NSE7 Enterprise Firewall and VDOMs Practice Test 15 — 15 Questions

Question 1

An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trigger. A trigger is essential because it defines the event or condition that initiates the playbook execution. Without a trigger, the playbook has no starting point and cannot automate responses to detected incidents. In FortiAnalyzer, triggers can be based on log events, alerts, or scheduled intervals.

Answer

A report schedule

Answer

A dashboard visualization

Question 2

A FortiGate administrator is troubleshooting an issue where IPsec VPN traffic is not being forwarded correctly in a multi-VDOM environment. Which TWO factors should the administrator verify?

Accepted Answer

The firewall policy for the VPN traffic is present in the correct VDOM. A is correct because firewall policies are VDOM-scoped; even if the VPN tunnel is up, traffic will not be forwarded unless a policy explicitly permits it within the VDOM that owns the VPN interface. The administrator must verify that the policy allowing the IPsec traffic exists in the correct VDOM, as policies from one VDOM cannot control traffic in another.

Answer

Inter-VDOM routing is enabled globally

Answer

The management VDOM has an IPsec policy

Answer

The FortiGate is in transparent mode

Question 3

An administrator configures inter-VDOM routing between VDOMs A and B. Both VDOMs are on the same FortiGate. The admin creates a policy allowing traffic from VDOM A to VDOM B. Traffic from VDOM A to VDOM B fails. What is the most likely cause?

Accepted Answer

There is no firewall policy in VDOM B to allow the return traffic. In a FortiGate inter-VDOM routing setup, traffic initiated from VDOM A to VDOM B requires a firewall policy in VDOM B to permit the return traffic. Without this policy, the FortiGate's stateful inspection engine drops the return packets because no session exists in VDOM B's session table. This is a common misconfiguration where administrators only create a policy in the source VDOM.

Answer

VDOM A and VDOM B must be in the same administrative VDOM

Answer

The VDOMs are in transparent mode

Answer

The inter-VDOM link is not configured

Question 4

An administrator configures a FortiGate with a management VDOM. Which of the following is true about the management VDOM?

Accepted Answer

The management VDOM cannot have any firewall policies. The management VDOM is a special-purpose VDOM used exclusively for out-of-band management traffic (e.g., GUI, SSH, SNMP). It operates in a separate management plane and cannot contain firewall policies because it is not designed to inspect or forward data-plane traffic. This isolation ensures that management access remains available even if the data-plane VDOMs are overloaded or misconfigured.

Answer

The management VDOM supports inter-VDOM routing

Answer

The management VDOM can be used to route production traffic

Answer

The management VDOM can be shared across multiple FortiGates in a HA cluster

Question 5

A network administrator is configuring FortiManager to manage multiple FortiGates with different VDOMs. The admin needs to ensure that each FortiGate's VDOMs can be independently managed. What is the correct configuration step?

Accepted Answer

Enable per-VDOM ADOM mode in FortiManager to manage each VDOM as a separate ADOM. FortiManager's per-VDOM ADOM mode allows each VDOM on a FortiGate to be treated as an independent ADOM, enabling separate management of policies, objects, and settings per VDOM. This is essential when different VDOMs serve distinct tenants or departments and must not share configuration contexts.

Answer

Use a single ADOM for all FortiGates

Answer

Configure each FortiGate as a separate device in the Global ADOM

Answer

Use the same policy package for all VDOMs

Question 6

A FortiGate administrator runs the following command and sees the output:

diagnose sys session filter dport 443
diagnose sys session list

Output shows sessions with proto=6 and expire time decreasing. What does this indicate?

Accepted Answer

The sessions are TCP sessions and are active. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.

Answer

The sessions are using UDP protocol

Answer

The FortiGate is performing deep packet inspection on these sessions

Answer

The sessions are being blocked by a firewall policy

Question 7

An administrator is configuring FortiAnalyzer to receive logs from FortiGates in a multi-VDOM environment. The admin wants to ensure that logs from each VDOM are separated into their own datasets. What must be configured?

