NSE7 Enterprise Firewall and VDOMs Practice Test 18 — 15 Questions

Question 1

A FortiGate running FortiOS 7.2 has multiple VDOMs. The administrator notices that inter-VDOM routing between two VDOMs is not working. Configuration shows a firewall policy allowing the traffic, and the route table shows routes to the destination VDOM. What additional configuration is required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a VDOM link interface pair and assign them to the respective VDOMs. Inter-VDOM routing requires a VDOM link, which is a pair of logical interfaces (one in each VDOM) that are directly connected. Without this link, the VDOMs cannot exchange traffic even if firewall policies and routes exist, because they operate as separate virtual firewalls with isolated forwarding tables.

Answer

Configure a static route with a gateway IP in the destination VDOM

Answer

Assign an IP address to the VLAN interface on the source VDOM

Answer

Enable 'inter-vdom' under config system global

Question 2

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

A TCP session on port 443 has been active for 1 hour and will expire in 3599 seconds. The output shows a TCP session (proto=6) on port 443 with a duration of 3600 seconds (1 hour) and an expire value of 3599 seconds, meaning the session has been active for 1 hour and will expire in 3599 seconds. The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP established state, confirming an active TCP session.

Answer

The session has expired and is being removed

Answer

A UDP session on port 443 is being blocked

Answer

The firewall policy is incorrectly configured

Question 3

A company uses FortiManager to manage multiple FortiGate firewalls. After making changes to a policy package, the administrator runs an install preview and sees a warning: 'Policy ID 10 will be deleted on device XYZ'. What is the most likely reason for this warning?

Accepted Answer

Policy ID 10 was manually added on the device but is not present in the policy package. The warning 'Policy ID 10 will be deleted on device XYZ' indicates that the policy package on FortiManager does not contain Policy ID 10, but the device currently has it. During an install, FortiManager synchronizes the device's policy set with the policy package, so any policy present on the device but absent from the package is flagged for deletion. This is a standard consistency check to prevent unintended policy loss.

Answer

The policy package has been corrupted and needs to be re-imported

Answer

The device is in a different ADOM and cannot use the same policy ID

Answer

A revision history conflict exists that prevents the install

Question 4

An administrator configures FortiAnalyzer to receive logs from multiple FortiGates. They want to create a report that shows only incidents involving 'critical' severity and specific attack types. Which FortiAnalyzer feature allows the administrator to define such a custom report?

Accepted Answer

Report datasets and charts. FortiAnalyzer's reporting engine uses datasets and charts to define custom reports. Datasets are SQL-like queries that extract specific log data, and charts visualize that data. By creating a dataset that filters for 'critical' severity and specific attack types, and then adding it to a report, the administrator can generate the desired custom report. Other features like incident management, playbooks, and FortiView dashboards are for real-time monitoring and automated response, not custom report generation.

Answer

Incident management

Answer

Playbooks

Answer

FortiView dashboards

Question 5

In a multi-VDOM deployment, what is the purpose of inter-VDOM routing?

Accepted Answer

To allow traffic to pass between different VDOMs via firewall policies. Inter-VDOM routing allows traffic to be forwarded between different VDOMs on the same FortiGate unit. This is achieved by configuring inter-VDOM links (IVL) or using VDOM peering, and then applying firewall policies to control and secure the traffic flow between VDOMs. Option C correctly identifies that firewall policies are the mechanism used to permit or deny inter-VDOM traffic.

Answer

To route traffic between the management VDOM and data VDOMs

Answer

To provide redundancy for VDOMs in an HA setup

Answer

To connect VDOMs to external routers

Question 6

A FortiGate administrator wants to use FortiManager automation stitches to automatically block an IP address when a specific threat is detected. Which components must be configured within the automation stitch?

Accepted Answer

A trigger, at least one action, and optionally conditions. An automation stitch in FortiManager requires a trigger (e.g., an event or log match) to start the workflow, at least one action (e.g., a CLI script to block an IP via firewall address creation), and optionally conditions to filter when the trigger fires. This three-part structure is mandatory because the trigger defines the event, the action executes the response, and conditions provide granular control without which the stitch would fire on every trigger occurrence.

Answer

A trigger and a connector to an external threat feed

Answer

An action only, since the trigger is predefined

Answer

A schedule and a script

Question 7

In FortiManager, what is the purpose of header and footer policies in a policy package?

Accepted Answer

To ensure specific policies are always placed at the top (header) or bottom (footer) of the policy list. Header and footer policies in FortiManager are special policy types that enforce a fixed position within the policy list. Header policies are always placed at the top (before all other policies), and footer policies are always placed at the bottom (after all other policies). This ensures that critical security rules, such as default-deny or global allow rules, remain in their intended position regardless of policy package changes or reordering operations.

Answer

To create policy groups for better organization

Answer

To apply policies only during specific times of the day

Answer

To separate IPv4 and IPv6 policies

Question 8

An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?

