NSE7 Enterprise Firewall and VDOMs Practice Test 13 — 15 Questions

Question 1

An administrator needs to isolate customer traffic in a FortiGate deployed at a service provider. Each customer should have independent administrators and security policies. Which feature should be used?

Accepted Answer

Virtual domains (VDOMs). Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Answer

VLAN interfaces

Answer

Policy packages

Answer

Administrative domains (ADOMs)

Question 2

A FortiGate running FortiOS 7.4.1 has two VDOMs: CustomerA and CustomerB. The administrator wants CustomerA to access an HTTP server in CustomerB. Both VDOMs have appropriate policies. What additional configuration is required?

Accepted Answer

Configure a VDOM link between CustomerA and CustomerB. A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

Answer

Create a policy allowing traffic from CustomerA to CustomerB

Answer

Enable inter-VDOM routing under system settings

Answer

Assign both VDOMs to the same administrative domain in FortiManager

Question 3

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in ESTABLISHED state. The output shows `proto=6`, which indicates TCP (protocol 6). The `proto_state=01` corresponds to the TCP state for an established connection (ESTABLISHED). The `duration=3600` and `expire=3599` confirm the session has been active for 3600 seconds and will expire in 3599 seconds, which is typical for a long-lived established TCP session. Therefore, option D is correct.

Answer

The session is a UDP session

Answer

The session is in TIME_WAIT state

Answer

The session is in SYN_SENT state

Question 4

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Header policies in policy packages allow global policies that apply before VDOM-specific policies. They are defined at the ADOM level and cannot be modified within individual VDOMs.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies

Question 5

A FortiGate in transparent mode is deployed between a router and a switch. The administrator needs to apply a deep inspection profile to HTTP traffic. What is the correct configuration for the interfaces?

Accepted Answer

Configure a management IP on the VDOM and apply the inspection profile to the policy. In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Answer

Place both interfaces in the same VDOM and enable DHCP

Answer

Switch to NAT mode to enable deep inspection

Answer

Assign IPs to both interfaces and create a policy from LAN to WAN

Question 6

An administrator configures a new ADOM in FortiManager for a set of FortiGates. The administrator wants to assign meta fields to devices in this ADOM. Where should the meta fields be defined?

Accepted Answer

Device Manager -> ADOM settings. Meta fields in FortiManager are defined at the ADOM level under Device Manager -> ADOM settings. This ensures that the custom fields are available for all devices within that specific ADOM, allowing consistent metadata assignment across managed FortiGates. Defining them elsewhere, such as in global database objects, would apply them globally rather than per-ADOM, which is not the administrator's intent.

Answer

Policy & Objects -> Object configurations

Answer

System settings -> Admin

Answer

Global database objects

Question 7

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

Accepted Answer

Run 'show firewall policy'. Option D is correct because running 'show firewall policy' on the FortiGate CLI displays the currently active policy set in the kernel, including the policy ID and its enabled/disabled status. This is the quickest way to confirm whether the policy installed via FortiManager is actually present and active on the FortiGate, without generating debug logs or querying the management plane.

Answer

Use 'diagnose debug flow'

Answer

Run 'execute fortimanager reindex'

Answer

Check FortiManager revision history

Question 8

An organization uses FortiManager to manage multiple FortiGates. A junior admin accidentally deleted a critical firewall policy on one device and the change was auto-installed. How can the senior admin revert the device to the previous configuration?

Accepted Answer

Go to Device Manager -> Revision History and restore the previous revision. FortiManager maintains revision history for managed devices. The admin can restore a previous revision to revert the configuration.

Answer

Delete the ADOM and recreate it

Answer

Use the 'restore' command on FortiManager

Answer

Manually recreate the policy on the FortiGate

Question 9

A FortiGate VDOM is configured with a WAN interface (port1) and LAN interface (internal). The admin creates a policy allowing HTTP from internal to WAN with an antivirus profile applied. Users report that HTTP throughput is very slow. The admin checks the session table and sees many sessions with state 11 (TCP_CLOSE_WAIT). What is causing the performance issue?

Accepted Answer

The HTTP server is not properly closing connections, and the FortiGate is waiting for FIN from client. State 11 (TCP_CLOSE_WAIT) indicates that the FortiGate has received a FIN from the server (WAN side) and is waiting for a FIN from the client (internal side) to complete the TCP connection closure. When the HTTP server does not properly close connections, the FortiGate holds these sessions open, consuming session table resources and causing performance degradation. The antivirus profile is not the direct cause; the issue is the accumulation of sessions stuck in CLOSE_WAIT due to incomplete TCP teardown.

