NSE7 Enterprise Firewall and VDOMs Practice Test 14 — 15 Questions

Question 1

An administrator uses FortiManager automation stitches to respond to an incident. The stitch includes a trigger, one or more actions, and conditions. Which THREE components are valid action types in an automation stitch?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

CLI script execution. CLI script execution is a valid action type in FortiManager automation stitches because it allows the administrator to run a predefined CLI script on a managed FortiGate device directly from the stitch. This enables automated configuration changes or troubleshooting commands in response to a trigger, such as blocking an IP address after an intrusion detection event.

Answer

FortiGate reboot

Answer

FortiAnalyzer report generation

Question 2

A company is deploying FortiGate in transparent mode between an existing router and LAN switch. Which TWO statements about transparent mode are true?

Accepted Answer

The FortiGate forwards traffic based on MAC addresses. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. It inspects packets at the application layer but does not modify the Layer 3 header, making it transparent to the network.

Answer

Each interface requires an IP address

Answer

The FortiGate can perform routing

Answer

Transparent mode supports multiple VDOMs

Question 3

A network administrator is configuring VDOMs on a FortiGate and wants to separate management traffic from production data traffic. What is the best practice when using a management VDOM?

Accepted Answer

Create a dedicated management VDOM and assign only management interfaces to it. Creating a dedicated management VDOM and assigning only management interfaces to it is the best practice because it isolates management traffic from production data traffic, reducing the attack surface and preventing management access from being exposed to untrusted networks. This aligns with Fortinet's security best practices for VDOM administration, ensuring that management functions are logically separated from data-plane operations.

Answer

Disable management access on all VDOMs except the root VDOM

Answer

Use inter-VDOM routing to route management traffic to the root VDOM

Answer

Assign all interfaces to the management VDOM

Question 4

An administrator deploys a FortiGate in transparent mode within a Layer 2 network. They apply a firewall policy with an antivirus profile to inspect traffic between two VLANs. What is a key characteristic of transparent mode that affects policy application?

Accepted Answer

Traffic is forwarded based on MAC addresses, and policies are applied transparently without changing the IP path. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

Answer

NAT is automatically applied to all traffic to preserve private IP addresses

Answer

Firewall policies are applied only to traffic entering the management interface

Answer

Each VDOM in transparent mode requires a unique IP address for management

Question 5

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

Accepted Answer

Create a VDOM link interface pair and assign them to the respective VDOMs. Inter-VDOM routing requires a VDOM link, which is a pair of logical interfaces (one in each VDOM) that are directly connected. Without this link, the VDOMs cannot exchange traffic even if firewall policies and routes exist, because they operate as separate virtual firewalls with isolated forwarding tables.

Answer

Configure a static route with a gateway IP in the destination VDOM

Answer

Assign an IP address to the VLAN interface on the source VDOM

Answer

Enable 'inter-vdom' under config system global

Question 6

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

A TCP session on port 443 has been active for 1 hour and will expire in 3599 seconds. The output shows a TCP session (proto=6) on port 443 with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 1 hour and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP established state, confirming an active TCP session.

Answer

The session has expired and is being removed

Answer

A UDP session on port 443 is being blocked

Answer

The firewall policy is incorrectly configured

Question 7

What is the purpose of a Global ADOM in FortiManager?

Accepted Answer

To share common objects and policies across multiple ADOMs. A Global ADOM in FortiManager is a special administrative domain that stores objects and policies shared across multiple regular ADOMs. This allows administrators to define common objects (e.g., address groups, services, schedules) once in the Global ADOM and then reference them in per-ADOM policies, ensuring consistency and reducing duplication. It does not replace the root ADOM, nor is it limited to backups or single-VDOM management.

Answer

To store backup configurations only

Answer

To manage all FortiGates in a single VDOM

Answer

To replace the root ADOM for system settings

Question 8

A company uses FortiManager to manage multiple FortiGate firewalls. After making changes to a policy package, the administrator runs an install preview and sees a warning: 'Policy ID 10 will be deleted on device XYZ'. What is the most likely reason for this warning?

Accepted Answer

Policy ID 10 was manually added on the device but is not present in the policy package. The warning 'Policy ID 10 will be deleted on device XYZ' indicates that the policy package on FortiManager does not contain Policy ID 10, but the device currently has it. During an install, FortiManager synchronizes the device's policy set with the policy package, so any policy present on the device but absent from the package is flagged for deletion. This is a standard consistency check to prevent unintended policy loss.

