NSE7 Enterprise Firewall and VDOMs Practice Test 16 — 15 Questions

Question 1

A network admin is deploying a FortiGate in transparent mode to inspect traffic between two Layer 2 switches. Which of the following statements about transparent mode is correct?

Accepted Answer

Transparent mode requires an IP address on each interface for management purposes. In transparent mode, FortiGate acts as a Layer 2 bridge and does not require IP addresses on its interfaces for forwarding traffic. However, to manage the device (e.g., via SSH, HTTPS, or SNMP), an IP address must be assigned to each interface or to a management VLAN. This allows administrative access while the firewall remains invisible to the Layer 2 network. Option B correctly identifies this requirement.

Answer

Transparent mode can only inspect traffic in one VLAN

Answer

Transparent mode supports NAT policies

Answer

Transparent mode requires VDOMs to be enabled

Question 2

An admin creates a VDOM named 'CustomerA' with inter-VDOM link to the management VDOM. The admin wants CustomerA administrators to manage only their own VDOM. Which configuration step is required?

Accepted Answer

Create a new administrator and set the 'VDOM' field to 'CustomerA' and assign a profile with appropriate permissions. To restrict a VDOM administrator to manage only their own VDOM, you must create a new administrator account and explicitly set the 'VDOM' field to that VDOM (e.g., 'CustomerA') and assign a profile with the necessary permissions. This ensures the admin's scope is limited to that VDOM, preventing access to the management VDOM or other VDOMs.

Answer

Use the 'config system admin' command and set trusthost to the admin's IP

Answer

Place the management VDOM and CustomerA in different administrative domains (ADOMs) in FortiManager

Answer

Enable admin-role override in the VDOM settings

Question 3

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

They define policies that are placed at the top (header) and bottom (footer) of the policy list when applied to a FortiGate. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list when the package is installed on a FortiGate. This ensures that critical policies, such as default deny rules or inter-VDOM links, remain in a fixed position regardless of other policy changes. This mechanism is essential for maintaining a consistent security posture across managed FortiGates.

Answer

They are used for VDOM-specific policies that cannot be modified

Answer

They provide a way to group policies for reporting purposes

Answer

They allow policy packages to be installed in a specific sequence

Question 4

An admin configures a FortiManager ADOM for a customer with multiple FortiGates. The admin wants to use meta fields to group firewalls by location. After defining a meta field 'Location' and assigning values to devices, where can the admin use the meta field for policy targeting?

Accepted Answer

In the installation target of a policy package, the admin can filter devices by meta field values. In FortiManager, meta fields are used within ADOM-level policy packages to filter devices during installation targeting. This allows the admin to select only FortiGates with a specific 'Location' meta field value, enabling policy targeting based on location without manual device grouping.

Answer

Meta fields are automatically synced to FortiGate and used in firewall policies

Answer

In the ADOM level policy package, meta fields are used as variables in policy names

Answer

Meta fields are only used for generating reports in FortiAnalyzer

Question 5

Which of the following is a required step when enabling VDOMs on a FortiGate for the first time?

Accepted Answer

Reboot the FortiGate after enabling VDOMs. When enabling VDOMs on a FortiGate for the first time, the device must be rebooted to restructure the internal data plane and control plane to support multiple virtual domains. This reboot is mandatory because the firmware transitions from a single-VDOM mode to a multi-VDOM mode, which requires reinitializing kernel structures and memory allocation for VDOM-specific resources.

Answer

Create at least two VDOMs before enabling the VDOM feature

Answer

Disable all firewall policies

Answer

Configure inter-VDOM routing

Question 6

In a FortiManager deployment with global ADOM enabled, an administrator creates a firewall policy in the global ADOM. What is the effect of this policy on the per-ADOM devices?

Accepted Answer

The policy is installed as a header policy on all managed FortiGates. In FortiManager, when global ADOM is enabled, policies created in the global ADOM are automatically installed as header policies on all managed FortiGates across all ADOMs. Header policies are evaluated before per-ADOM policies, allowing global enforcement of rules. This ensures consistent security posture across the entire managed estate.

Answer

The policy is used only if no per-ADOM policy exists with the same name

Answer

The policy is applied only to devices in the same ADOM as the global ADOM

Answer

The policy is ignored unless explicitly assigned to each ADOM

Question 7

What is the purpose of FortiAnalyzer in a Fortinet security fabric?

Accepted Answer

To collect and analyze logs, generate reports, and provide visibility into security events. FortiAnalyzer is the centralized logging and analytics platform within the Fortinet Security Fabric. It aggregates logs from FortiGate and other Fabric devices, correlates events, generates compliance reports, and provides a single-pane-of-glass view for security monitoring and forensic analysis. This directly supports visibility and reporting, not real-time threat prevention or configuration management.

