NSE7 Enterprise Firewall and VDOMs Practice Test 11 — 15 Questions

Question 1

In FortiAnalyzer, which tool provides real-time traffic monitoring and allows drilling down into details such as top talkers, applications, and threats?

Accepted Answer

FortiView. FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

Answer

Reports

Answer

Incidents

Answer

Log Viewer

Question 2

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Answer

FortiView dashboard

Answer

ADOM

Question 3

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Accepted Answer

Check if the policy is disabled. A policy that is disabled in FortiManager will be installed to the managed FortiGate in a disabled state, meaning it will not process any traffic. The administrator must verify that the policy is enabled in FortiManager before or after installation, as a disabled policy is effectively inactive regardless of installation success.

Answer

Reboot the FortiGate

Answer

Review the FortiGate's routing table

Answer

Verify the FortiGate's HA status

Question 4

A network admin is deploying a FortiGate in transparent mode to inspect traffic between two Layer 2 switches. Which of the following statements about transparent mode is correct?

Accepted Answer

Transparent mode requires an IP address on each interface for management purposes. In transparent mode, FortiGate acts as a Layer 2 bridge and does not require IP addresses on its interfaces for forwarding traffic. However, to manage the device (e.g., via SSH, HTTPS, or SNMP), an IP address must be assigned to each interface or to a management VLAN. This allows administrative access while the firewall remains invisible to the Layer 2 network. Option B correctly identifies this requirement.

Answer

Transparent mode can only inspect traffic in one VLAN

Answer

Transparent mode supports NAT policies

Answer

Transparent mode requires VDOMs to be enabled

Question 5

An admin creates a VDOM named 'CustomerA' with inter-VDOM link to the management VDOM. The admin wants CustomerA administrators to manage only their own VDOM. Which configuration step is required?

Accepted Answer

Create a new administrator and set the 'VDOM' field to 'CustomerA' and assign a profile with appropriate permissions. To restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Answer

Use the 'config system admin' command and set trusthost to the admin's IP

Answer

Place the management VDOM and CustomerA in different administrative domains (ADOMs) in FortiManager

Answer

Enable admin-role override in the VDOM settings

Question 6

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

They define policies that are placed at the top (header) and bottom (footer) of the policy list when applied to a FortiGate. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list when the package is installed on a FortiGate. This ensures that critical policies, such as default deny rules or inter-VDOM links, remain in a fixed position regardless of other policy changes. This mechanism is essential for maintaining a consistent security posture across managed FortiGates.

Answer

They are used for VDOM-specific policies that cannot be modified

Answer

They provide a way to group policies for reporting purposes

Answer

They allow policy packages to be installed in a specific sequence

Question 7

A FortiGate with multiple VDOMs is experiencing inter-VDOM routing issues. The admin has created inter-VDOM links between VDOMs and configured firewall policies allowing traffic. However, traffic from VDOM_A to VDOM_B is not reaching the destination. What is the most likely cause?

Accepted Answer

The routing table in VDOM_A does not have a route to VDOM_B's subnet via the inter-VDOM link. Inter-VDOM routing requires explicit routes in each VDOM's routing table pointing to the destination subnet via the inter-VDOM link interface. Even with inter-VDOM links and firewall policies configured, if VDOM_A lacks a route to VDOM_B's subnet through that link, traffic will be dropped or forwarded incorrectly. The routing table must contain a static or dynamic route for the destination network with the next-hop set to the inter-VDOM link's IP address on the VDOM_A side.

Answer

The inter-VDOM link's administrative status is down

Answer

VDOM_B does not have an interface in the same subnet as the inter-VDOM link

Answer

The traffic is blocked by an implicit deny policy in VDOM_B

Question 8

An admin configures a FortiManager ADOM for a customer with multiple FortiGates. The admin wants to use meta fields to group firewalls by location. After defining a meta field 'Location' and assigning values to devices, where can the admin use the meta field for policy targeting?

Accepted Answer

In the installation target of a policy package, the admin can filter devices by meta field values. In FortiManager, meta fields are used within ADOM-level policy packages to filter devices during installation targeting. This allows the admin to select only FortiGates with a specific 'Location' meta field value, enabling policy targeting based on location without manual device grouping.

Answer

Meta fields are automatically synced to FortiGate and used in firewall policies

Answer

In the ADOM level policy package, meta fields are used as variables in policy names

Answer

Meta fields are only used for generating reports in FortiAnalyzer

Question 9

A FortiGate admin runs the following command: 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto_state=01' and 'duration=3600, expire=3599'. What does this indicate about the session?

Accepted Answer

The session is established and has been active for 3600 seconds. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443 (HTTPS). The output shows 'duration=3600, expire=3599', meaning the session has been active for 3600 seconds and will expire in 3599 seconds. The 'proto_state=01' indicates a TCP session in the established state (state 1 = TCP_ESTABLISHED). This confirms the session is fully established and actively tracked by the FortiGate session table.

