NSE7 Enterprise Firewall and VDOMs Practice Test 17 — 15 Questions

Question 1

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. The management VDOM is specifically designed to handle administrative traffic, including FortiGuard updates. By isolating FortiGuard communications to the management VDOM, administrators ensure that security updates and threat intelligence downloads do not interfere with or consume bandwidth from the data VDOMs, and they can be centrally managed from a single VDOM.

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM

Question 2

A FortiGate administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator wants to allow traffic from VDOM-A to reach a server in VDOM-B while keeping the VDOMs logically separated. Which configuration step is REQUIRED?

Accepted Answer

Create a VDOM link between VDOM-A and VDOM-B and configure firewall policies on both sides. Inter-VDOM routing on FortiGate requires a VDOM link, which is a logical interface pair that connects two VDOMs. Firewall policies must be configured on both sides of the VDOM link to explicitly allow traffic between the VDOMs, ensuring logical separation while enabling controlled communication. Without these policies, traffic will be dropped even if routes exist.

Answer

Configure a static route in VDOM-A pointing to the server's subnet via the VDOM-B gateway

Answer

Enable inter-VDOM routing under system settings globally

Answer

Assign the same physical interface to both VDOMs and configure routing

Question 3

An administrator runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is fully established and has been active for 1 hour. The output shows proto=6 (TCP) and proto_state=01, which in FortiGate's session table corresponds to TCP state ESTABLISHED. The duration=3600 indicates the session has existed for 3600 seconds (1 hour), and expire=3599 shows it will expire in 3599 seconds. This confirms the session is fully established, making option A correct.

Answer

The session will expire in 3600 seconds and has been active for 3599 seconds

Answer

The session is in a TCP SYN-SENT state and has not completed the three-way handshake

Answer

The session is using UDP on port 443

Question 4

A network engineer is deploying a FortiGate in transparent mode at a branch office. The goal is to insert the firewall without changing the existing IP subnet scheme. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate acts as a Layer 2 bridge and forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Answer

The FortiGate must have a unique IP subnet for each interface

Answer

Transparent mode supports all routing protocols like OSPF and BGP

Answer

NAT is required for traffic to pass through the FortiGate

Question 5

A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?

Accepted Answer

A firewall policy is blocking the traffic from the VDOM link to the destination. When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.

Answer

The VDOM link is in the wrong VDOM

Answer

The routing table in VDOM-1 does not have a default route

Answer

The VDOM link is not administratively up

Question 6

An organization wants to use FortiManager to manage multiple FortiGate devices. The administrator needs to ensure that each device group has separate policy and object configurations. Which FortiManager feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow you to partition the management database so that each ADOM has its own independent set of policy packages and objects. By assigning each device group to a separate ADOM, administrators ensure that policy and object configurations are isolated and cannot be shared or accidentally overwritten between groups. This directly meets the requirement for separate configurations per device group.

Answer

Policy packages with header/footer policies

Answer

Global ADOM

Answer

Meta fields

Question 7

A FortiGate administrator notices that after installing a new policy package from FortiManager, the firewall policies on the managed FortiGate do not match what was configured in FortiManager. What feature should the administrator use to review the exact changes before committing?

Accepted Answer

Install preview. Install preview, is correct because it allows the administrator to review the exact configuration changes that FortiManager will push to the managed FortiGate before the changes are committed. This feature compares the current running configuration on the FortiGate with the intended policy package in FortiManager and displays a detailed diff of additions, deletions, and modifications. It is specifically designed to prevent unexpected policy mismatches by providing a pre-commit review step.

Answer

Revision history

Answer

Device manager log

Answer

Policy consistency check

Question 8

A FortiGate administrator is configuring automation stitches in FortiManager to trigger a script when a specific log event occurs. The automation stitch includes a trigger, a set of conditions, and an action. The administrator wants the script to run only if the event is generated by devices in a specific ADOM. Which element should be configured in the trigger condition?

Accepted Answer

Add a condition for the ADOM name in the trigger. Automation stitches in FortiManager can include conditions that filter on ADOM, device group, or device name. To restrict to a specific ADOM, the condition should specify the ADOM name. This ensures only events from that ADOM trigger the action.

