NSE7 Enterprise Firewall and VDOMs Practice Test 17 — 15 Questions

Question 1

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Verify that the FortiGate can reach the FortiAnalyzer IP address and that the FortiAnalyzer service is running. The 'disconnected' status indicates that the FortiGate cannot establish a TCP connection to the FortiAnalyzer. The first step is to verify basic Layer 3 reachability (ping) and that the FortiAnalyzer service is listening on the default port (TCP 514 or 3000 for encrypted). Without confirming these, further troubleshooting is premature.

Answer

Check the FortiGate's DNS resolution for the FortiAnalyzer hostname

Answer

Restart the FortiGate's logging service

Answer

Disable and re-enable logging to FortiAnalyzer

Question 2

A FortiGate admin configures a firewall policy with an antivirus profile in flow-based inspection mode. The admin notices that some large files are being scanned but others are allowed without scanning. What is the most likely cause?

Accepted Answer

The FortiGate's antivirus buffer size is exceeded, causing some files to bypass scanning. In flow-based inspection, FortiGate uses a buffer to reassemble files before scanning. When a file exceeds the configured antivirus buffer size (default 1 MB for flow-based), the FortiGate cannot buffer the entire file for scanning and allows it to pass without inspection. This explains why some large files bypass scanning while smaller ones are scanned.

Answer

The antivirus signatures are outdated

Answer

The antivirus profile has an exemption for certain file types

Answer

Flow-based inspection cannot scan files larger than 10 MB

Question 3

A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)

Accepted Answer

Trigger. An automation stitch in FortiManager requires a Trigger to define the event that initiates the stitch (e.g., an intrusion prevention event) and an Action to specify the response (e.g., blocking an IP address via a firewall address object). The Trigger monitors for specific log messages or system events, while the Action executes the configured remediation step. Without both, the stitch cannot be created or function.

Answer

Playbook

Answer

Destination

Answer

Schedule

Question 4

An enterprise FortiGate has multiple VDOMs. The security policy requires that all traffic between VDOMs must be inspected by a next-generation firewall profile. Which three steps are necessary to achieve this? (Choose three.)

Accepted Answer

Ensure routing is properly configured to forward traffic through the inter-VDOM link. For traffic to traverse between VDOMs via an inter-VDOM link, proper routing must be configured in each VDOM to forward traffic through the inter-VDOM link interface. Without correct routing entries (static or dynamic), packets will not be directed to the inter-VDOM link, and the next-generation firewall profile cannot be applied.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Enable VDOM inspection mode in global settings

Question 5

A network administrator is troubleshooting a scenario where FortiView in FortiAnalyzer shows no traffic data for a specific FortiGate, but logs are being received. Which two possible causes should the administrator investigate? (Choose two.)

Accepted Answer

The FortiGate is not sending traffic logs; only event logs are being forwarded. Option C is correct because FortiView visualizations are built from traffic (forward) logs, so if the FortiGate only forwards event logs and no traffic logs, FortiAnalyzer will show received logs but no traffic data in FortiView. Option D is correct because if the FortiView log database (the SQL/traffic log database used for FortiView aggregation) is corrupted or requires a rebuild, FortiAnalyzer can still receive logs while FortiView fails to display traffic data until the database is repaired or rebuilt. Option A is not the cause because clock skew typically affects log timestamps and correlation, not the complete absence of FortiView traffic data when logs are arriving. Option B is not the cause because a global ADOM affects ADOM scope and policy/object visibility, not whether FortiView renders traffic logs for a FortiGate. Option E is not the cause because a full disk would generally prevent or impair log reception/indexing broadly, whereas the scenario states logs are being received.

Answer

The FortiGate's clock is not synchronized with FortiAnalyzer

Answer

The FortiAnalyzer ADOM is configured as a global ADOM

Answer

The FortiAnalyzer disk is full and not indexing new logs

Question 6

An administrator needs to isolate customer traffic in a FortiGate deployed at a service provider. Each customer should have independent administrators and security policies. Which feature should be used?

Accepted Answer

Virtual domains (VDOMs). Virtual domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own administrators, security policies, routing tables, and interfaces. This is the correct feature for isolating customer traffic at a service provider because it provides complete administrative and policy separation per customer, which VLAN interfaces alone cannot achieve.

Answer

VLAN interfaces

Answer

Policy packages

Answer

Administrative domains (ADOMs)

Question 7

A FortiGate running FortiOS 7.4.1 has two VDOMs: CustomerA and CustomerB. The administrator wants CustomerA to access an HTTP server in CustomerB. Both VDOMs have appropriate policies. What additional configuration is required?

Accepted Answer

Configure a VDOM link between CustomerA and CustomerB. A VDOM link is required to enable Layer-2 or Layer-3 connectivity between two VDOMs on the same FortiGate. Without a VDOM link, the VDOMs are isolated from each other, even if policies exist. The VDOM link acts as a virtual interface pair that forwards traffic between CustomerA and CustomerB, allowing the HTTP server access.

Answer

Create a policy allowing traffic from CustomerA to CustomerB

Answer

Enable inter-VDOM routing under system settings

Answer

Assign both VDOMs to the same administrative domain in FortiManager

Question 8

A network admin needs to apply a common set of firewall rules at the beginning of every policy package for all VDOMs managed by FortiManager. The rules should be automatically inserted and not editable within each VDOM. What should be configured?

