NSE7 Enterprise Firewall and VDOMs Practice Test 13 — 15 Questions

Question 1

A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trigger. An automation stitch in FortiManager requires a Trigger to define the event that initiates the stitch (e.g., an intrusion prevention event) and an Action to specify the response (e.g., blocking an IP address via a firewall address object). The Trigger monitors for specific log messages or system events, while the Action executes the configured remediation step. Without both, the stitch cannot be created or function.

Answer

Playbook

Answer

Destination

Answer

Schedule

Question 2

An enterprise FortiGate has multiple VDOMs. The security policy requires that all traffic between VDOMs must be inspected by a next-generation firewall profile. Which three steps are necessary to achieve this? (Choose three.)

Accepted Answer

Ensure routing is properly configured to forward traffic through the inter-VDOM link. For traffic to traverse between VDOMs via an inter-VDOM link, proper routing must be configured in each VDOM to forward traffic through the inter-VDOM link interface. Without correct routing entries (static or dynamic), packets will not be directed to the inter-VDOM link, and the next-generation firewall profile cannot be applied.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Enable VDOM inspection mode in global settings

Question 3

A network administrator is troubleshooting a scenario where FortiView in FortiAnalyzer shows no traffic data for a specific FortiGate, but logs are being received. Which two possible causes should the administrator investigate? (Choose two.)

Accepted Answer

The FortiGate is not sending traffic logs; only event logs are being forwarded. FortiView relies on traffic logs (e.g., traffic, firewall, or application control logs) to generate its visualizations. If the FortiGate is only forwarding event logs (e.g., admin, system, or VPN logs) but not traffic logs, FortiView will show no traffic data even though logs are being received. This is a common misconfiguration in log forwarding policies on the FortiGate.

Answer

The FortiGate's clock is not synchronized with FortiAnalyzer

Answer

The FortiAnalyzer ADOM is configured as a global ADOM

Answer

The FortiAnalyzer disk is full and not indexing new logs

Question 4

An administrator needs to isolate customer traffic in a FortiGate deployed at a service provider. Each customer should have independent administrators and security policies. Which feature should be used?

Accepted Answer

Virtual domains (VDOMs). Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Answer

VLAN interfaces

Answer

Policy packages

Answer

Administrative domains (ADOMs)

Question 5

A FortiGate running FortiOS 7.4.1 has two VDOMs: CustomerA and CustomerB. The administrator wants CustomerA to access an HTTP server in CustomerB. Both VDOMs have appropriate policies. What additional configuration is required?

Accepted Answer

Configure a VDOM link between CustomerA and CustomerB. A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

Answer

Create a policy allowing traffic from CustomerA to CustomerB

Answer

Enable inter-VDOM routing under system settings

Answer

Assign both VDOMs to the same administrative domain in FortiManager

Question 6

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Header policies in policy packages allow global policies that apply before VDOM-specific policies. They are defined at the ADOM level and cannot be modified within individual VDOMs.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies

Question 7

A FortiGate in transparent mode is deployed between a router and a switch. The administrator needs to apply a deep inspection profile to HTTP traffic. What is the correct configuration for the interfaces?

Accepted Answer

Configure a management IP on the VDOM and apply the inspection profile to the policy. In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Answer

Place both interfaces in the same VDOM and enable DHCP

Answer

Switch to NAT mode to enable deep inspection

Answer

Assign IPs to both interfaces and create a policy from LAN to WAN

Question 8

An administrator configures a new ADOM in FortiManager for a set of FortiGates. The administrator wants to assign meta fields to devices in this ADOM. Where should the meta fields be defined?

Accepted Answer

Device Manager -> ADOM settings. Meta fields in FortiManager are defined at the ADOM level under Device Manager -> ADOM settings. This ensures that the custom fields are available for all devices within that specific ADOM, allowing consistent metadata assignment across managed FortiGates. Defining them elsewhere, such as in global database objects, would apply them globally rather than per-ADOM, which is not the administrator's intent.

Answer

Policy & Objects -> Object configurations

Answer

System settings -> Admin

Answer

Global database objects

Question 9

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

Accepted Answer

Run 'show firewall policy'. Running 'show firewall policy' on the FortiGate CLI displays the currently active policy set in the kernel, including the policy ID and its enabled/disabled status. This is the quickest way to confirm whether the policy installed via FortiManager is actually present and active on the FortiGate, without generating debug logs or querying the management plane.

Answer

Use 'diagnose debug flow'

Answer

Run 'execute fortimanager reindex'

Answer

Check FortiManager revision history

Question 10

An organization uses FortiManager to manage multiple FortiGates. A junior admin accidentally deleted a critical firewall policy on one device and the change was auto-installed. How can the senior admin revert the device to the previous configuration?

