NSE7 Enterprise Firewall and VDOMs Practice Test 15 — 15 Questions

Question 1

An administrator configures inter-VDOM routing between VDOMs A and B. Both VDOMs are on the same FortiGate. The admin creates a policy allowing traffic from VDOM A to VDOM B. Traffic from VDOM A to VDOM B fails. What is the most likely cause?

Accepted Answer

There is no firewall policy in VDOM B to allow the return traffic. In a FortiGate inter-VDOM routing setup, traffic initiated from VDOM A to VDOM B requires a firewall policy in VDOM B to permit the return traffic. Without this policy, the FortiGate's stateful inspection engine drops the return packets because no session exists in VDOM B's session table. This is a common misconfiguration where administrators only create a policy in the source VDOM.

Answer

VDOM A and VDOM B must be in the same administrative VDOM

Answer

The VDOMs are in transparent mode

Answer

The inter-VDOM link is not configured

Question 2

A FortiGate is operating in transparent mode. Which of the following statements is true about this mode?

Accepted Answer

The FortiGate operates as a Layer 2 device and does not require IP addresses on its interfaces. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding frames based on MAC addresses without modifying them. It does not require IP addresses on its interfaces for traffic forwarding, though management IP addresses can be assigned. This allows the FortiGate to be inserted into an existing network segment without reconfiguring IP subnets.

Answer

The FortiGate does not modify the MAC addresses of packets

Answer

The FortiGate can route between different VLANs

Answer

The FortiGate can perform NAT

Question 3

An administrator configures a FortiGate with a management VDOM. Which of the following is true about the management VDOM?

Accepted Answer

The management VDOM cannot have any firewall policies. The management VDOM is a special-purpose VDOM used exclusively for out-of-band management traffic (e.g., GUI, SSH, SNMP). It operates in a separate management plane and cannot contain firewall policies because it is not designed to inspect or forward data-plane traffic. This isolation ensures that management access remains available even if the data-plane VDOMs are overloaded or misconfigured.

Answer

The management VDOM supports inter-VDOM routing

Answer

The management VDOM can be used to route production traffic

Answer

The management VDOM can be shared across multiple FortiGates in a HA cluster

Question 4

A network administrator is configuring FortiManager to manage multiple FortiGates with different VDOMs. The admin needs to ensure that each FortiGate's VDOMs can be independently managed. What is the correct configuration step?

Accepted Answer

Enable per-VDOM ADOM mode in FortiManager to manage each VDOM as a separate ADOM. Option A is correct because FortiManager's per-VDOM ADOM mode allows each VDOM on a FortiGate to be treated as an independent ADOM, enabling separate management of policies, objects, and settings per VDOM. This is essential when different VDOMs serve distinct tenants or departments and must not share configuration contexts.

Answer

Use a single ADOM for all FortiGates

Answer

Configure each FortiGate as a separate device in the Global ADOM

Answer

Use the same policy package for all VDOMs

Question 5

A FortiGate administrator runs the following command and sees the output:

diagnose sys session filter dport 443
diagnose sys session list

Output shows sessions with proto=6 and expire time decreasing. What does this indicate?

Accepted Answer

The sessions are TCP sessions and are active. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.

Answer

The sessions are using UDP protocol

Answer

The FortiGate is performing deep packet inspection on these sessions

Answer

The sessions are being blocked by a firewall policy

Question 6

An administrator is configuring FortiAnalyzer to receive logs from FortiGates in a multi-VDOM environment. The admin wants to ensure that logs from each VDOM are separated into their own datasets. What must be configured?

Accepted Answer

Enable per-VDOM logging on the FortiGate and use ADOMs on FortiAnalyzer. Option A is correct because per-VDOM logging on the FortiGate must be enabled to tag logs with the VDOM identifier, and ADOMs on FortiAnalyzer must be configured to segregate those logs into separate datasets. Without both, logs from different VDOMs would be mixed in a single dataset, defeating the purpose of isolation.

Answer

Use the same log settings for all VDOMs

Answer

Configure a separate log disk partition for each VDOM

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Question 7

What is the purpose of a header policy in a FortiManager policy package?

