NSE7 Enterprise Firewall and VDOMs Practice Test 15 — 15 Questions

Question 1

A FortiGate administrator configures inter-VDOM routing. Traffic from VDOM-A to VDOM-B is blocked. The administrator checks the policy in VDOM-A allowing traffic to the VDOM link interface. What else must be verified?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

That there is a corresponding policy in VDOM-B allowing traffic from the VDOM link to the destination. In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Answer

That the VDOM link uses a different interface type

Answer

That the VDOM link interface is in the same subnet

Answer

That inter-VDOM routing is enabled in system settings

Question 2

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 3

What is the function of FortiAnalyzer in a Fortinet Security Fabric?

Accepted Answer

To collect logs and generate reports and incidents. FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Answer

To manage VDOM configurations

Answer

To act as a VPN concentrator

Answer

To provide real-time firewall management

Question 4

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Option C is correct because Fortinet best practice for multi-VDOM deployments is to create a dedicated management VDOM so that administrative access, management interfaces, and management traffic are isolated from production VDOMs, improving security and operational clarity. Option D is correct because each VDOM maintains its own independent configuration, including its own administrator accounts, authentication, and access profiles, allowing delegated administration per VDOM. Option A is incorrect because FortiGate models have platform-specific maximum VDOM limits (for example, entry-level units support fewer VDOMs than high-end chassis), so VDOMs are not unlimited. Option B is incorrect because each VDOM has its own independent routing table and can run its own routing protocols. Option E is incorrect because VDOMs can operate in NAT/route mode or transparent mode, so transparent mode is supported per VDOM.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode

Question 5

An administrator configures FortiManager automation stitches to respond to high CPU usage on a FortiGate. The stitch should trigger a script to run diagnostics. Which THREE components are required in an automation stitch?

Accepted Answer

Trigger (e.g., event type). An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch, such as a high CPU usage event. The trigger specifies the event type (e.g., 'CPU Usage High') that the FortiGate reports, which then activates the stitch. Without a trigger, the automation stitch has no starting point to respond to the condition.

Answer

Condition (e.g., severity threshold)

Answer

Result (e.g., email notification)

Question 6

A FortiGate administrator wants to use FortiAnalyzer to view traffic logs from multiple VDOMs. Which TWO steps must the administrator perform on FortiAnalyzer?

Accepted Answer

Add the FortiGate as a device in FortiAnalyzer. Option B is correct because FortiAnalyzer can only receive, index, and display logs from a FortiGate after that FortiGate has been added as a managed device (via the device registration/authorization process), which establishes the log-receiving relationship. Option D is correct because the FortiGate must be configured to send its logs to FortiAnalyzer, typically by enabling logging to FortiAnalyzer under config log fortianalyzer setting and pointing it at the FortiAnalyzer IP, so that traffic logs from all VDOMs are actually transmitted. Options A and E are incorrect because FortiAnalyzer is a log management and analytics appliance, not a traffic-inspecting firewall, so it does not require security profiles or a built-in firewall to view logs. Option C is incorrect because a single ADOM can contain the FortiGate and its multiple VDOMs; separate ADOMs per VDOM are not required to view multi-VDOM traffic logs.

Answer

Install a security profile on FortiAnalyzer

Answer

Create a separate ADOM for each VDOM

Answer

Enable FortiAnalyzer's built-in firewall

Question 7

An administrator configures inter-VDOM routing between VDOMs A and B using a VDOM link. The administrator can ping from VDOM A to an interface in VDOM B, but traffic from VDOM B to VDOM A times out. What is the most likely cause?

Accepted Answer

The route back to the source subnet is missing in VDOM A. Inter-VDOM routing requires a route in both directions. Since the administrator can ping from VDOM A to VDOM B, the forward path works, but the return traffic from VDOM B to VDOM A fails due to a missing route back to the source subnet in VDOM A. This is a classic asymmetric routing issue where the destination VDOM (A) does not know how to reach the source subnet of VDOM B.

Answer

VDOM B has no traffic VDOM capability

Answer

The firewall policy in VDOM B is blocking traffic

Answer

The VDOM link's MTU is set too high

Question 8

Which FortiManager feature allows an administrator to roll back a policy package to a previous version?

Accepted Answer

Revision history. FortiManager's Revision History feature automatically creates a versioned snapshot of policy packages each time they are installed or modified. Administrators can browse prior revisions and revert to any previous version, restoring the exact policy state. This is the built-in rollback mechanism for policy packages.

Answer

Install preview

Answer

Device manager

Answer

Automation stitch

Question 9

An administrator wants to use FortiManager to manage multiple FortiGates, each in a separate customer environment. The administrator needs to isolate configuration changes per customer and ensure each customer's admin can only see their own devices. What FortiManager feature should be used?

Accepted Answer

Administrative domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow the administrator to logically partition the management plane, isolating configuration changes per customer. Each ADOM can contain a set of FortiGates, and administrators assigned to an ADOM can only see and manage devices within that ADOM, ensuring strict separation of customer environments.

