NSE7 Enterprise Firewall and VDOMs Practice Test 12 — 15 Questions

Question 1

Drag and drop the steps to configure a FortiGate as a DNS server (DNS proxy) into the correct order.

Accepted Answer

Enable DNS proxy → Set interface and port → Configure upstream DNS servers → Set caching → Allow DNS traffic in firewall policies. Enable DNS proxy, set interface and port, configure upstream, set caching, then allow traffic.

Answer

Set interface and port → Enable DNS proxy → Configure upstream DNS servers → Set caching → Allow DNS traffic in firewall policies

Answer

Enable DNS proxy → Set interface and port → Set caching → Configure upstream DNS servers → Allow DNS traffic in firewall policies

Answer

Enable DNS proxy → Set interface and port → Allow DNS traffic in firewall policies → Configure upstream DNS servers → Set caching

Question 2

Match each Fortinet component to its description.

Accepted Answer

FortiGate: Next-generation firewall (NGFW) with integrated security features. FortiGate is the NGFW, FortiManager manages devices, FortiAnalyzer handles logging/analytics, and FortiClient is an endpoint agent. Common confusions involve swapping these roles.

Answer

FortiGate: Centralized management for Fortinet devices

Answer

FortiManager: Next-generation firewall (NGFW) with integrated security features

Question 3

Match each FortiGate routing concept to its description.

Accepted Answer

Policy-based routing: Routes packets based on criteria other than destination IP, such as source IP or protocol. Correct matches: PBR, Route redistribution, Administrative distance, and Static route are correctly paired. ECMP and Metric are swapped; ECMP distributes traffic across equal-cost paths, while Metric compares routes within a protocol.

Answer

ECMP: A numeric value used to compare routes within the same routing protocol

Answer

Metric: Distributes traffic across multiple equal-cost paths to the same destination

Question 4

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

Accepted Answer

Configure static or dynamic routing. Routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Answer

Configure a VDOM link

Answer

Create a policy with inter-VDOM link

Answer

Enable inter-VDOM routing

Question 5

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 6

An administrator is deploying a FortiGate in transparent mode to seamlessly integrate into an existing network. The administrator needs to manage the FortiGate remotely over the network. Which configuration is required?

Accepted Answer

Configure a management IP address under the VDOM settings. In transparent mode, FortiGate operates as a Layer 2 bridge and does not route traffic, so physical interfaces cannot have IP addresses. To enable remote management, a dedicated management IP must be configured under the VDOM settings, which allows the FortiGate to be reachable via protocols like HTTPS, SSH, or SNMP without participating in Layer 3 forwarding.

Answer

Create a VLAN interface and assign an IP

Answer

Assign an IP address to the physical interfaces

Answer

Enable DHCP client on the interfaces

Question 7

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 8

In FortiManager, an administrator wants to apply a set of firewall policies to multiple FortiGates in different ADOMs. The policies must be centrally managed. What is the best approach?

Accepted Answer

Use the Global ADOM to define global policies that apply to all ADOMs. The Global ADOM in FortiManager allows administrators to define firewall policies that are automatically inherited by all ADOMs, ensuring consistent, centrally managed policy enforcement across multiple FortiGates without manual duplication. This approach leverages FortiManager's hierarchical policy model, where global policies are pushed to each ADOM's policy packages and take precedence over local policies unless overridden.

Answer

Create a policy package in each ADOM and use the same policies

Answer

Configure the policies directly on each FortiGate

Answer

Use automation stitches to copy policies between ADOMs

Question 9

An administrator configures an automation stitch in FortiManager to execute a CLI script on a FortiGate when a specific event is triggered. The automation stitch is enabled but does not run when the event occurs. What is the most likely cause?

Accepted Answer

The automation stitch has not been installed to the FortiGate. In FortiManager, automation stitches are created and stored in the central management database but must be explicitly installed to the managed FortiGate via the 'Install Wizard' or a direct policy/object install. Until the stitch is installed, the FortiGate does not have the configuration locally, so even if the stitch is enabled in FortiManager and the event occurs, the FortiGate will not execute the CLI script. This is a common oversight where administrators assume enabling the stitch in FortiManager automatically pushes it to the device.

Answer

The event trigger is set to high severity only

Answer

The FortiGate does not support automation stitches

Answer

The CLI script contains an invalid command

Question 10

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

Accepted Answer

Reports. The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Answer

Incidents

Answer

Playbooks

Answer

FortiView

Question 11

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Accepted Answer

The FortiGate must be assigned to an ADOM. FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Answer

Inter-VDOM routing must be enabled

Answer

FortiAnalyzer must be registered with FortiManager

Answer

All VDOMs must be in the same ADOM

Question 12

In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?

Accepted Answer

Firewall policies are missing or not allowing the traffic. In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.

Answer

The inter-VDOM routing mode is set to 'nat' instead of 'route'

Answer

The VDOM links are not assigned to the correct VDOM

Answer

The VDOMs are in different administrative domains

Question 13

What is the purpose of a management VDOM on a FortiGate?

Accepted Answer

To provide a dedicated environment for administrative access and management protocols. A management VDOM is a dedicated virtual domain that isolates administrative traffic (e.g., HTTPS, SSH, SNMP, syslog) from data-plane traffic. This ensures that management access and protocols like RADIUS or TACACS+ authentication are processed in a separate context, preventing interference with production VDOMs and allowing granular administrative access control.

Answer

To log all administrative actions

Answer

To route traffic between different VDOMs

Answer

To increase the number of available firewall policies

Question 14

In FortiManager, what is the difference between a Global ADOM and a regular ADOM?

Accepted Answer

Global ADOM allows sharing of global objects across all ADOMs. In FortiManager, a Global ADOM is a special administrative domain that stores global objects (such as address objects, services, and policies) that can be shared and referenced by all regular ADOMs. This centralizes management of common resources, reducing duplication and ensuring consistency across multiple ADOMs. Regular ADOMs are isolated from each other by default, but they can import objects from the Global ADOM, which is the key distinction.

Answer

Regular ADOM supports automation stitches while Global ADOM does not

Answer

Regular ADOM can only manage one FortiGate

Answer

Global ADOM is used for managing FortiGates in a single VDOM environment

Question 15

An administrator wants to create a separate virtual firewall instance on a FortiGate to isolate a DMZ environment. The DMZ must have its own routing table, firewall policies, and administrators. Which FortiGate feature should be used?

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) are the FortiGate feature that allows the creation of multiple independent virtual firewalls within a single physical appliance. Each VDOM operates with its own separate routing table, firewall policies, and administrative domains, making it the correct choice for isolating a DMZ environment with dedicated administrators and routing.

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Answer

Security Fabric