NSE7 Enterprise Firewall and VDOMs Practice Test 13 — 15 Questions

Question 1

An administrator runs 'diagnose sys session list' and sees sessions with 'proto=6 proto_state=02' and a long duration. The administrator is troubleshooting why sessions are not being terminated after a policy change that should block the traffic. What does 'proto_state=02' indicate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The session is in established state (TCP connection active). In Fortinet's 'diagnose sys session list' output, 'proto=6' indicates TCP, and 'proto_state=02' maps to the TCP established state (ESTABLISHED). This means the session has completed the three-way handshake and is actively passing data. A long duration in this state explains why the session persists even after a policy change that should block new traffic—the existing session remains in the kernel session table until it times out or is explicitly cleared, because FortiGate's stateful inspection does not retroactively terminate established sessions upon policy modification.

Answer

The session is in TIME_WAIT state

Answer

The session is in SYN_SENT state, waiting for a SYN-ACK

Answer

The session is in FIN_WAIT state, closing the connection

Question 2

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. After configuration, traffic from VDOM-A cannot reach VDOM-B. Which configuration step is MOST likely missing?

Accepted Answer

Create a firewall policy on VDOM-A and VDOM-B allowing traffic over the VDOM link interface. VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

Answer

Enable 'inter-vdom-routing' under system settings

Answer

Configure a static route on VDOM-A pointing to VDOM-B's subnet via the VDOM link

Answer

Assign both VDOM link interfaces to the same VDOM

Question 3

An administrator wants to use FortiManager to push a new firewall policy to a managed FortiGate. Before installing, the administrator wants to review what changes will be applied. Which FortiManager feature should be used?

Accepted Answer

Install Preview. Install Preview (Option A) is the correct feature because it allows the administrator to see a detailed, side-by-side comparison of the current configuration on the managed FortiGate versus the pending changes that FortiManager will push. This preview is generated by FortiManager's policy compilation engine, which calculates the exact CLI commands and object modifications required to synchronize the device database (ADOM) with the managed FortiGate. It provides a safe, non-disruptive way to validate changes before committing them, reducing the risk of misconfiguration.

Answer

Policy & Objects - Install Wizard

Answer

Configuration Rollback

Answer

Revision History

Question 4

An administrator configures a firewall policy with an application control profile to block social media. The administrator observes that some social media traffic is still passing through. The traffic is HTTPS. What additional configuration is REQUIRED for application control to effectively block HTTPS-based social media?

Accepted Answer

Enable 'ssl-ssh-profile' with deep inspection on the policy. Application control requires visibility into the application layer to identify HTTPS-based traffic. Without SSL inspection, the firewall cannot decrypt the HTTPS payload to inspect the application signatures. Enabling an 'ssl-ssh-profile' with deep inspection on the policy allows the FortiGate to decrypt the traffic, apply the application control profile, and effectively block social media applications.

Answer

Set application control to proxy-based inspection

Answer

Enable 'allow-ssl-inspection' under system settings

Answer

Add a DNS filter to block social media domains

Question 5

A FortiGate in HA active-passive mode has two VDOMs. VDOM-1 is configured for management (management VDOM). The administrator connects to the management VDOM IP to manage the device. What is a characteristic of the management VDOM?

Accepted Answer

It provides administrative access and is separate from data VDOMs. In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Answer

It automatically synchronizes configuration to other VDOMs

Answer

It must be the root VDOM

Answer

It can only be accessed via the console port

Question 6

A FortiGate administrator configures a VDOM with a limit on the number of firewall policies. The VDOM has 200 policies, and the limit is set to 250. The administrator attempts to add a new policy but receives an error indicating the limit has been reached. What is the MOST likely reason?

Accepted Answer

The limit includes IPv4, IPv6, and other policy types. The FortiGate VDOM policy limit includes all policy types—IPv4, IPv6, and others (e.g., local-in policies, authentication policies). Even if the administrator has only 200 IPv4 policies, the total count of all policy types combined may already reach the 250 limit, preventing the addition of a new policy. This is why the error occurs despite the VDOM appearing to have room under the configured limit.

Answer

The administrator must reboot the FortiGate for the limit to take effect

Answer

The VDOM has reached the maximum number of objects, not policies

Answer

The limit is per VDOM and cannot be changed

Question 7

An administrator wants to use FortiAnalyzer to generate weekly compliance reports for all managed FortiGates. Which FortiAnalyzer feature should be used?

Accepted Answer

Reports. FortiAnalyzer's Reports feature is specifically designed to generate scheduled, customizable compliance reports that aggregate data from multiple managed FortiGates. This allows administrators to produce weekly reports aligned with regulatory standards (e.g., PCI DSS, HIPAA) without manual effort, leveraging pre-defined or custom report templates.

Answer

Incidents

Answer

FortiView

Answer

Log Analytics

Question 8

In a multi-VDOM deployment, an administrator needs to route traffic between VDOM-A and VDOM-B. The administrator creates a VDOM link between the two VDOMs. What additional configuration is required on each VDOM to enable inter-VDOM traffic?