Answer

Configure the script to check the ADOM at runtime

Answer

Use a meta field to tag the devices and filter by meta field

Answer

Assign the automation stitch to a specific ADOM in the settings

Question 9

A FortiGate in NAT mode has multiple VDOMs. The administrator wants to centralize logging from all VDOMs to a single FortiAnalyzer. What configuration is required on the FortiGate to ensure logs from all VDOMs are sent?

Accepted Answer

Configure FortiAnalyzer logging in each VDOM individually. In a multi-VDOM FortiGate, each VDOM operates as an independent firewall with its own logging configuration. To send logs from all VDOMs to a single FortiAnalyzer, you must configure the FortiAnalyzer IP and logging settings within each VDOM individually. This ensures that each VDOM's logs are forwarded directly to the FortiAnalyzer, as there is no global or centralized log-forwarding mechanism that aggregates logs across VDOMs.

Answer

Configure the FortiAnalyzer IP under system global settings

Answer

Use the management VDOM as a log relay to FortiAnalyzer

Answer

Enable centralized logging under config log setting

Question 10

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Accepted Answer

The management VDOM can be used to manage all other VDOMs. The management VDOM in a multi-VDOM FortiGate setup is specifically designed to provide centralized management. Administrators logged into the management VDOM can use the `execute` commands or the GUI to manage all other VDOMs, including configuration changes and monitoring, without needing to log into each VDOM individually.

Answer

Traffic VDOMs cannot have any administrative access

Answer

Each VDOM must have a separate management IP address

Answer

An administrator assigned to one VDOM can automatically view configurations of other VDOMs

Question 11

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

Accepted Answer

Create separate ADOMs for each department. ADOMs (Administrative Domains) in FortiAnalyzer provide administrative isolation, allowing each department to have its own segregated management domain. This ensures that administrators assigned to a specific ADOM can only view and generate reports from logs belonging to that ADOM, enforcing strict data separation.

Answer

Configure meta fields on FortiGate objects

Answer

Enable per-device logging on FortiGate

Answer

Assign each administrator the 'super_admin' profile

Question 12

A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?

Accepted Answer

Trigger. An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch. Without a trigger, the stitch has no starting condition and cannot execute. The trigger specifies the log event that, when matched, causes the stitch to run.

Answer

Schedule

Answer

Recovery action

Question 13

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Accepted Answer

Header and footer policies can be used to enforce common rules across all policies. Header and footer policies in FortiManager allow administrators to enforce common rules across all policies in a policy package. Header policies are evaluated before the main policy set, and footer policies are evaluated after, ensuring consistent security controls such as logging or traffic shaping are applied universally without manual duplication.

Answer

Policy packages are automatically applied to the device upon creation

Answer

Policy packages cannot include NAT policies

Answer

A policy package can contain policies for different VDOMs

Question 14

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate?

Accepted Answer

The session is in FIN_WAIT_2 state. In FortiOS session diagnostics, the 'proto_state' field displays a hexadecimal value representing the TCP state. The value 0x0a (decimal 10) corresponds to the TCP FIN_WAIT_2 state. TIME_WAIT corresponds to 0x0b, not 0x0a. Therefore, the session is in FIN_WAIT_2 state. An excessive number of sessions in FIN_WAIT_2 may indicate that remote peers are not properly closing connections.

Answer

The session has been reset

Answer

The session is in TIME_WAIT state

Answer

The session is actively transferring data

Answer

The session is in SYN_RECEIVED state

Question 15

A FortiGate administrator wants to use FortiManager to push configuration changes to a managed FortiGate. To ensure changes are applied correctly, the administrator wants to review the exact CLI commands that will be sent. Which TWO tools can be used for this purpose?

Accepted Answer

Install preview. The Install Preview feature in FortiManager generates a detailed list of the exact CLI commands that will be pushed to the managed FortiGate during an installation. This allows the administrator to review and verify the changes before they are applied, ensuring accuracy and preventing unintended configuration errors.

Answer

Device manager dashboard

Answer

Policy consistency check

Answer

ADOM lock