Accepted Answer

To define policies that are inserted at the beginning of the policy list. A header policy in a FortiManager policy package is used to define policies that are inserted at the beginning of the policy list, before any other policies. This ensures that certain traffic matching criteria (e.g., from specific sources or to specific destinations) is evaluated first, which is critical for enforcing high-priority rules like allowlisting or blocking specific traffic before more general policies are applied.

Answer

To apply policies to the management VDOM

Answer

To create policies that bypass security profiles

Answer

To specify the name of the policy package

Question 8

A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?

Accepted Answer

Policies in both VDOMs allowing traffic to and from the inter-VDOM link. Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.

Answer

A single policy in VDOM A with destination VDOM B

Answer

A static route in VDOM A pointing to VDOM B

Answer

Disable VDOM security features

Question 9

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

Accepted Answer

The administrator is in the context of a specific VDOM. The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration. This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Answer

The VDOMs are not properly synchronized

Answer

The VDOMs are not assigned any interfaces

Answer

The FortiGate is in transparent mode

Question 10

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. Automation stitches in FortiManager allow administrators to define a set of actions triggered by specific events (e.g., high CPU, failed login). These actions can include running CLI scripts, sending SNMP traps, or email notifications. Stitches enable automated responses to network events.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one

Question 11

An administrator wants to limit the number of VDOMs that can be created on a FortiGate. What should the administrator configure?

Accepted Answer

Set the 'max-vdom' option under 'config system global'. The 'max-vdom' option under 'config system global' directly limits the number of VDOMs that can be created on a FortiGate. This setting enforces a hard cap on the total VDOM count, regardless of licensing or administrative roles. By default, the value is set to 10 on most models, but it can be increased up to the maximum supported by the platform or license.

Answer

Use the 'config vdom' command to delete unused VDOMs

Answer

Configure the VDOM license on FortiManager

Answer

Set the 'vdom-admin' option to 'enable'

Question 12

A FortiGate administrator receives an error when trying to create a new VDOM: 'Maximum number of VDOMs reached.' However, the FortiGate model supports more VDOMs. What could be the issue?

Accepted Answer

The VDOM license is not installed or is expired. The error 'Maximum number of VDOMs reached' occurs when the FortiGate attempts to exceed the licensed VDOM count, even if the hardware model supports more. FortiGate VDOM licensing is enforced via a separate license file; without a valid, non-expired license, the device restricts VDOM creation to the default (often 1 or 2) or previously licensed limit. This is a common issue when a license has expired or was never installed.

Answer

The administrator is in the wrong VDOM context

Answer

The FortiGate is in transparent mode

Answer

The FortiGate needs a firmware upgrade

Question 13

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Accepted Answer

Check that there is a firewall policy in the destination VDOM allowing the return traffic. Option B is correct because inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.

Answer

Check that NAT is enabled on the policies

Answer

Check that the inter-VDOM link is configured as a physical interface

Answer

Check that both VDOMs are in the same administrative VDOM

Question 14

An administrator is configuring FortiManager to manage a multi-VDOM FortiGate. The administrator wants to ensure that policy changes are not accidentally applied without review. Which THREE measures should be taken? (Choose three.)

Accepted Answer

Use install preview to review changes before deploying. To prevent accidental deployment, the administrator should use revision history to track changes, enable install preview to review changes before applying, and use ADOM locking to prevent multiple administrators from making concurrent changes. These features provide control and visibility.

Answer

Use the same password for all devices

Answer

Configure meta fields to track device location

Question 15

A FortiGate administrator wants to use FortiAnalyzer to generate reports on traffic patterns for each VDOM separately. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable per-VDOM logging on the FortiGate. Option C is correct because per-VDOM logging must be enabled on the FortiGate to allow each VDOM to generate its own independent log stream. Without this setting, all VDOMs share a single log stream, making it impossible to separate traffic patterns per VDOM on FortiAnalyzer. Option E is correct because log forwarding from each VDOM to FortiAnalyzer is required to send the per-VDOM logs to the FortiAnalyzer for reporting.

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Answer

Disable logging on the FortiGate system

Answer

Create separate ADOMs for each VDOM on FortiAnalyzer