NSE7 Enterprise Firewall and VDOMs Practice Test 10 — 15 Questions

Question 1

An administrator configures inter-VDOM routing between VDOMs A and B using a VDOM link. The administrator can ping from VDOM A to an interface in VDOM B, but traffic from VDOM B to VDOM A times out. What is the most likely cause?

Accepted Answer

The route back to the source subnet is missing in VDOM A. The correct answer is B because inter-VDOM routing requires a route in both directions. Since the administrator can ping from VDOM A to VDOM B, the forward path works, but the return traffic from VDOM B to VDOM A fails due to a missing route back to the source subnet in VDOM A. This is a classic asymmetric routing issue where the destination VDOM (A) does not know how to reach the source subnet of VDOM B.

Answer

VDOM B has no traffic VDOM capability

Answer

The firewall policy in VDOM B is blocking traffic

Answer

The VDOM link's MTU is set too high

Question 2

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

Accepted Answer

Revision history. Option D is correct. Revision history stores previous versions of policy packages, allowing rollback. Install preview shows pending changes but does not roll back.

Answer

Install preview

Answer

Device manager

Answer

Automation stitch

Question 3

You deploy a FortiGate in transparent mode for a retail branch. The upstream router's ARP table shows the FortiGate's management IP, but end users cannot reach the internet. The FortiGate's management IP is on the same subnet as the users. What should you verify first?

Accepted Answer

The firewall policy allows traffic from internal to external. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not require a routing table for user traffic; forwarding decisions are based on firewall policies. Since the management IP is on the same subnet as users, the upstream router can ARP for it, but user traffic must be explicitly allowed by a firewall policy from the internal to external zone. Without such a policy, packets are dropped even if Layer 2 connectivity exists.

Answer

The upstream router is forwarding traffic to the FortiGate's management MAC

Answer

The FortiGate's routing table has a default route

Answer

The FortiGate's management interface is in the same VDOM as user traffic

Question 4

An administrator wants to use FortiManager to manage multiple FortiGates, each in a separate customer environment. The administrator needs to isolate configuration changes per customer and ensure each customer's admin can only see their own devices. What FortiManager feature should be used?

Accepted Answer

Administrative domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow the administrator to logically partition the management plane, isolating configuration changes per customer. Each ADOM can contain a set of FortiGates, and administrators assigned to an ADOM can only see and manage devices within that ADOM, ensuring strict separation of customer environments.

Answer

Administrator profiles

Answer

Policy packages

Answer

VDOMs on managed FortiGates

Question 5

A network admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. The output shows `duration=3600`, meaning the session has been active for 3600 seconds (1 hour), and `expire=3599`, meaning the session will expire in 3599 seconds (approximately 1 hour). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session was established 1 hour ago and will expire in about 1 hour, making option A correct.

Answer

The session is using UDP port 443

Answer

The session is for HTTP traffic and has 3599 seconds left

Answer

The session is for HTTPS traffic and is halfway through its expected lifetime

Question 6

In a multi-VDOM deployment, an administrator needs to centralize logging for all VDOMs. Which FortiGate feature should be used to send logs to a central FortiAnalyzer?

Accepted Answer

Log configuration under each VDOM's settings. Option D is correct because in a multi-VDOM FortiGate deployment, each VDOM operates as an independent virtual firewall with its own log settings. To centralize logging to a FortiAnalyzer, you must configure the log settings individually under each VDOM, specifying the FortiAnalyzer as the log destination. This ensures that logs from all VDOMs are forwarded to the central FortiAnalyzer, as global log settings do not apply across VDOMs.

Answer

FortiGate Cloud

Answer

Global log settings

Answer

Syslog server

Question 7

An administrator configures a VDOM link between VDOMs A and B. In VDOM A, the VDOM link interface is assigned IP 10.10.10.1/24, and in VDOM B, it is assigned 10.10.10.2/24. A firewall policy on VDOM A allows traffic from a subnet in VDOM A to a subnet in VDOM B. However, traffic fails. The admin checks the routing table in VDOM A and sees a route to the destination subnet via 10.10.10.2. What is the most likely cause?

