NSE7 Enterprise Firewall and VDOMs Practice Test 16 — 15 Questions

Question 1

An administrator wants to isolate tenant traffic in a single FortiGate by creating separate virtual firewalls with independent routing tables, administrators, and policies. Which feature should the administrator use?

Accepted Answer

Virtual Domains (VDOMs). VDOMs (Virtual Domains) are the correct feature because they partition a single FortiGate into multiple independent virtual firewalls, each with its own routing table, administrator access, and security policies. This allows complete tenant isolation within one physical appliance, meeting the administrator's requirement for separate virtual firewalls with independent routing, administration, and policy control.

Answer

Policy-based routing (PBR)

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Question 2

An enterprise deploys a FortiGate in transparent mode to bridge two broadcast domains. The administrator needs to apply a web filter to HTTP traffic between these domains. Which configuration is required?

Accepted Answer

Configure a security policy with source and destination interfaces as the bridge, action ACCEPT, and a web filter profile. In transparent mode, FortiGate bridges traffic at Layer 2, so security policies must use the bridge interface as both source and destination. Option B correctly configures a security policy with source and destination interfaces set to the bridge, action ACCEPT, and a web filter profile applied. This allows the FortiGate to inspect HTTP traffic between the two broadcast domains and apply the web filter.

Answer

Apply the web filter profile directly to the bridge interface

Answer

Enable web filtering globally under Config -> Features

Answer

Create a policy with action SET_PERMIT and enable web filtering

Question 3

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The default route in VDOM-A points to a next-hop router, and VDOM-B has a static route to a subnet behind VDOM-A. Users in VDOM-B cannot reach that subnet. The administrator runs 'diagnose ip route list' in both VDOMs and sees the routes are present. What is the most likely cause?

Accepted Answer

Firewall policies are missing on the VDOMs to permit traffic between the VDOM link and the destination interfaces. Even though the routes are present in both VDOMs, inter-VDOM routing via a VDOM link requires explicit firewall policies on each VDOM to permit traffic between the VDOM link interface and the destination interface. Without these policies, the FortiGate drops the traffic at the firewall layer, even though the routing table is correct. This is a common misconfiguration because VDOM links behave like physical interfaces and are subject to firewall policy enforcement.

Answer

The VDOM link MTU is too small for the traffic

Answer

The VDOM link interfaces are administratively down

Answer

The VDOMs are in different administrative domains (ADOMs) on FortiManager

Question 4

What is the purpose of a management VDOM in a multi-VDOM FortiGate deployment?

Accepted Answer

To host the management interfaces and administrative services (GUI, SSH) while other VDOMs carry user traffic. A management VDOM is dedicated to hosting all administrative interfaces (GUI, SSH, SNMP, syslog) and management services, isolating them from user traffic VDOMs. This separation ensures that management access remains available even if a data VDOM is overloaded or compromised, and it centralizes administrative control without mixing management and data plane functions.

Answer

To route traffic between different VDOMs

Answer

To aggregate logs from all other VDOMs

Answer

To enforce inter-VDOM traffic policies centrally

Question 5

A FortiGate is managed by FortiManager. The administrator creates a new policy package for VDOM 'Sales' and installs it. Later, they find that the previous configuration has been overwritten. What should the administrator do to avoid this in the future?

Accepted Answer

Use the install preview before applying the changes. Option C is correct because using the install preview allows the administrator to review the exact changes that will be applied to the FortiGate before committing them. This prevents accidental overwrites by showing a diff of the configuration, enabling the administrator to verify that the new policy package will not replace existing settings unintentionally.

Answer

Set the FortiGate to backup mode

Answer

Enable auto-lock on the policy package

Answer

Enable revision history

Question 6

An administrator needs to generate a report showing top applications by bandwidth usage across all VDOMs for the last 30 days. Which FortiAnalyzer feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides pre-aggregated, real-time and historical traffic analytics, including top applications by bandwidth usage, across all VDOMs without requiring custom queries. It leverages the FortiAnalyzer’s built-in data summarization engine to display per-VDOM and cross-VDOM application usage over a specified time range, such as the last 30 days.

Answer

Playbooks

Answer

Log browsing

Answer

Incident management

Question 7

An administrator configures automation stitches on FortiManager to trigger a script when a specific event log is received. The script should block the source IP on the firewall. However, the script does not run when the event occurs. What is a likely cause?