Answer

The policy package has been corrupted and needs to be re-imported

Answer

The device is in a different ADOM and cannot use the same policy ID

Answer

A revision history conflict exists that prevents the install

Question 9

An administrator configures FortiAnalyzer to receive logs from multiple FortiGates. They want to create a report that shows only incidents involving 'critical' severity and specific attack types. Which FortiAnalyzer feature allows the administrator to define such a custom report?

Accepted Answer

Report datasets and charts. FortiAnalyzer reports use SQL-like queries and dataset definitions to filter and aggregate log data based on severity, attack type, etc.

Answer

Incident management

Answer

Playbooks

Answer

FortiView dashboards

Question 10

In a multi-VDOM deployment, what is the purpose of inter-VDOM routing?

Accepted Answer

To allow traffic to pass between different VDOMs via firewall policies. Inter-VDOM routing allows traffic to be forwarded between different VDOMs on the same FortiGate unit. This is achieved by configuring inter-VDOM links (IVL) or using VDOM peering, and then applying firewall policies to control and secure the traffic flow between VDOMs. Option C correctly identifies that firewall policies are the mechanism used to permit or deny inter-VDOM traffic.

Answer

To route traffic between the management VDOM and data VDOMs

Answer

To provide redundancy for VDOMs in an HA setup

Answer

To connect VDOMs to external routers

Question 11

A FortiGate administrator wants to use FortiManager automation stitches to automatically block an IP address when a specific threat is detected. Which components must be configured within the automation stitch?

Accepted Answer

A trigger, at least one action, and optionally conditions. An automation stitch in FortiManager requires a trigger (e.g., an event or log match) to start the workflow, at least one action (e.g., a CLI script to block an IP via firewall address creation), and optionally conditions to filter when the trigger fires. This three-part structure is mandatory because the trigger defines the event, the action executes the response, and conditions provide granular control without which the stitch would fire on every trigger occurrence.

Answer

A trigger and a connector to an external threat feed

Answer

An action only, since the trigger is predefined

Answer

A schedule and a script

Question 12

An administrator configures a FortiGate in transparent mode with two VDOMs. Each VDOM is assigned to a different VLAN. The administrator wants to apply a common security policy to traffic between the VLANs. What is the correct approach?

Accepted Answer

Use inter-VDOM routing linked to a policy in the global policy set. In transparent mode, FortiGate VDOMs are isolated by default, and traffic between VLANs assigned to different VDOMs must traverse an inter-VDOM link. The correct approach is to use inter-VDOM routing and apply a security policy in the global policy set, which allows a common policy to govern traffic crossing VDOM boundaries. This ensures that the policy is evaluated once for inter-VDOM traffic, rather than requiring separate policies in each VDOM.

Answer

Assign both VLANs to the same VDOM and apply a policy there

Answer

Apply the policy on the management VDOM

Answer

Configure a single policy on the root VDOM that matches all VLANs

Question 13

In FortiManager, what is the purpose of header and footer policies in a policy package?

Accepted Answer

To ensure specific policies are always placed at the top (header) or bottom (footer) of the policy list. Header and footer policies in FortiManager are special policy types that enforce a fixed position within the policy list. Header policies are always placed at the top (before all other policies), and footer policies are always placed at the bottom (after all other policies). This ensures that critical security rules, such as default-deny or global allow rules, remain in their intended position regardless of policy package changes or reordering operations.

Answer

To create policy groups for better organization

Answer

To apply policies only during specific times of the day

Answer

To separate IPv4 and IPv6 policies

Question 14

A network engineer is deploying FortiGate VDOMs and needs to limit the number of VDOMs per FortiGate to comply with licensing. Which command can be used to check the maximum VDOMs allowed?

Accepted Answer

get system status. The 'get system status' command displays the current FortiGate system status, including the maximum number of VDOMs allowed by the installed license. This is the correct command to verify the licensed VDOM limit before deploying additional VDOMs.

Answer

show system vdom

Answer

execute vdom limit

Answer

diagnose sys vdom list

Question 15

A FortiGate administrator needs to configure a new FortiGate in FortiManager for centralized management. Which TWO steps are required to add the device to an ADOM?

Accepted Answer

Add the device to the ADOM using the device manager. The Device Manager in FortiManager is the interface used to add a device to an ADOM. After adding the device, it must be authorized (Option E) to establish a management tunnel and allow configuration synchronization. Without authorization, the device remains in a pending state and cannot be managed.

Answer

Create a policy package before adding the device

Answer

Configure a VDOM link on the FortiGate

Answer

Enable automation stitches on the FortiGate