NSE7 Enterprise Firewall and VDOMs Practice Test 20 — 15 Questions

Question 1

A FortiGate administrator notices that after installing a new policy package from FortiManager, the firewall policies on the managed FortiGate do not match what was configured in FortiManager. What feature should the administrator use to review the exact changes before committing?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install preview. Install preview, is correct because it allows the administrator to review the exact configuration changes that FortiManager will push to the managed FortiGate before the changes are committed. This feature compares the current running configuration on the FortiGate with the intended policy package in FortiManager and displays a detailed diff of additions, deletions, and modifications. It is specifically designed to prevent unexpected policy mismatches by providing a pre-commit review step.

Answer

Revision history

Answer

Device manager log

Answer

Policy consistency check

Question 2

A FortiGate administrator is deploying a multi-VDOM setup for a service provider. The provider wants each customer VDOM to have its own administrative access, yet the overall device management (including firmware upgrades) should be centralized from the management VDOM. Which TWO statements are true regarding administrative VDOMs?

Accepted Answer

The management VDOM can be used to manage all other VDOMs. Option A is correct because in a multi-VDOM FortiGate, the management VDOM is specifically designed to centrally administer and manage all other VDOMs, allowing the provider to oversee the entire device from one administrative domain. Option D is correct because device-level functions such as firmware upgrades, global settings, and system-wide operations are handled by the management VDOM, which is why centralized device management is possible. Option B is incorrect because traffic VDOMs can be configured with administrative access (for example, HTTPS, SSH, or Telnet on their interfaces) so each customer can manage its own VDOM. Option C is incorrect because a separate management IP address per VDOM is not mandatory; administrative access can be enabled on existing interfaces, and the management VDOM itself provides centralized access. Option E is incorrect because administrators are scoped to their assigned VDOM and cannot automatically view other VDOMs' configurations unless they have the appropriate multi-VDOM or super-admin privileges.

Answer

Traffic VDOMs cannot have any administrative access

Answer

Each VDOM must have a separate management IP address

Answer

An administrator assigned to one VDOM can automatically view configurations of other VDOMs

Question 3

A FortiGate administrator is configuring a multi-VDOM deployment. The administrator wants to use a single physical interface for multiple VDOMs. Which TWO methods allow this?

Accepted Answer

Use NP6 virtual interfaces (e.g., virtual wire) on supported models. Option C is correct because a physical interface can be partitioned into VLAN subinterfaces (e.g., port1.10, port1.20), and each subinterface can be assigned to a different VDOM, allowing one physical port to serve multiple VDOMs. Option B is correct because on NP6-accelerated FortiGate models, NP6 virtual interfaces such as virtual wire pairs (and NP6 vlinks) can be created and mapped into different VDOMs, letting a single physical NP6 interface be shared across VDOMs. Option A is incorrect because a physical interface can belong to only one VDOM at a time; it cannot be directly assigned to multiple VDOMs. Option D is incorrect because a software switch is a single interface object that resides in one VDOM and cannot be assigned to multiple VDOMs simultaneously. Option E is incorrect because inter-VDOM routing is used to pass traffic between VDOMs and does not allow sharing the same physical interface or the same IP subnet across VDOMs.

Answer

Use the same physical interface in multiple VDOMs directly

Answer

Create a software switch interface and assign it to multiple VDOMs

Answer

Configure inter-VDOM routing to share the same IP subnet

Question 4

A company uses FortiManager to manage multiple FortiGates. The admin wants to use a global ADOM to manage certain policies across all devices while allowing local customization. Which two statements about global ADOM are true? (Choose two.)

Accepted Answer

Header/footer policies can only be configured in the global ADOM. Header and footer policies are global constructs that can only be created and managed within the global ADOM. These policies are automatically applied to all policy packages across all regular ADOMs, ensuring consistent enforcement at the top and bottom of the policy list without local modification.

Answer

Global ADOM supports per-device policy objects

Answer

Global ADOM requires a separate FortiManager license

Answer

Global ADOM policies are installed on all managed FortiGates in all ADOMs

Question 5

A FortiGate admin configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. The admin wants traffic from VDOM-A to reach a server in VDOM-B. Which three configuration steps are required? (Choose three.)

Accepted Answer

Configure static routes pointing to the VDOM link interface on both VDOMs. Option E is correct because a VDOM link must first be created and its two ends (interfaces) assigned to VDOM-A and VDOM-B, which provides the physical/logical path for inter-VDOM traffic. Option B is correct because each VDOM needs a static route whose destination is the remote subnet and whose gateway/interface is the local VDOM link interface, so traffic is forwarded across the link. Option C is correct because FortiGate security policies are required to permit traffic between interfaces, so VDOM-A needs a policy allowing traffic from its source interface to the VDOM link interface. Option A is not required because NAT is not needed for inter-VDOM routing when addressing is preserved; NAT could even break return-path routing. Option D is not required because ARP must remain enabled on the VDOM link interfaces for next-hop resolution.

