NSE7 Enterprise Firewall and VDOMs Practice Test 19 — 15 Questions

Question 1

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Check that there is a firewall policy in the destination VDOM allowing the return traffic. Inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.

Answer

Check that NAT is enabled on the policies

Answer

Check that the inter-VDOM link is configured as a physical interface

Answer

Check that both VDOMs are in the same administrative VDOM

Question 2

An administrator wants to isolate tenant traffic in a single FortiGate by creating separate virtual firewalls with independent routing tables, administrators, and policies. Which feature should the administrator use?

Accepted Answer

Virtual Domains (VDOMs). VDOMs (Virtual Domains) are the correct feature because they partition a single FortiGate into multiple independent virtual firewalls, each with its own routing table, administrator access, and security policies. This allows complete tenant isolation within one physical appliance, meeting the administrator's requirement for separate virtual firewalls with independent routing, administration, and policy control.

Answer

Policy-based routing (PBR)

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Question 3

An enterprise deploys a FortiGate in transparent mode to bridge two broadcast domains. The administrator needs to apply a web filter to HTTP traffic between these domains. Which configuration is required?

Accepted Answer

Configure a security policy with source and destination interfaces as the bridge, action ACCEPT, and a web filter profile. In transparent mode, FortiGate bridges traffic at Layer 2, so security policies must use the bridge interface as both source and destination. Option B correctly configures a security policy with source and destination interfaces set to the bridge, action ACCEPT, and a web filter profile applied. This allows the FortiGate to inspect HTTP traffic between the two broadcast domains and apply the web filter.

Answer

Apply the web filter profile directly to the bridge interface

Answer

Enable web filtering globally under Config -> Features

Answer

Create a policy with action SET_PERMIT and enable web filtering

Question 4

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The default route in VDOM-A points to a next-hop router, and VDOM-B has a static route to a subnet behind VDOM-A. Users in VDOM-B cannot reach that subnet. The administrator runs 'diagnose ip route list' in both VDOMs and sees the routes are present. What is the most likely cause?

Accepted Answer

Firewall policies are missing on the VDOMs to permit traffic between the VDOM link and the destination interfaces. Even though the routes are present in both VDOMs, inter-VDOM routing via a VDOM link requires explicit firewall policies on each VDOM to permit traffic between the VDOM link interface and the destination interface. Without these policies, the FortiGate drops the traffic at the firewall layer, even though the routing table is correct. This is a common misconfiguration because VDOM links behave like physical interfaces and are subject to firewall policy enforcement.

Answer

The VDOM link MTU is too small for the traffic

Answer

The VDOM link interfaces are administratively down

Answer

The VDOMs are in different administrative domains (ADOMs) on FortiManager

Question 5

What is the purpose of a management VDOM in a multi-VDOM FortiGate deployment?

Accepted Answer

To host the management interfaces and administrative services (GUI, SSH) while other VDOMs carry user traffic. A management VDOM is dedicated to hosting all administrative interfaces (GUI, SSH, SNMP, syslog) and management services, isolating them from user traffic VDOMs. This separation ensures that management access remains available even if a data VDOM is overloaded or compromised, and it centralizes administrative control without mixing management and data plane functions.

Answer

To route traffic between different VDOMs

Answer

To aggregate logs from all other VDOMs

Answer

To enforce inter-VDOM traffic policies centrally

Question 6

A FortiGate is managed by FortiManager. The administrator creates a new policy package for VDOM 'Sales' and installs it. Later, they find that the previous configuration has been overwritten. What should the administrator do to avoid this in the future?

Accepted Answer

Use the install preview before applying the changes. Using the install preview allows the administrator to review the exact changes that will be applied to the FortiGate before committing them. This prevents accidental overwrites by showing a diff of the configuration, enabling the administrator to verify that the new policy package will not replace existing settings unintentionally.

Answer

Set the FortiGate to backup mode

Answer

Enable auto-lock on the policy package

Answer

Enable revision history

Question 7

An administrator needs to generate a report showing top applications by bandwidth usage across all VDOMs for the last 30 days. Which FortiAnalyzer feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides pre-aggregated, real-time and historical traffic analytics, including top applications by bandwidth usage, across all VDOMs without requiring custom queries. It leverages the FortiAnalyzer’s built-in data summarization engine to display per-VDOM and cross-VDOM application usage over a specified time range, such as the last 30 days.

Answer

Playbooks

Answer

Log browsing

Answer

Incident management

Question 8

An administrator configures automation stitches on FortiManager to trigger a script when a specific event log is received. The script should block the source IP on the firewall. However, the script does not run when the event occurs. What is a likely cause?