Answer

The session has timed out and is being removed

Answer

The session is in a closing state

Answer

The session is in a half-open state

Question 10

Which of the following is a required step when enabling VDOMs on a FortiGate for the first time?

Accepted Answer

Reboot the FortiGate after enabling VDOMs. When enabling VDOMs on a FortiGate for the first time, the device must be rebooted to restructure the internal data plane and control plane to support multiple virtual domains. This reboot is mandatory because the firmware transitions from a single-VDOM mode to a multi-VDOM mode, which requires reinitializing kernel structures and memory allocation for VDOM-specific resources.

Answer

Create at least two VDOMs before enabling the VDOM feature

Answer

Disable all firewall policies

Answer

Configure inter-VDOM routing

Question 11

A FortiGate administrator needs to inspect traffic between two VLANs in the same VDOM. The administrator has configured a firewall policy that applies an antivirus profile, but traffic is passing without inspection. What should the administrator check first?

Accepted Answer

That the firewall policy's source and destination interfaces match the VLAN interfaces. The most common reason for traffic passing without inspection in a VDOM is a misconfiguration in the firewall policy's interface matching. Since the traffic is between two VLANs, the policy must explicitly specify the correct source and destination VLAN interfaces. If the policy uses the wrong interfaces (e.g., a physical interface instead of the VLAN subinterface), the traffic will bypass the policy and its associated security profiles entirely.

Answer

The FortiGuard subscription status

Answer

Whether the antivirus profile is configured to use flow-based inspection

Answer

The antivirus profile's scan mode

Question 12

In a FortiManager deployment with global ADOM enabled, an administrator creates a firewall policy in the global ADOM. What is the effect of this policy on the per-ADOM devices?

Accepted Answer

The policy is installed as a header policy on all managed FortiGates. In FortiManager with global ADOM enabled, policies created in the global ADOM are installed as header policies on all managed FortiGates across all ADOMs. These header policies are processed first, before any per-ADOM policies. They apply to all devices unless overridden by per-ADOM policies with higher priority. Therefore, option D is correct.

Answer

The policy is used only if no per-ADOM policy exists with the same name

Answer

The policy is applied only to devices in the same ADOM as the global ADOM

Answer

The policy is ignored unless explicitly assigned to each ADOM

Question 13

What is the purpose of FortiAnalyzer in a Fortinet security fabric?

Accepted Answer

To collect and analyze logs, generate reports, and provide visibility into security events. FortiAnalyzer is the centralized logging and analytics platform within the Fortinet Security Fabric. It aggregates logs from FortiGate and other Fabric devices, correlates events, generates compliance reports, and provides a single-pane-of-glass view for security monitoring and forensic analysis. This directly supports visibility and reporting, not real-time threat prevention or configuration management.

Answer

To provide sandboxing and advanced threat protection

Answer

To act as a network firewall and IPS

Answer

To manage and deploy configurations to FortiGates

Question 14

An administrator notices that after making changes to a policy package in FortiManager, the 'Install Preview' shows that the changes will modify policies on a FortiGate. However, the admin wants to verify what the exact changes will be before installing. What should the admin do?

Accepted Answer

Use the 'Revision History' to compare the current configuration with the previous version. The Revision History feature in FortiManager allows an administrator to compare the current configuration of a policy package with a previous version, showing a detailed diff of exactly which policies will be added, removed, or modified. This provides a precise verification of changes before installation, unlike the Install Preview which only indicates that changes exist without showing the specific modifications.

Answer

Check the 'Audit Log' for recent changes

Answer

Run 'diagnose dvm device list' on FortiManager

Answer

Use the 'Install Preview' and then click 'View Details' on each device

Question 15

A FortiGate with VDOMs enabled has a management VDOM (mgmt-vdom) and a traffic VDOM (traffic-vdom). The admin wants to manage the FortiGate via HTTPS from a network in traffic-vdom. What configuration is needed?

Accepted Answer

Add the interface from traffic-vdom to the management VDOM using 'set vdom mgmt-vdom' in the interface configuration. When VDOMs are enabled, the management VDOM owns the management IP addresses for the entire FortiGate. To allow HTTPS management from an interface in a non-management VDOM (traffic-vdom), that interface must be reassigned to the management VDOM using the 'set vdom mgmt-vdom' command. This makes the interface part of the management VDOM while still passing traffic for the original VDOM, enabling administrative access from that network.

Answer

Configure a static route in the management VDOM to reach traffic-vdom subnets

Answer

Enable 'admin-sport' in the global system settings

Answer

Create a firewall policy in traffic-vdom allowing HTTPS to the FortiGate's IP