NSE7 Enterprise Firewall and VDOMs Practice Test 17 — 15 Questions

Question 1

A FortiGate administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator wants to allow traffic from VDOM-A to reach a server in VDOM-B while keeping the VDOMs logically separated. Which configuration step is REQUIRED?

Accepted Answer

Create a VDOM link between VDOM-A and VDOM-B and configure firewall policies on both sides. Inter-VDOM routing on FortiGate requires a VDOM link, which is a logical interface pair that connects two VDOMs. Firewall policies must be configured on both sides of the VDOM link to explicitly allow traffic between the VDOMs, ensuring logical separation while enabling controlled communication. Without these policies, traffic will be dropped even if routes exist.

Answer

Configure a static route in VDOM-A pointing to the server's subnet via the VDOM-B gateway

Answer

Enable inter-VDOM routing under system settings globally

Answer

Assign the same physical interface to both VDOMs and configure routing

Question 2

An administrator runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in a TCP SYN-SENT state and has not completed the three-way handshake. The output shows 'proto=6' (TCP) and 'proto_state=01', which in FortiGate's session table corresponds to TCP state SYN-SENT (the first step of the three-way handshake). The 'duration=3600' indicates the session has existed for 3600 seconds, but 'expire=3599' shows it will expire in 3599 seconds because the handshake was never completed. This confirms the session is not fully established, making option C correct.

Answer

The session is fully established and has been active for 1 hour

Answer

The session will expire in 3600 seconds and has been active for 3599 seconds

Answer

The session is using UDP on port 443

Question 3

A network engineer is deploying a FortiGate in transparent mode at a branch office. The goal is to insert the firewall without changing the existing IP subnet scheme. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate acts as a Layer 2 bridge and forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Answer

The FortiGate must have a unique IP subnet for each interface

Answer

Transparent mode supports all routing protocols like OSPF and BGP

Answer

NAT is required for traffic to pass through the FortiGate

Question 4

A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking the traffic from the VDOM link to the destination. When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.

Answer

The VDOM link is in the wrong VDOM

Answer

The routing table in VDOM-1 does not have a default route

Answer

The VDOM link is not administratively up

Question 5

An organization wants to use FortiManager to manage multiple FortiGate devices. The administrator needs to ensure that each device group has separate policy and object configurations. Which FortiManager feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Option B is correct. Administrative Domains (ADOMs) allow logical separation of devices, policies, and objects. Each ADOM can have its own policy packages and object databases, ensuring isolation between groups.

Answer

Policy packages with header/footer policies

Answer

Global ADOM

Answer

Meta fields

Question 6

A FortiGate administrator notices that after installing a new policy package from FortiManager, the firewall policies on the managed FortiGate do not match what was configured in FortiManager. What feature should the administrator use to review the exact changes before committing?

Accepted Answer

Install preview. Option C, Install preview, is correct because it allows the administrator to review the exact configuration changes that FortiManager will push to the managed FortiGate before the changes are committed. This feature compares the current running configuration on the FortiGate with the intended policy package in FortiManager and displays a detailed diff of additions, deletions, and modifications. It is specifically designed to prevent unexpected policy mismatches by providing a pre-commit review step.

Answer

Revision history

Answer

Device manager log

Answer

Policy consistency check

Question 7

A FortiGate administrator is configuring automation stitches in FortiManager to trigger a script when a specific log event occurs. The automation stitch includes a trigger, a set of conditions, and an action. The administrator wants the script to run only if the event is generated by devices in a specific ADOM. Which element should be configured in the trigger condition?

Accepted Answer

Add a condition for the ADOM name in the trigger. Option A is correct. Automation stitches in FortiManager can include conditions that filter on ADOM, device group, or device name. To restrict to a specific ADOM, the condition should specify the ADOM name. This ensures only events from that ADOM trigger the action.

Answer

Configure the script to check the ADOM at runtime

Answer

Use a meta field to tag the devices and filter by meta field

Answer

Assign the automation stitch to a specific ADOM in the settings

Question 8

A FortiGate in NAT mode has multiple VDOMs. The administrator wants to centralize logging from all VDOMs to a single FortiAnalyzer. What configuration is required on the FortiGate to ensure logs from all VDOMs are sent?