Accepted Answer

Trigger. In FortiAnalyzer playbooks, the essential building blocks are the trigger, conditions, and actions. Option A (Trigger) is correct because a playbook must have an event source that initiates execution, such as a new log, incident, or event detected by FortiAnalyzer. Option C (Conditions) is correct because conditions define the matching logic or filters that determine whether the playbook should run and which path it follows. Option E (Actions) is correct because actions specify the automated response steps the playbook performs, such as sending notifications, running CLI scripts, or creating incidents. Option B (A report schedule) is not required, since reports are separate scheduled outputs and do not drive playbook execution. Option D (A dashboard visualization) is not required, because dashboards are for display and monitoring, not for the functional logic of a playbook.

Answer

A report schedule

Answer

A dashboard visualization

Question 9

A FortiGate administrator is troubleshooting an issue where IPsec VPN traffic is not being forwarded correctly in a multi-VDOM environment. Which TWO factors should the administrator verify?

Accepted Answer

The firewall policy for the VPN traffic is present in the correct VDOM. A is correct because firewall policies are VDOM-scoped; even if the VPN tunnel is up, traffic will not be forwarded unless a policy explicitly permits it within the VDOM that owns the VPN interface. The administrator must verify that the policy allowing the IPsec traffic exists in the correct VDOM, as policies from one VDOM cannot control traffic in another.

Answer

Inter-VDOM routing is enabled globally

Answer

The management VDOM has an IPsec policy

Answer

The FortiGate is in transparent mode

Question 10

A FortiGate administrator runs the following command and sees the output:

diagnose sys session filter dport 443
diagnose sys session list

Output shows sessions with proto=6 and expire time decreasing. What does this indicate?

Accepted Answer

The sessions are TCP sessions and are active. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443, and 'diagnose sys session list' displays them. The output shows 'proto=6', which is the protocol number for TCP (per IANA protocol numbers). The 'expire time decreasing' indicates that the session timer is counting down, which is normal behavior for an active TCP session that is being refreshed by ongoing traffic. Therefore, the sessions are TCP and active.

Answer

The sessions are using UDP protocol

Answer

The FortiGate is performing deep packet inspection on these sessions

Answer

The sessions are being blocked by a firewall policy

Question 11

An administrator is configuring FortiAnalyzer to receive logs from FortiGates in a multi-VDOM environment. The admin wants to ensure that logs from each VDOM are separated into their own datasets. What must be configured?

Accepted Answer

Enable per-VDOM logging on the FortiGate and use ADOMs on FortiAnalyzer. Per-VDOM logging on the FortiGate must be enabled to tag logs with the VDOM identifier, and ADOMs on FortiAnalyzer must be configured to segregate those logs into separate datasets. Without both, logs from different VDOMs would be mixed in a single dataset, defeating the purpose of isolation.

Answer

Use the same log settings for all VDOMs

Answer

Configure a separate log disk partition for each VDOM

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Question 12

What is the purpose of a header policy in a FortiManager policy package?

Accepted Answer

To define policies that are inserted at the beginning of the policy list. A header policy in a FortiManager policy package is used to define policies that are inserted at the beginning of the policy list, before any other policies. This ensures that certain traffic matching criteria (e.g., from specific sources or to specific destinations) is evaluated first, which is critical for enforcing high-priority rules like allowlisting or blocking specific traffic before more general policies are applied.

Answer

To apply policies to the management VDOM

Answer

To create policies that bypass security profiles

Answer

To specify the name of the policy package

Question 13

A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?

Accepted Answer

Policies in both VDOMs allowing traffic to and from the inter-VDOM link. Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.

Answer

A single policy in VDOM A with destination VDOM B

Answer

A static route in VDOM A pointing to VDOM B

Answer

Disable VDOM security features

Question 14

An administrator configures a FortiGate with VDOMs and notices that the 'config vdom' command lists multiple VDOMs, but only one VDOM is shown in the 'show full-configuration' output. What is the most likely reason?

Accepted Answer

The administrator is in the context of a specific VDOM. The 'config vdom' command lists all VDOMs configured on the FortiGate because it operates in the global context. However, 'show full-configuration' only displays the configuration of the current VDOM context. If the administrator is inside a specific VDOM (e.g., after executing 'config vdom' and 'edit <vdom-name>'), the output is scoped to that VDOM, not the global configuration. This is a fundamental behavior of VDOM-based CLI navigation in FortiOS.

Answer

The VDOMs are not properly synchronized

Answer

The VDOMs are not assigned any interfaces

Answer

The FortiGate is in transparent mode

Question 15

In FortiManager, what is the purpose of an automation stitch?

Accepted Answer

To trigger automated actions based on predefined events. An automation stitch in FortiManager is a sequence of automated actions triggered by a predefined event, such as a log message, SNMP trap, or schedule. It allows administrators to define a set of actions (e.g., run a script, send an alert, or change a policy) that execute in response to specific conditions, streamlining incident response and network management without manual intervention.

Answer

To combine multiple ADOMs into a single management domain

Answer

To automatically deploy configuration changes to devices

Answer

To stitch together multiple policy packages into one