Answer

Administrator profiles

Answer

Policy packages

Answer

VDOMs on managed FortiGates

Question 10

An administrator configures a VDOM link between VDOMs A and B. In VDOM A, the VDOM link interface is assigned IP 10.10.10.1/24, and in VDOM B, it is assigned 10.10.10.2/24. A firewall policy on VDOM A allows traffic from a subnet in VDOM A to a subnet in VDOM B. However, traffic fails. The admin checks the routing table in VDOM A and sees a route to the destination subnet via 10.10.10.2. What is the most likely cause?

Accepted Answer

No firewall policy in VDOM B to allow traffic from the VDOM link. In a VDOM link configuration, traffic must be permitted by firewall policies on both VDOMs. Even though VDOM A has a policy allowing traffic to the destination subnet and a valid route via 10.10.10.2, VDOM B must have a policy that allows traffic from the VDOM link interface to reach the destination subnet. Without this policy, VDOM B will drop the packets, causing the traffic failure.

Answer

The VDOM link is not administratively up in VDOM B

Answer

Inter-VDOM routing is disabled globally

Answer

The subnet in VDOM B is not defined as an address object in VDOM A's policy

Question 11

A FortiGate has two VDOMs: Root and CustomerA. The administrator wants to manage the CustomerA VDOM from FortiManager. What must be configured on FortiManager to allow management of the CustomerA VDOM?

Accepted Answer

Add the FortiGate's VDOM to an ADOM. FortiManager uses Administrative Domains (ADOMs) to logically group and manage VDOMs. To manage the CustomerA VDOM, the administrator must add that specific VDOM to an ADOM on FortiManager, which then allows FortiManager to push policies, objects, and configuration to that VDOM. Without this mapping, FortiManager cannot target the VDOM for management, even if the FortiGate itself is registered.

Answer

Configure an automation stitch on FortiManager

Answer

Add the FortiGate to the global ADOM

Answer

Enable VDOM management on FortiGate

Question 12

Which FortiAnalyzer feature allows an administrator to create a sequence of automated response actions triggered by a specific log event?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define a sequence of automated response actions that are triggered by specific log events. This feature enables event-driven automation, such as executing CLI scripts, sending alerts, or integrating with external systems via webhooks, directly from the FortiAnalyzer interface.

Answer

Reports

Answer

Incidents

Answer

FortiView

Question 13

A FortiGate in an HA cluster with VDOMs enabled experiences a failover. After the failover, traffic that was passing before is now being dropped. The configuration is synchronized between the primary and secondary units. What is the most likely reason?

Accepted Answer

Session synchronization is not enabled between HA members. The most likely reason is that session synchronization is not enabled between HA members. When a failover occurs, the new primary FortiGate does not have the existing session table entries from the original primary, so it treats incoming packets as new connections and may drop them if they do not match a firewall policy's initial handshake state. Even though the configuration is synchronized, session information is not shared unless session synchronization is explicitly configured, causing traffic to be dropped after failover.

Answer

The new primary has a different VDOM configuration

Answer

The firewall policies are not synchronized

Answer

VDOM link interfaces are down on the new primary

Question 14

In FortiAnalyzer, which tool provides real-time traffic monitoring and allows drilling down into details such as top talkers, applications, and threats?

Accepted Answer

FortiView. FortiView in FortiAnalyzer provides real-time traffic monitoring with drill-down capabilities into top talkers, applications, and threats. It aggregates data from FortiGate logs and presents it in an interactive dashboard, allowing administrators to identify and investigate network anomalies instantly without generating reports.

Answer

Reports

Answer

Incidents

Answer

Log Viewer

Question 15

An administrator is troubleshooting why a new firewall policy on a managed FortiGate is not taking effect. The policy was created in FortiManager and installed successfully. Which TWO steps should the administrator verify to identify the issue? (Select TWO.)

Accepted Answer

Check if the policy is disabled. Option C is correct because a policy that exists in FortiManager and installs successfully can still be administratively disabled on the managed FortiGate, in which case it will never match traffic; the administrator should confirm the policy's status is enabled. Option D is correct because firewall policies are evaluated top-down and the first matching policy wins, so if a broader or conflicting policy appears above the new policy in the policy list, the new policy will never be hit; verifying its position in the order is essential. Option A is not appropriate because rebooting the FortiGate does not resolve a policy configuration or ordering problem and would only cause unnecessary downtime. Option B is not the right focus because routing determines whether traffic reaches the FortiGate and which interface/next-hop is used, but the scenario states the policy itself is not taking effect, not that traffic is failing to route. Option E is not relevant because HA status affects failover and session synchronization, not whether a specific installed policy matches traffic.

Answer

Reboot the FortiGate

Answer

Review the FortiGate's routing table

Answer

Verify the FortiGate's HA status