Accepted Answer

No firewall policy in VDOM B to allow traffic from the VDOM link. Option A is correct. In VDOM B, there must be a firewall policy allowing inbound traffic from the VDOM link. Without it, the traffic will be dropped upon entering VDOM B.

Answer

The VDOM link is not administratively up in VDOM B

Answer

Inter-VDOM routing is disabled globally

Answer

The subnet in VDOM B is not defined as an address object in VDOM A's policy

Question 8

A FortiGate has two VDOMs: Root and CustomerA. The administrator wants to manage the CustomerA VDOM from FortiManager. What must be configured on FortiManager to allow management of the CustomerA VDOM?

Accepted Answer

Add the FortiGate's VDOM to an ADOM. Option D is correct because FortiManager uses Administrative Domains (ADOMs) to logically group and manage VDOMs. To manage the CustomerA VDOM, the administrator must add that specific VDOM to an ADOM on FortiManager, which then allows FortiManager to push policies, objects, and configuration to that VDOM. Without this mapping, FortiManager cannot target the VDOM for management, even if the FortiGate itself is registered.

Answer

Configure an automation stitch on FortiManager

Answer

Add the FortiGate to the global ADOM

Answer

Enable VDOM management on FortiGate

Question 9

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Answer

Reports

Answer

Incidents

Answer

FortiView

Question 10

A FortiGate in an HA cluster with VDOMs enabled experiences a failover. After the failover, traffic that was passing before is now being dropped. The configuration is synchronized between the primary and secondary units. What is the most likely reason?

Accepted Answer

Session synchronization is not enabled between HA members. The most likely reason is that session synchronization is not enabled between HA members. When a failover occurs, the new primary FortiGate does not have the existing session table entries from the original primary, so it treats incoming packets as new connections and may drop them if they do not match a firewall policy's initial handshake state. Even though the configuration is synchronized, session information is not shared unless session synchronization is explicitly configured, causing traffic to be dropped after failover.

Answer

The new primary has a different VDOM configuration

Answer

The firewall policies are not synchronized

Answer

VDOM link interfaces are down on the new primary

Question 11

An administrator wants to use FortiManager to deploy a common set of firewall rules to all VDOMs on a single FortiGate. The rules will be the same except for the source and destination addresses, which differ per VDOM. What FortiManager feature allows the administrator to reuse a policy package and customize per-VDOM objects?

Accepted Answer

Meta fields. Meta fields in FortiManager allow you to define custom variables that can be assigned to managed devices or VDOMs. When a policy package is installed, these meta fields are substituted with the per-VDOM values, enabling the reuse of a single policy package with different source and destination addresses for each VDOM. This avoids the need to create separate policy packages for each VDOM.

Answer

Policy package header/footer

Answer

Automation stitches

Answer

Global ADOM

Question 12

In FortiAnalyzer, which tool provides real-time traffic monitoring and allows drilling down into details such as top talkers, applications, and threats?

Accepted Answer

FortiView. FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

Answer

Reports

Answer

Incidents

Answer

Log Viewer

Question 13

An administrator is configuring a FortiGate in transparent mode for a retail store. The store has a flat network with a single subnet. Which TWO of the following statements about transparent mode are correct? (Select TWO.)

Accepted Answer

The FortiGate uses a management IP address for administrative access. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in routing. A management IP address is required for administrative access (e.g., SSH, HTTPS) because the device does not have an IP on the bridged interfaces by default. This management IP is assigned to a dedicated management interface or a VLAN interface and allows the administrator to reach the FortiGate from the same subnet.

Answer

Virtual IPs (VIPs) can be used for destination NAT

Answer

The FortiGate will perform routing between VLANs

Answer

The FortiGate requires a default route to forward user traffic

Question 14

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Answer

FortiView dashboard

Answer

ADOM

Question 15

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Accepted Answer

Check if the policy is disabled. Option C is correct because a policy that is disabled in FortiManager will be installed to the managed FortiGate in a disabled state, meaning it will not process any traffic. The administrator must verify that the policy is enabled in FortiManager before or after installation, as a disabled policy is effectively inactive regardless of installation success.

Answer

Reboot the FortiGate

Answer

Review the FortiGate's routing table

Answer

Verify the FortiGate's HA status