Accepted Answer

The event handler filter does not match the log. Option A is correct because automation stitches on FortiManager rely on event handler filters to match specific log IDs or patterns. If the filter does not match the incoming event log (e.g., wrong log ID, incorrect field value, or mismatched severity), the trigger condition is never met, and the script will not execute. This is the most common misconfiguration when setting up event-driven automation.

Answer

The FortiGate is in transparent mode

Answer

The script is not compiled

Answer

The script is set to run on all managed devices

Question 8

What is the difference between a global ADOM and a regular ADOM in FortiManager?

Accepted Answer

Global ADOM allows sharing policy packages and objects across multiple ADOMs. In FortiManager, a Global ADOM is a special administrative domain that allows you to centrally manage and share policy packages, objects, and templates across multiple regular ADOMs. This enables consistent security policies and objects (like addresses, services, and schedules) to be pushed to all managed FortiGates, regardless of which ADOM they belong to. Regular ADOMs are isolated and cannot share objects or policies with other ADOMs, making the Global ADOM essential for large-scale, multi-tenant deployments.

Answer

Global ADOM manages only FortiGates in transparent mode

Answer

Regular ADOM cannot use meta fields

Answer

Global ADOM has unlimited device capacity

Question 9

An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.

Answer

System templates

Answer

Custom reports

Answer

Dynamic mapping

Question 10

A FortiGate has multiple VDOMs. The administrator notices that traffic from VDOM-1 to VDOM-2 is allowed by inter-VDOM policies but is not being inspected by the security profiles. What is the most likely cause?

Accepted Answer

The security profiles are applied only on the egress VDOM. When inter-VDOM traffic flows through a VDOM link, security profiles are applied only on the egress VDOM by default. This is because the VDOM link acts as a logical wire, and inspection occurs at the point where traffic exits the link. If the administrator has applied security profiles only on the ingress VDOM (VDOM-1), they will not be enforced on traffic leaving VDOM-1 toward VDOM-2, resulting in no inspection.

Answer

The traffic is using a bypass path due to asymmetric routing

Answer

The VDOMs are in different virtual routers

Answer

The VDOM link is configured as a signal interface

Question 11

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. The output shows `duration=3600` and `expire=3599`, meaning the session was established 3600 seconds (1 hour) ago and has 3599 seconds remaining before timeout. The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session is active and will expire in about 1 hour from the current time, making option C correct.

Answer

The session is a TCP session that has been idle for 1 hour

Answer

The session is a UDP flow

Answer

The session is in a half-open state

Question 12

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

To apply policies at the top and bottom of the policy list that are not affected by reordering within the package. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list. These policies remain fixed in position and are not affected by any reordering operations performed on the regular policies within the package, ensuring that critical security controls (e.g., deny-all or allow-specific traffic) are always enforced in the correct order.

Answer

To separate IPv4 and IPv6 policies

Answer

To create backup policies

Answer

To define policies that are only used during installation

Question 13

An administrator needs to configure a FortiGate to allow inter-VDOM routing between VDOM-1 and VDOM-2. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure firewall policies on each VDOM to permit traffic across the VDOM link. Option A is correct because inter-VDOM routing requires explicit firewall policies on each VDOM to control and permit traffic traversing the VDOM link. Without these policies, the FortiGate will drop the traffic at the VDOM boundary, even if the VDOM link is up and IP addresses are configured.

Answer

Disable NAT on all policies

Answer

Enable inter-VDOM routing under system settings

Answer

Assign an IP address to the VDOM link in only one VDOM

Question 14

A FortiGate is deployed in multi-VDOM mode. The administrator wants to use FortiAnalyzer to centralize logging from all VDOMs. Which THREE steps must be performed? (Choose three.)

Accepted Answer

Ensure that the FortiAnalyzer can reach the FortiGate's management IP. Option B is correct because the FortiAnalyzer must be able to reach the FortiGate's management IP to establish the logging connection. In multi-VDOM mode, the management VDOM handles all management traffic, including FortiAnalyzer communication, so reachability to that specific IP is essential for centralized logging.

Answer

Enable log forwarding on the management VDOM only

Answer

Enable 'log-all-vdoms' feature on the FortiGate

Question 15

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. Option A is correct because the management VDOM is specifically designed to handle administrative traffic, including FortiGuard updates. By isolating FortiGuard communications to the management VDOM, administrators ensure that security updates and threat intelligence downloads do not interfere with or consume bandwidth from the data VDOMs, and they can be centrally managed from a single VDOM.

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM