times out. What is the most likely cause?

Accepted Answer

The route back to the source subnet is missing in VDOM A. Inter-VDOM routing requires a route in both directions. Since the administrator can ping from VDOM A to VDOM B, the forward path works, but the return traffic from VDOM B to VDOM A fails due to a missing route back to the source subnet in VDOM A. This is a classic asymmetric routing issue where the destination VDOM (A) does not know how to reach the source subnet of VDOM B.

Answer

VDOM B has no traffic VDOM capability

Answer

The firewall policy in VDOM B is blocking traffic

Answer

The VDOM link's MTU is set too high

Question 6

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

Accepted Answer

Revision history. Revision history stores previous versions of policy packages, allowing an administrator to roll back to a previous version. Install preview (A) shows pending changes but does not provide rollback capability. Device manager (C) manages devices, not policy versioning. Automation stitch (D) automates tasks but does not handle policy rollback.

Answer

Install preview

Answer

Device manager

Answer

Automation stitch

Question 7

You deploy a FortiGate in transparent mode for a retail branch. The upstream router's ARP table shows the FortiGate's management IP, but end users cannot reach the internet. The FortiGate's management IP is on the same subnet as the users. What should you verify first?

Accepted Answer

The firewall policy allows traffic from internal to external. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not require a routing table for user traffic; forwarding decisions are based on firewall policies. Since the management IP is on the same subnet as users, the upstream router can ARP for it, but user traffic must be explicitly allowed by a firewall policy from the internal to external zone. Without such a policy, packets are dropped even if Layer 2 connectivity exists.

Answer

The upstream router is forwarding traffic to the FortiGate's management MAC

Answer

The FortiGate's routing table has a default route

Answer

The FortiGate's management interface is in the same VDOM as user traffic

Question 8

An administrator wants to use FortiManager to manage multiple FortiGates, each in a separate customer environment. The administrator needs to isolate configuration changes per customer and ensure each customer's admin can only see their own devices. What FortiManager feature should be used?

Accepted Answer

Administrative domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow the administrator to logically partition the management plane, isolating configuration changes per customer. Each ADOM can contain a set of FortiGates, and administrators assigned to an ADOM can only see and manage devices within that ADOM, ensuring strict separation of customer environments.

Answer

Administrator profiles

Answer

Policy packages

Answer

VDOMs on managed FortiGates

Question 9

A network admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. The output shows `duration=3600`, meaning the session has been active for 3600 seconds (1 hour), and `expire=3599`, meaning the session will expire in 3599 seconds (approximately 1 hour). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session was established 1 hour ago and will expire in about 1 hour, making option A correct.

Answer

The session is using UDP port 443

Answer

The session is for HTTP traffic and has 3599 seconds left

Answer

The session is for HTTPS traffic and is halfway through its expected lifetime

Question 10

In a multi-VDOM deployment, an administrator needs to centralize logging for all VDOMs. Which FortiGate feature should be used to send logs to a central FortiAnalyzer?

Accepted Answer

Log configuration under each VDOM's settings. In a multi-VDOM FortiGate deployment, each VDOM operates as an independent virtual firewall with its own log settings. To centralize logging to a FortiAnalyzer, you must configure the log settings individually under each VDOM, specifying the FortiAnalyzer as the log destination. This ensures that logs from all VDOMs are forwarded to the central FortiAnalyzer, as global log settings do not apply across VDOMs.

Answer

FortiGate Cloud

Answer

Global log settings

Answer

Syslog server

Question 11

An administrator configures a VDOM link between VDOMs A and B. In VDOM A, the VDOM link interface is assigned IP 10.10.10.1/24, and in VDOM B, it is assigned 10.10.10.2/24. A firewall policy on VDOM A allows traffic from a subnet in VDOM A to a subnet in VDOM B. However, traffic fails. The admin checks the routing table in VDOM A and sees a route to the destination subnet via 10.10.10.2. What is the most likely cause?

Accepted Answer

No firewall policy in VDOM B to allow traffic from the VDOM link. In a VDOM link configuration, traffic must be permitted by firewall policies on both VDOMs. Even though VDOM A has a policy allowing traffic to the destination subnet and a valid route via 10.10.10.2, VDOM B must have a policy that allows traffic from the VDOM link interface to reach the destination subnet. Without this policy, VDOM B will drop the packets, causing the traffic failure.

Answer

The VDOM link is not administratively up in VDOM B

Answer

Inter-VDOM routing is disabled globally

Answer

The subnet in VDOM B is not defined as an address object in VDOM A's policy

Question 12

A FortiGate has two VDOMs: Root and CustomerA. The administrator wants to manage the CustomerA VDOM from FortiManager. What must be configured on FortiManager to allow management of the CustomerA VDOM?

Accepted Answer

Add the FortiGate's VDOM to an ADOM. FortiManager uses Administrative Domains (ADOMs) to logically group and manage VDOMs. To manage the CustomerA VDOM, the administrator must add that specific VDOM to an ADOM on FortiManager, which then allows FortiManager to push policies, objects, and configuration to that VDOM. Without this mapping, FortiManager cannot target the VDOM for management, even if the FortiGate itself is registered.

Answer

Configure an automation stitch on FortiManager

Answer

Add the FortiGate to the global ADOM

Answer

Enable VDOM management on FortiGate

Question 13

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Answer

Reports

Answer

Incidents

Answer

FortiView

Question 14

A FortiGate in an HA cluster with VDOMs enabled experiences a failover. After the failover, traffic that was passing before is now being dropped. The configuration is synchronized between the primary and secondary units. What is the most likely reason?

Accepted Answer

Session synchronization is not enabled between HA members. The most likely reason is that session synchronization is not enabled between HA members. When a failover occurs, the new primary FortiGate does not have the existing session table entries from the original primary, so it treats incoming packets as new connections and may drop them if they do not match a firewall policy's initial handshake state. Even though the configuration is synchronized, session information is not shared unless session synchronization is explicitly configured, causing traffic to be dropped after failover.

Answer

The new primary has a different VDOM configuration

Answer

The firewall policies are not synchronized

Answer

VDOM link interfaces are down on the new primary

Question 15

An administrator wants to use FortiManager to deploy a common set of firewall rules to all VDOMs on a single FortiGate. The rules will be the same except for the source and destination addresses, which differ per VDOM. What FortiManager feature allows the administrator to reuse a policy package and customize per-VDOM objects?

Accepted Answer

Meta fields. Meta fields in FortiManager allow you to define custom variables that can be assigned to managed devices or VDOMs. When a policy package is installed, these meta fields are substituted with the per-VDOM values, enabling the reuse of a single policy package with different source and destination addresses for each VDOM. This avoids the need to create separate policy packages for each VDOM.

Answer

Policy package header/footer

Answer

Automation stitches

Answer

Global ADOM