Answer

Enable NAT on the VDOM link interface

Answer

Disable ARP on the VDOM link interfaces

Question 6

A FortiGate administrator needs to use FortiManager to deploy a new security policy to all firewalls in a specific ADOM. Which two steps are part of the installation process? (Choose two.)

Accepted Answer

Run the install preview to see the changes that will be applied. Option B is correct because running the install preview in FortiManager lets the administrator review exactly which policy package changes will be pushed to the managed FortiGates before committing, helping avoid unintended configuration changes. Option C is correct because the actual deployment step in FortiManager's Install Wizard requires selecting the target devices (or all devices in the ADOM) and clicking 'Install' to push the policy package to those firewalls. Option A is not part of the installation process itself; revision history is a logging/versioning feature that records changes, not a required install step. Option D is unnecessary because the scenario already specifies an existing ADOM containing the firewalls, so creating a new ADOM is not required. Option E is incorrect because automation stitches are used to trigger automated actions based on events, not to install a policy package to devices.

Answer

Configure revision history to track changes

Answer

Create a new ADOM for the policy package

Answer

Enable automation stitches to push the policy

Question 7

A FortiGate 600E is running in multi-VDOM mode with VDOM-1 and VDOM-2. The administrator assigns physical port3 to VDOM-1 as a dedicated interface, then creates a VLAN subinterface (VLAN 100) on port3 for VDOM-2. After configuration, VLAN 100 traffic is dropped even though the VLAN interface is up. Which action resolves the issue?

Accepted Answer

Create the VLAN 100 subinterface inside VDOM-1, where the parent interface resides, rather than in VDOM-2.. On FortiGate, VLAN subinterfaces inherit the VDOM membership of their parent physical interface. Because port3 is assigned to VDOM-1, VLAN 100 must also be created within VDOM-1. Creating it under VDOM-2 leaves the traffic unhandled in the VDOM that actually receives the frames, so frames are dropped.

Answer

Configure a VDOM link between VDOM-1 and VDOM-2 and route VLAN 100 traffic through the link.

Answer

Enable the vlan-forwarding setting under config system interface on port3.

Answer

Assign the physical port3 interface to VDOM-2 as well, using the same interface in both VDOMs.

Question 8

A FortiGate 600E is running in multi-VDOM mode and is managed by FortiManager. The administrator needs to assign CPU and memory resource limits to a specific VDOM so that it cannot consume more than 30% of the system's resources. Which FortiGate feature should the administrator configure?

Accepted Answer

Enable VDOM resource limits under the global system settings and assign per-VDOM CPU and memory quotas.. The correct answer is to enable VDOM resource limits and assign per-VDOM quotas. This is the only method that directly enforces CPU and memory limits on a per-VDOM basis, ensuring fair resource distribution. Other options address bandwidth, administrative access, or hardware offloading, none of which satisfy the requirement to cap CPU and memory usage.

Answer

Create a traffic shaping policy for all traffic entering and leaving the VDOM.

Answer

Assign the VDOM to a dedicated NP6 processor using NPU offload settings.

Answer

Configure a separate administrative profile that restricts the VDOM's access to system resources.

Question 9

A FortiGate 600E is running multiple VDOMs in NAT mode. The administrator wants to assign a VLAN subinterface to VDOM-A while the parent physical interface remains in the root VDOM. Which configuration step is required to accomplish this?

Accepted Answer

Create the VLAN subinterface under the physical interface in the root VDOM, then move the VLAN subinterface to VDOM-A.. VLAN subinterfaces can be individually assigned to different VDOMs while the parent interface remains in the root VDOM. The administrator must create the VLAN under the parent in root, then change the VLAN interface's VDOM assignment. This allows a single physical port to serve multiple VDOMs without moving the parent, preserving root access and other VLANs.

Answer

Use a VDOM link between root and VDOM-A and bridge the VLAN traffic across the link.

Answer

Enable VDOM partitioning on the physical interface and assign the VLAN subinterface to VDOM-A.

Answer

Assign the physical interface to VDOM-A and create the VLAN subinterface there; the root VDOM will automatically retain management access.

Question 10

A FortiGate is deployed with multiple VDOMs in NAT/route mode. The administrator has created a VDOM link between VDOM-1 and VDOM-2 and assigned IP addresses to both ends. A server in VDOM-1 (10.1.1.10/24) needs to reach a server in VDOM-2 (10.2.2.10/24). The administrator has added a static route in VDOM-1 for 10.2.2.0/24 pointing to the VDOM-2 link interface IP, and a static route in VDOM-2 for 10.1.1.0/24 pointing to the VDOM-1 link interface IP. However, traffic is not passing. Which additional configuration is required on the FortiGate to allow the traffic to flow?

Accepted Answer

Create firewall policies in VDOM-1 and VDOM-2 that allow traffic from the source subnet to the destination subnet on the respective VDOM link interfaces.. Inter-VDOM traffic is treated like traffic between two separate firewalls. Even with VDOM links and static routes in place, the implicit deny policy in each VDOM blocks the traffic. You must explicitly allow it with firewall policies in both VDOMs, specifying the source, destination, and VDOM link interface. No global setting or zone configuration can override this requirement.