Accepted Answer

Go to Device Manager -> Revision History and restore the previous revision. FortiManager automatically stores configuration revisions for managed FortiGates. By navigating to Device Manager -> Revision History, the admin can select the previous revision and restore it, which reverts the device to its state before the accidental deletion. This process ensures the change is undone without manual intervention or affecting other devices.

Answer

Delete the ADOM and recreate it

Answer

Use the 'restore' command on FortiManager

Answer

Manually recreate the policy on the FortiGate

Question 11

A FortiGate VDOM is configured with a WAN interface (port1) and LAN interface (internal). The admin creates a policy allowing HTTP from internal to WAN with an antivirus profile applied. Users report that HTTP throughput is very slow. The admin checks the session table and sees many sessions with state 11 (TCP_CLOSE_WAIT). What is causing the performance issue?

Accepted Answer

The HTTP server is not properly closing connections, and the FortiGate is waiting for FIN from client. State 11 (TCP_CLOSE_WAIT) indicates that the FortiGate has received a FIN from the server (WAN side) and is waiting for a FIN from the client (internal side) to complete the TCP connection closure. When the HTTP server does not properly close connections, the FortiGate holds these sessions open, consuming session table resources and causing performance degradation. The antivirus profile is not the direct cause; the issue is the accumulation of sessions stuck in CLOSE_WAIT due to incomplete TCP teardown.

Answer

The antivirus profile is performing file scanning, causing delays

Answer

The policy is missing a timeout setting for TCP half-close

Answer

The FortiGate is using proxy-based inspection, which delays session closure

Question 12

An administrator needs to view real-time traffic logs and top applications for a specific VDOM on FortiAnalyzer. Which tool should be used?

Accepted Answer

FortiView. FortiView is the correct tool because it provides real-time traffic logs and top applications per VDOM on FortiAnalyzer. It uses live data streams from FortiGate logs to display current network activity, allowing administrators to filter by VDOM and view metrics like top applications, sources, and destinations without running a report or script.

Answer

Playbooks

Answer

Incident Management

Answer

Reports

Question 13

A multi-tenant FortiGate uses VDOMs. The administrator notices that logins via SSH to the management VDOM succeed, but attempts to SSH to a traffic VDOM's management IP fail. The traffic VDOM has an administrative user configured. What is the most likely cause?

Accepted Answer

SSH access is not enabled on the traffic VDOM's management interface. SSH access to a VDOM's management IP requires that the management interface explicitly permits SSH administrative access. In a multi-tenant FortiGate with VDOMs, each VDOM's management interface has its own independent administrative access settings. Even if the admin user exists and the VDOM is licensed, SSH will be rejected if the management interface does not have SSH access enabled under config system interface or via the GUI. The fact that SSH to the management VDOM succeeds but fails to the traffic VDOM's management IP points directly to this per-interface access control.

Answer

The traffic VDOM does not have a license

Answer

The traffic VDOM is in transparent mode

Answer

The admin user is not in the correct trust group

Question 14

An administrator uses FortiManager to deploy a new security policy to a remote FortiGate. The administrator selects 'Install Preview' and sees that the policy will be created. After confirming, the installation fails with 'Device not reachable'. What is the most likely reason?

Accepted Answer

The FortiGate is behind a NAT device that blocks FGFM traffic. The 'Device not reachable' error during an Install Preview operation indicates that FortiManager cannot establish or maintain the FGFM (FortiGate-to-FortiManager) tunnel with the remote FortiGate. When the FortiGate is behind a NAT device, the NAT may alter the source IP or port of FGFM traffic, causing the tunnel to break or preventing the FortiManager from reaching the FortiGate's management IP. This is the most common cause of such reachability failures in remote deployments.

Answer

The FortiGate has insufficient memory

Answer

The policy package is locked by another administrator

Answer

The FortiGate's configuration revision has changed since the last sync

Question 15

A FortiGate in HA mode has two VDOMs: VDOM1 and VDOM2. The administrator needs to ensure that if the active unit fails, the standby unit takes over with minimal disruption. Which TWO steps should be taken?

Accepted Answer

Enable session synchronization. Session synchronization ensures that stateful firewall sessions (e.g., TCP/UDP connections) are replicated from the active FortiGate to the standby unit. In HA active-passive mode, this allows the standby to seamlessly take over active sessions upon failover, minimizing disruption. Without session synchronization, all existing connections would be dropped and must be re-established.

Answer

Set the HA mode to active-active

Answer

Enable HA on each VDOM individually

Answer

Use VDOM link for inter-VDOM traffic