Accepted Answer

Policy package header policies. Policy package header policies in FortiManager allow administrators to define a set of firewall policies that are automatically inserted at the top of every policy package for all VDOMs, and they are not editable within each VDOM. This enforces a common baseline of rules across managed devices.

Answer

VDOM policy templates

Answer

Global policy objects

Answer

Central management policies

Question 9

A FortiGate in transparent mode is deployed between a router and a switch. The administrator needs to apply a deep inspection profile to HTTP traffic. What is the correct configuration for the interfaces?

Accepted Answer

Configure a management IP on the VDOM and apply the inspection profile to the policy. In transparent mode, FortiGate acts as a Layer 2 bridge, so interfaces do not require IP addresses. Deep inspection of HTTP traffic is applied via a firewall policy that references a deep inspection profile, and a management IP must be configured on the VDOM to allow the FortiGate to participate in management traffic (e.g., DNS, NTP, or proxy operations). Option A correctly identifies that the management IP is set on the VDOM and the inspection profile is applied to the policy.

Answer

Place both interfaces in the same VDOM and enable DHCP

Answer

Switch to NAT mode to enable deep inspection

Answer

Assign IPs to both interfaces and create a policy from LAN to WAN

Question 10

An administrator configures a new ADOM in FortiManager for a set of FortiGates. The administrator wants to assign meta fields to devices in this ADOM. Where should the meta fields be defined?

Accepted Answer

Device Manager -> ADOM settings. Meta fields in FortiManager are defined at the ADOM level under Device Manager -> ADOM settings. This ensures that the custom fields are available for all devices within that specific ADOM, allowing consistent metadata assignment across managed FortiGates. Defining them elsewhere, such as in global database objects, would apply them globally rather than per-ADOM, which is not the administrator's intent.

Answer

Policy & Objects -> Object configurations

Answer

System settings -> Admin

Answer

Global database objects

Question 11

An organization uses FortiManager to manage multiple FortiGates. A junior admin accidentally deleted a critical firewall policy on one device and the change was auto-installed. How can the senior admin revert the device to the previous configuration?

Accepted Answer

Go to Device Manager -> Revision History and restore the previous revision. FortiManager automatically stores configuration revisions for managed FortiGates. By navigating to Device Manager -> Revision History, the admin can select the previous revision and restore it, which reverts the device to its state before the accidental deletion. This process ensures the change is undone without manual intervention or affecting other devices.

Answer

Delete the ADOM and recreate it

Answer

Use the 'restore' command on FortiManager

Answer

Manually recreate the policy on the FortiGate

Question 12

An administrator needs to view real-time traffic logs and top applications for a specific VDOM on FortiAnalyzer. Which tool should be used?

Accepted Answer

FortiView. FortiView is the correct tool because it provides real-time traffic logs and top applications per VDOM on FortiAnalyzer. It uses live data streams from FortiGate logs to display current network activity, allowing administrators to filter by VDOM and view metrics like top applications, sources, and destinations without running a report or script.

Answer

Playbooks

Answer

Incident Management

Answer

Reports

Question 13

A multi-tenant FortiGate uses VDOMs. The administrator notices that logins via SSH to the management VDOM succeed, but attempts to SSH to a traffic VDOM's management IP fail. The traffic VDOM has an administrative user configured. What is the most likely cause?

Accepted Answer

SSH access is not enabled on the traffic VDOM's management interface. SSH access to a VDOM's management IP requires that the management interface explicitly permits SSH administrative access. In a multi-tenant FortiGate with VDOMs, each VDOM's management interface has its own independent administrative access settings. Even if the admin user exists and the VDOM is licensed, SSH will be rejected if the management interface does not have SSH access enabled under config system interface or via the GUI. The fact that SSH to the management VDOM succeeds but fails to the traffic VDOM's management IP points directly to this per-interface access control.

Answer

The traffic VDOM does not have a license

Answer

The traffic VDOM is in transparent mode

Answer

The admin user is not in the correct trust group

Question 14

A network administrator is configuring VDOMs on a FortiGate and wants to separate management traffic from production data traffic. What is the best practice when using a management VDOM?

Accepted Answer

Create a dedicated management VDOM and assign only management interfaces to it. Creating a dedicated management VDOM and assigning only management interfaces to it is the best practice because it isolates management traffic from production data traffic, reducing the attack surface and preventing management access from being exposed to untrusted networks. This aligns with Fortinet's security best practices for VDOM administration, ensuring that management functions are logically separated from data-plane operations.

Answer

Disable management access on all VDOMs except the root VDOM

Answer

Use inter-VDOM routing to route management traffic to the root VDOM

Answer

Assign all interfaces to the management VDOM

Question 15

An administrator deploys a FortiGate in transparent mode within a Layer 2 network. They apply a firewall policy with an antivirus profile to inspect traffic between two VLANs. What is a key characteristic of transparent mode that affects policy application?

Accepted Answer

Traffic is forwarded based on MAC addresses, and policies are applied transparently without changing the IP path. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This allows firewall policies, including antivirus inspection, to be applied to traffic between VLANs without modifying the IP path or requiring NAT, ensuring seamless integration into existing Layer 2 networks.

Answer

NAT is automatically applied to all traffic to preserve private IP addresses

Answer

Firewall policies are applied only to traffic entering the management interface

Answer

Each VDOM in transparent mode requires a unique IP address for management