Accepted Answer

Configure FortiAnalyzer logging in each VDOM individually. In a multi-VDOM FortiGate, each VDOM operates as an independent firewall with its own logging configuration. To send logs from all VDOMs to a single FortiAnalyzer, you must configure the FortiAnalyzer IP and logging settings within each VDOM individually. This ensures that each VDOM's logs are forwarded directly to the FortiAnalyzer, as there is no global or centralized log-forwarding mechanism that aggregates logs across VDOMs.

Answer

Configure the FortiAnalyzer IP under system global settings

Answer

Use the management VDOM as a log relay to FortiAnalyzer

Answer

Enable centralized logging under config log setting

Question 9

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Accepted Answer

The management VDOM can be used to manage all other VDOMs. Option A is correct because the management VDOM in a multi-VDOM FortiGate setup is specifically designed to provide centralized management. Administrators logged into the management VDOM can use the `execute` commands or the GUI to manage all other VDOMs, including configuration changes and monitoring, without needing to log into each VDOM individually.

Answer

Traffic VDOMs cannot have any administrative access

Answer

Each VDOM must have a separate management IP address

Answer

An administrator assigned to one VDOM can automatically view configurations of other VDOMs

Question 10

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

Accepted Answer

Create separate ADOMs for each department. Option B is correct because ADOMs (Administrative Domains) in FortiAnalyzer provide administrative isolation, allowing each department to have its own segregated management domain. This ensures that administrators assigned to a specific ADOM can only view and generate reports from logs belonging to that ADOM, enforcing strict data separation.

Answer

Configure meta fields on FortiGate objects

Answer

Enable per-device logging on FortiGate

Answer

Assign each administrator the 'super_admin' profile

Question 11

A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?

Accepted Answer

Trigger. Option A is correct because an automation stitch in FortiManager requires a trigger to define the event that initiates the stitch. Without a trigger, the stitch has no starting condition and cannot execute. The trigger specifies the log event that, when matched, causes the stitch to run.

Answer

Schedule

Answer

Recovery action

Question 12

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Accepted Answer

Header and footer policies can be used to enforce common rules across all policies. Options A and C are correct. Policy packages can be shared across multiple devices of the same type (e.g., FortiGate) within the same ADOM. Header and footer policies allow common policy rules (like logging or NAT) to be applied consistently across all policies in the package.

Answer

Policy packages are automatically applied to the device upon creation

Answer

Policy packages cannot include NAT policies

Answer

A policy package can contain policies for different VDOMs

Question 13

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate? (Select TWO.)

Accepted Answer

The session is in FIN_WAIT_2 state. In FortiOS, the 'proto_state=0a' value in session diagnostics indicates the session is in the TCP FIN_WAIT_2 state (hex 0x0a = decimal 10). This state occurs after the local side has sent a FIN and received an ACK, but is still waiting for the remote side to close its connection. It is a normal part of TCP connection teardown, but an excessive number of sessions in this state can indicate that the remote peer is not properly closing connections, potentially contributing to slow performance due to resource exhaustion.

Answer

The session has been reset

Answer

The session is actively transferring data

Answer

The session is in SYN_RECEIVED state

Question 14

A FortiGate administrator wants to use FortiManager to push configuration changes to a managed FortiGate. To ensure changes are applied correctly, the administrator wants to review the exact CLI commands that will be sent. Which TWO tools can be used for this purpose?

Accepted Answer

Install preview. Option C is correct because the Install Preview feature in FortiManager generates a detailed list of the exact CLI commands that will be pushed to the managed FortiGate during an installation. This allows the administrator to review and verify the changes before they are applied, ensuring accuracy and preventing unintended configuration errors.

Answer

Device manager dashboard

Answer

Policy consistency check

Answer

ADOM lock

Question 15

A FortiGate administrator is configuring a multi-VDOM deployment. The administrator wants to use a single physical interface for multiple VDOMs. Which TWO methods allow this?

Accepted Answer

Use NP6 virtual interfaces (e.g., virtual wire) on supported models. Option B is correct because on supported FortiGate models with NP6 processors, you can create NP6 virtual interfaces (e.g., virtual wire pairs) that allow a single physical interface to be shared across multiple VDOMs without VLAN tagging. Option C is correct because VLAN subinterfaces can be created on a physical interface and each subinterface assigned to a different VDOM, enabling multi-VDOM use of the same physical port.

Answer

Use the same physical interface in multiple VDOMs directly

Answer

Create a software switch interface and assign it to multiple VDOMs

Answer

Configure inter-VDOM routing to share the same IP subnet