Accepted Answer

The event handler filter does not match the log. Automation stitches on FortiManager rely on event handler filters to match specific log IDs or patterns. If the filter does not match the incoming event log (e.g., wrong log ID, incorrect field value, or mismatched severity), the trigger condition is never met, and the script will not execute. This is the most common misconfiguration when setting up event-driven automation.

Answer

The FortiGate is in transparent mode

Answer

The script is not compiled

Answer

The script is set to run on all managed devices

Question 9

What is the difference between a global ADOM and a regular ADOM in FortiManager?

Accepted Answer

Global ADOM allows sharing policy packages and objects across multiple ADOMs. In FortiManager, a Global ADOM is a special administrative domain that allows you to centrally manage and share policy packages, objects, and templates across multiple regular ADOMs. This enables consistent security policies and objects (like addresses, services, and schedules) to be pushed to all managed FortiGates, regardless of which ADOM they belong to. Regular ADOMs are isolated and cannot share objects or policies with other ADOMs, making the Global ADOM essential for large-scale, multi-tenant deployments.

Answer

Global ADOM manages only FortiGates in transparent mode

Answer

Regular ADOM cannot use meta fields

Answer

Global ADOM has unlimited device capacity

Question 10

An administrator wants to add custom fields to device objects in FortiManager to track location and contact info. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., location, contact info) that can be attached to device objects. These fields are stored in the FortiManager database and can be used for filtering, reporting, and policy mapping, providing a flexible way to enrich device metadata without modifying the device configuration itself.

Answer

System templates

Answer

Custom reports

Answer

Dynamic mapping

Question 11

A FortiGate has multiple VDOMs. The administrator notices that traffic from VDOM-1 to VDOM-2 is allowed by inter-VDOM policies but is not being inspected by the security profiles. What is the most likely cause?

Accepted Answer

The security profiles are applied only on the egress VDOM. When inter-VDOM traffic flows through a VDOM link, security profiles are applied only on the egress VDOM by default. This is because the VDOM link acts as a logical wire, and inspection occurs at the point where traffic exits the link. If the administrator has applied security profiles only on the ingress VDOM (VDOM-1), they will not be enforced on traffic leaving VDOM-1 toward VDOM-2, resulting in no inspection.

Answer

The traffic is using a bypass path due to asymmetric routing

Answer

The VDOMs are in different virtual routers

Answer

The VDOM link is configured as a signal interface

Question 12

An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)

Accepted Answer

The management VDOM can be used for FortiGuard updates. Option A is correct because in a multi-VDOM FortiGate deployment the management VDOM is specifically designed to carry out-of-band management functions, including FortiGuard update traffic (FortiGuard services such as AV/IPS signature and web-filter database downloads), which is why it is often given its own dedicated management interface and route. Option D is correct because the management VDOM is intended to host administrative access services such as HTTPS GUI and SSH, allowing administrators to log in and manage the device independently of the production VDOMs. The remaining options are incorrect: the management VDOM can still contain firewall policies (so B is false), it does not require a separate license since VDOMs are a built-in feature of the FortiGate platform (so C is false), and user traffic is not required to traverse the management VDOM—it is reserved for management-plane traffic, not data-plane forwarding (so E is false).

Answer

The management VDOM cannot have firewall policies

Answer

The management VDOM requires a separate license

Answer

All user traffic must pass through the management VDOM

Question 13

A network engineer is deploying a FortiGate in transparent mode at a branch office. The goal is to insert the firewall without changing the existing IP subnet scheme. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate acts as a Layer 2 bridge and forwards traffic based on MAC addresses. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses without modifying the IP subnet scheme. This allows the firewall to be inserted into an existing network segment without requiring IP reconfiguration of connected devices.

Answer

The FortiGate must have a unique IP subnet for each interface

Answer

Transparent mode supports all routing protocols like OSPF and BGP

Answer

NAT is required for traffic to pass through the FortiGate

Question 14

A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A firewall policy is blocking the traffic from the VDOM link to the destination. When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.

Answer

The VDOM link is in the wrong VDOM

Answer

The routing table in VDOM-1 does not have a default route

Answer

The VDOM link is not administratively up

Question 15

An organization wants to use FortiManager to manage multiple FortiGate devices. The administrator needs to ensure that each device group has separate policy and object configurations. Which FortiManager feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow you to partition the management database so that each ADOM has its own independent set of policy packages and objects. By assigning each device group to a separate ADOM, administrators ensure that policy and object configurations are isolated and cannot be shared or accidentally overwritten between groups. This directly meets the requirement for separate configurations per device group.

Answer

Policy packages with header/footer policies

Answer

Global ADOM

Answer

Meta fields