NSE7 Enterprise Firewall and VDOMs Practice Test 12 — 15 Questions

Question 1

An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?

Accepted Answer

Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'. Option C is correct because inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.

Answer

Place both VDOMs in the same VDOM group

Answer

Configure a static route in each VDOM pointing to the other VDOM's management IP

Answer

Enable VDOM forwarding in global settings

Question 2

A network administrator is deploying a FortiGate in transparent mode to replace an existing layer 2 switch. Which statement about transparent mode is true?

Accepted Answer

All interfaces operate at layer 2, and the FortiGate forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding traffic based on MAC addresses without performing routing. All interfaces are in the same broadcast domain, and the FortiGate inspects traffic at layers 3–7 while remaining transparent to the network. This allows it to replace a layer 2 switch while adding firewall functionality.

Answer

Transparent mode only supports static routing

Answer

Transparent mode requires VDOMs to be enabled

Answer

The FortiGate acts as a router and requires IP addresses on its interfaces

Question 3

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is established and has been active for 1 hour. Option C is correct because the output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED in Fortinet's session table), `duration=3600` seconds (1 hour), and `expire=3599` seconds (remaining lifetime). This combination indicates a fully established TCP session that has been active for one hour and is still valid, not blocked or in a transitional state.

Answer

The session is being blocked by a firewall policy

Answer

The session is in SYN_SENT state, waiting for a reply

Answer

The session is in TIME_WAIT state after a FIN

Question 4

A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?

Accepted Answer

Header policies are inserted before the VDOM's own policies; footer policies are appended after. Option D is correct because in FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.

Answer

Header/footer policies are only available when using per-device mapping

Answer

Header/footer policies can only be configured directly on the FortiGate, not via FortiManager

Answer

Header/footer policies are automatically generated and cannot be manually edited

Question 5

A FortiGate in a multi-VDOM environment has a management VDOM (mgmt-vdom) and a traffic VDOM (corp-vdom). The admin wants to access the FortiGate GUI using IP 10.0.1.1 assigned to port1 in mgmt-vdom. However, the GUI is unreachable. The admin can SSH into mgmt-vdom. What is the most likely cause?

Accepted Answer

The management VDOM has an implicit deny policy blocking inbound HTTPS. In a multi-VDOM FortiGate, each VDOM has its own independent firewall policies. Even if HTTPS access is enabled on the interface (set allowaccess https), the management VDOM (mgmt-vdom) still requires an explicit firewall policy to permit inbound HTTPS traffic from the source to the FortiGate's own IP. Without such a policy, the implicit deny rule at the end of the policy list blocks the GUI connection. SSH works because it is typically allowed by a separate policy or by default administrative access rules, but HTTPS is not implicitly permitted.

Answer

The admin must enable 'set allowaccess https' under the interface configuration

Answer

The FortiGate is in transparent mode and requires a management IP

Answer

The traffic VDOM's routing table is incorrect

Question 6

Which FortiAnalyzer feature allows administrators to create automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer define automated workflows triggered by events, enabling actions like blocking IPs via FortiGate API calls.

Answer

FortiView

Answer

Reports

Answer

Incidents

Question 7

A FortiGate administrator wants to use FortiManager to manage multiple FortiGates in different geographic regions. To isolate configuration changes, the administrator creates separate ADOMs for each region. Which type of ADOM should be used to allow some common objects (like address groups) to be shared across all regions?

Accepted Answer

Global ADOM. The Global ADOM is designed to store and share common objects, such as address groups, policies, and schedules, across all ADOMs in a FortiManager deployment. When an administrator creates separate ADOMs for each region, the Global ADOM acts as a central repository for objects that need to be consistent everywhere, allowing per-region ADOMs to reference these shared objects without duplicating them. This ensures configuration isolation for region-specific settings while maintaining a single source of truth for global resources.

Answer

Per-Device ADOM

Answer

Regular ADOM

Answer

Meta ADOM

Question 8

An administrator deploys a FortiGate in transparent mode with two VDOMs: one for the internal network and one for DMZ. The admin notices that ARP requests from internal hosts are not reaching the DMZ servers even though they are on the same VLAN. What is the most likely cause?

Accepted Answer

VDOMs in transparent mode are isolated layer 2 domains; inter-VDOM routing is required for communication. In transparent mode, each VDOM acts as an independent Layer 2 forwarding domain with its own MAC address table and VLAN database. ARP requests are broadcast frames that are confined to the VDOM where they originate; they are not forwarded to other VDOMs. Therefore, even if the internal and DMZ interfaces are on the same VLAN, the ARP request from an internal host will never reach a DMZ server unless inter-VDOM routing (Layer 3 forwarding between VDOMs) is explicitly configured.