Answer

The antivirus profile is performing file scanning, causing delays

Answer

The policy is missing a timeout setting for TCP half-close

Answer

The FortiGate is using proxy-based inspection, which delays session closure

Question 10

An administrator needs to view real-time traffic logs and top applications for a specific VDOM on FortiAnalyzer. Which tool should be used?

Accepted Answer

FortiView. FortiView is the correct tool because it provides real-time traffic logs and top applications per VDOM on FortiAnalyzer. It uses live data streams from FortiGate logs to display current network activity, allowing administrators to filter by VDOM and view metrics like top applications, sources, and destinations without running a report or script.

Answer

Playbooks

Answer

Incident Management

Answer

Reports

Question 11

A multi-tenant FortiGate uses VDOMs. The administrator notices that logins via SSH to the management VDOM succeed, but attempts to SSH to a traffic VDOM's management IP fail. The traffic VDOM has an administrative user configured. What is the most likely cause?

Accepted Answer

SSH access is not enabled on the traffic VDOM's management interface. Option D is correct because SSH access to a VDOM's management IP requires that the management interface explicitly permits SSH administrative access. In a multi-tenant FortiGate with VDOMs, each VDOM's management interface has its own independent administrative access settings. Even if the admin user exists and the VDOM is licensed, SSH will be rejected if the management interface does not have SSH access enabled under config system interface or via the GUI. The fact that SSH to the management VDOM succeeds but fails to the traffic VDOM's management IP points directly to this per-interface access control.

Answer

The traffic VDOM does not have a license

Answer

The traffic VDOM is in transparent mode

Answer

The admin user is not in the correct trust group

Question 12

An administrator uses FortiManager to deploy a new security policy to a remote FortiGate. The administrator selects 'Install Preview' and sees that the policy will be created. After confirming, the installation fails with 'Device not reachable'. What is the most likely reason?

Accepted Answer

The FortiGate is behind a NAT device that blocks FGFM traffic. The 'Device not reachable' error during an Install Preview operation indicates that FortiManager cannot establish or maintain the FGFM (FortiGate-to-FortiManager) tunnel with the remote FortiGate. When the FortiGate is behind a NAT device, the NAT may alter the source IP or port of FGFM traffic, causing the tunnel to break or preventing the FortiManager from reaching the FortiGate's management IP. This is the most common cause of such reachability failures in remote deployments.

Answer

The FortiGate has insufficient memory

Answer

The policy package is locked by another administrator

Answer

The FortiGate's configuration revision has changed since the last sync

Question 13

A FortiGate in HA mode has two VDOMs: VDOM1 and VDOM2. The administrator needs to ensure that if the active unit fails, the standby unit takes over with minimal disruption. Which TWO steps should be taken?

Accepted Answer

Enable session synchronization. Option A is correct because session synchronization ensures that stateful firewall sessions (e.g., TCP/UDP connections) are replicated from the active FortiGate to the standby unit. In HA active-passive mode, this allows the standby to seamlessly take over active sessions upon failover, minimizing disruption. Without session synchronization, all existing connections would be dropped and must be re-established.

Answer

Set the HA mode to active-active

Answer

Enable HA on each VDOM individually

Answer

Use VDOM link for inter-VDOM traffic

Question 14

An administrator uses FortiManager automation stitches to respond to an incident. The stitch includes a trigger, one or more actions, and conditions. Which THREE components are valid action types in an automation stitch?

Accepted Answer

CLI script execution. CLI script execution is a valid action type in FortiManager automation stitches because it allows the administrator to run a predefined CLI script on a managed FortiGate device directly from the stitch. This enables automated configuration changes or troubleshooting commands in response to a trigger, such as blocking an IP address after an intrusion detection event.

Answer

FortiGate reboot

Answer

FortiAnalyzer report generation

Question 15

A company is deploying FortiGate in transparent mode between an existing router and LAN switch. Which TWO statements about transparent mode are true?

Accepted Answer

The FortiGate forwards traffic based on MAC addresses. Option A is correct because in transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. It inspects packets at the application layer but does not modify the Layer 3 header, making it transparent to the network.

Answer

Each interface requires an IP address

Answer

The FortiGate can perform routing

Answer

Transparent mode supports multiple VDOMs