Accepted Answer

Configure a static route on each VDOM pointing to the other VDOM's networks via the VDOM link, and create a firewall policy allowing traffic. Inter-VDOM traffic via a VDOM link requires both a static route on each VDOM pointing to the remote VDOM's networks through the VDOM link interface, and a firewall policy on each VDOM that permits the desired traffic. Without the static route, the VDOM does not know how to reach the other VDOM's subnets; without the firewall policy, traffic is blocked by the implicit deny rule. The VDOM link itself provides the Layer 2 or Layer 3 connectivity between the VDOMs, but routing and policy enforcement are mandatory for traffic to flow.

Answer

Only a firewall policy on VDOM-A allowing traffic to VDOM-B

Answer

Assign the VDOM link interfaces to the same VDOM

Answer

Enable 'inter-vdom-routing' under system settings only

Question 9

Which FortiManager feature allows an administrator to view the exact CLI commands that will be pushed to a managed FortiGate before installation?

Accepted Answer

Install Preview. Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

Answer

Policy Check

Answer

Revision History

Answer

Device Manager Dashboard

Question 10

What is the primary function of FortiAnalyzer's FortiView feature?

Accepted Answer

Real-time traffic monitoring and visualization. FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

Answer

Centralized device configuration management

Answer

Scheduling and generating compliance reports

Answer

Automated remediation of security incidents

Question 11

A FortiGate admin configures a policy package with header and footer policies in FortiManager. What is the purpose of header policies?

Accepted Answer

They are evaluated before other policies in the same policy package. Header policies in FortiManager are evaluated before any other policies in the same policy package. This allows administrators to enforce mandatory rules—such as blocking specific traffic or applying global inspection—that must be processed first, ensuring they are not bypassed by more specific policies later in the sequence.

Answer

They are used for NAT policies only

Answer

They provide default logging for all traffic

Answer

They apply only to the root VDOM

Question 12

An organization has multiple ADOMs in FortiManager. The admin wants to share a set of firewall objects across all ADOMs. What is the best approach?

Accepted Answer

Use the Global ADOM to create global objects. The Global ADOM in FortiManager is specifically designed to create and manage global objects (such as address objects, services, and schedules) that can be shared across all regular ADOMs. When an object is created in the Global ADOM, it is automatically available in all ADOMs that are linked to it, eliminating the need for duplication. This is the only native, supported method for sharing objects across multiple ADOMs in FortiManager.

Answer

Create a meta field and assign objects

Answer

Manually recreate the objects in each ADOM

Answer

Enable object sharing in the system settings

Question 13

An admin needs to configure a FortiGate to send logs to FortiAnalyzer for a specific VDOM only. How can this be achieved?

Accepted Answer

Set the FortiAnalyzer IP in the specific VDOM's log settings. FortiGate allows per-VDOM log configuration, including the FortiAnalyzer IP address, under the VDOM's log settings. This ensures that only logs from that specific VDOM are sent to the designated FortiAnalyzer, while other VDOMs remain unaffected.

Answer

Create a separate ADOM in FortiAnalyzer for that VDOM

Answer

Configure log forwarding globally; it applies to all VDOMs

Answer

Use a firewall policy to filter logs to FortiAnalyzer

Question 14

An administrator configures a multi-VDOM FortiGate in transparent mode. The admin notices that the management IP is reachable from both interfaces, but traffic passing through the device is not being inspected. What is the likely issue?

Accepted Answer

The VDOM is in transparent mode, but no firewall policy is applied to the traffic. In transparent mode, a FortiGate acts as a Layer 2 bridge, and traffic passing through the device is controlled by firewall policies, not by routing. Even though the management IP is reachable (because it is a separate IP on the bridge interface), no traffic inspection occurs unless an explicit firewall policy is configured to allow and inspect the traffic between the bridge interfaces. Option B correctly identifies that the missing firewall policy is the root cause.

Answer

Inter-VDOM routing is misconfigured

Answer

The FortiGate needs a default route

Answer

The management IP is assigned to the wrong VDOM

Question 15

A company has a FortiGate with multiple VDOMs. The security team wants to use FortiManager to manage policies centrally. Which three steps are necessary to set up VDOM management via FortiManager? (Choose three.)

Accepted Answer

Enable VDOMs on the FortiGate and configure them for FortiManager management. VDOMs must be enabled on the FortiGate and each VDOM must be configured to allow FortiManager management. This is done by setting the 'set vdom mgmt' parameter within each VDOM or globally, which permits FortiManager to push policy and object changes to the specific VDOM context. Without this step, FortiManager cannot authenticate or communicate with the VDOMs, even if the device is added to the ADOM.

Answer

Configure a static route on FortiManager to reach the FortiGate's management IP

Answer

Disable VDOM configuration locking on FortiManager