Answer

The FortiGate is not configured to proxy ARP

Answer

The internal and DMZ VDOMs are in different VLANs on the same physical interface

Answer

Transparent mode does not support VDOMs

Question 9

Which FortiManager feature allows administrators to view the exact configuration changes that would be applied to a managed FortiGate before committing them?

Accepted Answer

Install preview. Install preview in FortiManager shows the CLI commands that will be executed on the device, allowing validation before installation.

Answer

Revision history

Answer

Device manager

Answer

Policy checker

Question 10

A FortiGate has two VDOMs: 'root' and 'customer'. The admin wants to route traffic from 'customer' to the internet via 'root', which has a BGP connection to an ISP. What is the required configuration?

Accepted Answer

Create an inter-VDOM link between 'customer' and 'root', and configure policies to allow traffic. Option D is correct because inter-VDOM links are the only supported method for routing traffic between VDOMs on the same FortiGate. An inter-VDOM link creates a virtual point-to-point connection between two VDOMs, allowing traffic to flow through firewall policies. Without this link, VDOMs are isolated and cannot exchange traffic, even if static routes or BGP are configured.

Answer

Enable VDOM forwarding on the WAN interface in 'root'

Answer

Configure a static route in 'customer' pointing to the 'root' VDOM's management IP

Answer

Place both VDOMs in the same VDOM group and enable route leak

Question 11

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

Accepted Answer

Verify that the FortiGate can reach the FortiAnalyzer IP address and that the FortiAnalyzer service is running. The 'disconnected' status indicates that the FortiGate cannot establish a TCP connection to the FortiAnalyzer. The first step is to verify basic Layer 3 reachability (ping) and that the FortiAnalyzer service is listening on the default port (TCP 514 or 3000 for encrypted). Without confirming these, further troubleshooting is premature.

Answer

Check the FortiGate's DNS resolution for the FortiAnalyzer hostname

Answer

Restart the FortiGate's logging service

Answer

Disable and re-enable logging to FortiAnalyzer

Question 12

A FortiGate admin configures a firewall policy with an antivirus profile in flow-based inspection mode. The admin notices that some large files are being scanned but others are allowed without scanning. What is the most likely cause?

Accepted Answer

The FortiGate's antivirus buffer size is exceeded, causing some files to bypass scanning. In flow-based inspection, FortiGate uses a buffer to reassemble files before scanning. When a file exceeds the configured antivirus buffer size (default 1 MB for flow-based), the FortiGate cannot buffer the entire file for scanning and allows it to pass without inspection. This explains why some large files bypass scanning while smaller ones are scanned.

Answer

The antivirus signatures are outdated

Answer

The antivirus profile has an exemption for certain file types

Answer

Flow-based inspection cannot scan files larger than 10 MB

Question 13

A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)

Accepted Answer

Trigger. An automation stitch consists of a trigger (event condition) and one or more actions. The trigger defines when the stitch runs; the action defines what happens (e.g., CLI script, email).

Answer

Playbook

Answer

Destination

Answer

Schedule

Question 14

An enterprise FortiGate has multiple VDOMs. The security policy requires that all traffic between VDOMs must be inspected by a next-generation firewall profile. Which three steps are necessary to achieve this? (Choose three.)

Accepted Answer

Ensure routing is properly configured to forward traffic through the inter-VDOM link. Option A is correct because for traffic to traverse between VDOMs via an inter-VDOM link, proper routing must be configured in each VDOM to forward traffic through the inter-VDOM link interface. Without correct routing entries (static or dynamic), packets will not be directed to the inter-VDOM link, and the next-generation firewall profile cannot be applied.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Enable VDOM inspection mode in global settings

Question 15

A network administrator is troubleshooting a scenario where FortiView in FortiAnalyzer shows no traffic data for a specific FortiGate, but logs are being received. Which two possible causes should the administrator investigate? (Choose two.)

Accepted Answer

The FortiGate is not sending traffic logs; only event logs are being forwarded. Option C is correct because FortiView relies on traffic logs (e.g., traffic, firewall, or application control logs) to generate its visualizations. If the FortiGate is only forwarding event logs (e.g., admin, system, or VPN logs) but not traffic logs, FortiView will show no traffic data even though logs are being received. This is a common misconfiguration in log forwarding policies on the FortiGate.

Answer

The FortiGate's clock is not synchronized with FortiAnalyzer

Answer

The FortiAnalyzer ADOM is configured as a global ADOM

Answer

The FortiAnalyzer disk is full and not indexing new logs