Answer

To provide sandboxing and advanced threat protection

Answer

To act as a network firewall and IPS

Answer

To manage and deploy configurations to FortiGates

Question 8

An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?

Accepted Answer

Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'. Inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.

Answer

Place both VDOMs in the same VDOM group

Answer

Configure a static route in each VDOM pointing to the other VDOM's management IP

Answer

Enable VDOM forwarding in global settings

Question 9

A network administrator is deploying a FortiGate in transparent mode to replace an existing layer 2 switch. Which statement about transparent mode is true?

Accepted Answer

All interfaces operate at layer 2, and the FortiGate forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding traffic based on MAC addresses without performing routing. All interfaces are in the same broadcast domain, and the FortiGate inspects traffic at layers 3–7 while remaining transparent to the network. This allows it to replace a layer 2 switch while adding firewall functionality.

Answer

Transparent mode only supports static routing

Answer

Transparent mode requires VDOMs to be enabled

Answer

The FortiGate acts as a router and requires IP addresses on its interfaces

Question 10

An admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session is established and has been active for 1 hour. The output shows `proto=6` (TCP), `proto_state=01` (ESTABLISHED in Fortinet's session table), `duration=3600` seconds (1 hour), and `expire=3599` seconds (remaining lifetime). This combination indicates a fully established TCP session that has been active for one hour and is still valid, not blocked or in a transitional state.

Answer

The session is being blocked by a firewall policy

Answer

The session is in SYN_SENT state, waiting for a reply

Answer

The session is in TIME_WAIT state after a FIN

Question 11

A FortiManager administrator wants to push a policy package that includes both global header/footer policies and VDOM-specific policies. Which statement about header/footer policies is correct?

Accepted Answer

Header policies are inserted before the VDOM's own policies; footer policies are appended after. In FortiManager, when a policy package includes both global header/footer policies and VDOM-specific policies, the header policies are inserted before the VDOM's own policies in the policy table, while footer policies are appended after them. This ensures that header policies are evaluated first for traffic matching, and footer policies serve as a catch-all or default set of rules at the end of the VDOM policy list.

Answer

Header/footer policies are only available when using per-device mapping

Answer

Header/footer policies can only be configured directly on the FortiGate, not via FortiManager

Answer

Header/footer policies are automatically generated and cannot be manually edited

Question 12

Which FortiAnalyzer feature allows administrators to create automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected?

Accepted Answer

Playbooks. Playbooks in FortiAnalyzer allow administrators to define automated response actions triggered by specific log events, such as blocking an IP address when an intrusion is detected. This feature uses a visual workflow editor to chain conditions and actions (e.g., executing CLI commands via FortiGate API or sending alerts) based on real-time log analysis, enabling automated threat mitigation without manual intervention.

Answer

FortiView

Answer

Reports

Answer

Incidents

Question 13

A FortiGate administrator wants to use FortiManager to manage multiple FortiGates in different geographic regions. To isolate configuration changes, the administrator creates separate ADOMs for each region. Which type of ADOM should be used to allow some common objects (like address groups) to be shared across all regions?

Accepted Answer

Global ADOM. The Global ADOM is designed to store and share common objects, such as address groups, policies, and schedules, across all ADOMs in a FortiManager deployment. When an administrator creates separate ADOMs for each region, the Global ADOM acts as a central repository for objects that need to be consistent everywhere, allowing per-region ADOMs to reference these shared objects without duplicating them. This ensures configuration isolation for region-specific settings while maintaining a single source of truth for global resources.

Answer

Per-Device ADOM

Answer

Regular ADOM

Answer

Meta ADOM

Question 14

Which FortiManager feature allows administrators to view the exact configuration changes that would be applied to a managed FortiGate before committing them?

Accepted Answer

Install preview. Install preview is the correct answer because it allows administrators to see the exact CLI commands that will be pushed to a managed FortiGate during the next install operation, without actually applying them. This feature provides a diff-like view of the configuration changes, enabling validation before committing changes to production devices.

Answer

Revision history

Answer

Device manager

Answer

Policy checker

Question 15

A FortiGate has two VDOMs: 'root' and 'customer'. The admin wants to route traffic from 'customer' to the internet via 'root', which has a BGP connection to an ISP. What is the required configuration?

Accepted Answer

Create an inter-VDOM link between 'customer' and 'root', and configure policies to allow traffic. Inter-VDOM links are the only supported method for routing traffic between VDOMs on the same FortiGate. An inter-VDOM link creates a virtual point-to-point connection between two VDOMs, allowing traffic to flow through firewall policies. Without this link, VDOMs are isolated and cannot exchange traffic, even if static routes or BGP are configured.

Answer

Enable VDOM forwarding on the WAN interface in 'root'

Answer

Configure a static route in 'customer' pointing to the 'root' VDOM's management IP

Answer

Place both VDOMs in the same VDOM group and enable route leak