Accepted Answer

Enable per-VDOM logging on the FortiGate and use ADOMs on FortiAnalyzer. Per-VDOM logging on the FortiGate must be enabled to tag logs with the VDOM identifier, and ADOMs on FortiAnalyzer must be configured to segregate those logs into separate datasets. Without both, logs from different VDOMs would be mixed in a single dataset, defeating the purpose of isolation.

Answer

Use the same log settings for all VDOMs

Answer

Configure a separate log disk partition for each VDOM

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Question 8

What is the purpose of a header policy in a FortiManager policy package?

Accepted Answer

To define policies that are inserted at the beginning of the policy list. A header policy in a FortiManager policy package is used to define policies that are inserted at the beginning of the policy list, before any other policies. This ensures that certain traffic matching criteria (e.g., from specific sources or to specific destinations) is evaluated first, which is critical for enforcing high-priority rules like allowlisting or blocking specific traffic before more general policies are applied.

Answer

To apply policies to the management VDOM

Answer

To create policies that bypass security profiles

Answer

To specify the name of the policy package

Question 9

A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?

Accepted Answer

Policies in both VDOMs allowing traffic to and from the inter-VDOM link. Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.

Answer

A single policy in VDOM A with destination VDOM B

Answer

A static route in VDOM A pointing to VDOM B

Answer

Disable VDOM security features

Question 10

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

Accepted Answer

The administrator is in the context of a specific VDOM. The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration. This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Answer

The VDOMs are not properly synchronized

Answer

The VDOMs are not assigned any interfaces

Answer

The FortiGate is in transparent mode

Question 11

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one

Question 12

An administrator wants to limit the number of VDOMs that can be created on a FortiGate. What should the administrator configure?

Accepted Answer

Set the 'max-vdom' option under 'config system global'. The 'max-vdom' option under 'config system global' directly limits the number of VDOMs that can be created on a FortiGate. This setting enforces a hard cap on the total VDOM count, regardless of licensing or administrative roles. By default, the value is set to 10 on most models, but it can be increased up to the maximum supported by the platform or license.

Answer

Use the 'config vdom' command to delete unused VDOMs

Answer

Configure the VDOM license on FortiManager

Answer

Set the 'vdom-admin' option to 'enable'

Question 13

A FortiGate administrator receives an error when trying to create a new VDOM: 'Maximum number of VDOMs reached.' However, the FortiGate model supports more VDOMs. What could be the issue?

Accepted Answer

The VDOM license is not installed or is expired. The error 'Maximum number of VDOMs reached' occurs when the FortiGate attempts to exceed the licensed VDOM count, even if the hardware model supports more. FortiGate VDOM licensing is enforced via a separate license file; without a valid, non-expired license, the device restricts VDOM creation to the default (often 1 or 2) or previously licensed limit. This is a common issue when a license has expired or was never installed.

Answer

The administrator is in the wrong VDOM context

Answer

The FortiGate is in transparent mode

Answer

The FortiGate needs a firmware upgrade

Question 14

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Accepted Answer

Check that there is a firewall policy in the destination VDOM allowing the return traffic. Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.

Answer

Check that NAT is enabled on the policies

Answer

Check that the inter-VDOM link is configured as a physical interface

Answer

Check that both VDOMs are in the same administrative VDOM

Question 15

An administrator is configuring FortiManager to manage a multi-VDOM FortiGate. The administrator wants to ensure that policy changes are not accidentally applied without review. Which THREE measures should be taken? (Choose three.)

Accepted Answer

Use install preview to review changes before deploying. The install preview feature in FortiManager allows administrators to review the exact policy and object changes that will be applied to the managed FortiGate before deployment. This ensures that no unintended modifications are pushed without explicit approval, which is critical in a multi-VDOM environment where changes can affect multiple virtual domains.

Answer

Use the same password for all devices

Answer

Configure meta fields to track device location