Answer

Enable inter-VDOM routing globally using the command config system settings, set allow-inter-vdom-traffic enable.

Answer

Assign the VDOM link interfaces to the same zone in both VDOMs to permit traffic between them.

Answer

Configure a static route in the global routing table that points to both VDOMs, enabling inter-VDOM routing.

Question 11

A FortiGate is configured with multiple VDOMs in NAT/route mode. The administrator wants to allow a server in VDOM-A to be accessed from the internet through VDOM-B, which has the public IP address. The administrator has already created a VDOM link between VDOM-A and VDOM-B. Which additional configuration is required to make the server accessible?

Accepted Answer

Configure a VIP on VDOM-B that maps the public IP to the server's private IP, and ensure firewall policies allow the traffic in both VDOMs.. To allow external access to a server behind a FortiGate with multiple VDOMs, a VIP must be configured on the VDOM with the public IP to perform destination NAT. Firewall policies in both VDOMs must permit the traffic, and the VDOM link carries the translated packets. Without the VIP, the server would not receive the traffic correctly.

Answer

Create a firewall policy in VDOM-B that allows incoming traffic to the VDOM link interface and a policy in VDOM-A that allows traffic from the VDOM link to the server.

Answer

Create a central SNAT policy in VDOM-B to translate the public IP to the server's private IP, and apply it to the VDOM link.

Answer

Enable NAT on the VDOM link interface in VDOM-B and create a static route in VDOM-A pointing to the server.

Question 12

An administrator has a FortiGate with multiple VDOMs and a management VDOM enabled. The management VDOM is used for out-of-band management and logging. The administrator wants to ensure that the management VDOM can reach a syslog server on the Internet while all other VDOMs use a separate data VDOM for their Internet traffic. Which configuration is required to allow the management VDOM to use a different default route than the other VDOMs?

Accepted Answer

Configure a default route in the management VDOM pointing to the management gateway, and ensure that the management VDOM has its own interface with Internet connectivity.. To allow the management VDOM to use a different default route, you must configure that route within the management VDOM itself. Each VDOM has its own routing table, so a default route in one VDOM does not affect others. The management VDOM also needs its own interface with Internet reachability. This ensures management traffic uses the intended path while data VDOMs use theirs.

Answer

Use the global routing table to define a default route that applies only to the management VDOM.

Answer

Enable 'allow-subnet-overlap' in the management VDOM to permit a separate default route.

Answer

Create a policy route in the management VDOM that forwards all traffic to the data VDOM's default gateway.

Question 13

A FortiGate is deployed in multi-VDOM mode. The administrator has created VDOM-A and VDOM-B, and configured an inter-VDOM link between them. Users in VDOM-A need to access a web server in VDOM-B. The administrator has added a static route in VDOM-A for the server's subnet pointing to the VDOM link interface, and a return route in VDOM-B. Which TWO additional configurations are required to allow the traffic? (Choose two.)

Accepted Answer

A firewall policy on VDOM-A that allows traffic from the internal interface to the VDOM link interface.. Inter-VDOM traffic requires firewall policies in both the originating and destination VDOMs. In VDOM-A, a policy must allow traffic from the internal interface to the VDOM link. In VDOM-B, a policy must allow traffic from the VDOM link to the server's interface. Routing must also be correct, but the scenario already includes static routes. NAT is not required unless specified.

Answer

Configure a central SNAT policy on VDOM-B to translate the destination IP addresses.

Answer

Add a static route in VDOM-B for the user subnet pointing to the VDOM link interface.

Answer

Enable NAT on the VDOM link interface in VDOM-A to translate the source IP addresses.

Question 14

A FortiGate 600E is deployed with multiple VDOMs in NAT/route mode. The administrator assigns VLAN 100 to VDOM-A on port1 and VLAN 200 to VDOM-B on port1, then configures the VLAN interfaces as management interfaces for each VDOM. Users in VDOM-A report intermittent connectivity to servers in VDOM-B, while pings between the VLAN interface IPs fail. What is the most likely cause?

Accepted Answer

No inter-VDOM links or firewall policies exist to permit traffic between VDOM-A and VDOM-B, so the VDOMs are isolated by design.. VDOMs on a FortiGate are isolated routing and security domains. Even when VLAN subinterfaces on the same physical port are assigned to different VDOMs, traffic between those VDOMs does not flow automatically. Inter-VDOM links must be created and firewall policies must allow the traffic in both directions. The failed pings and intermittent connectivity are classic symptoms of missing inter-VDOM routing, not a limitation of VLAN coexistence or management access.

Answer

Two VLAN interfaces with management access enabled cannot coexist on the same physical interface; the second VDOM's VLAN is silently ignored.

Answer

Management access on a VLAN interface enables the administrative gateway, which overrides inter-VDOM routing and blocks data traffic.

Answer

VLAN interfaces in different VDOMs on the same physical port require the physical interface to be in a third VDOM with explicit VLAN trunking.

Question 15

An administrator has a FortiGate 600E running FortiOS 7.2 with multiple VDOMs enabled. The administrator wants to create a new VDOM named 'DMZ' and assign it a specific physical interface (port3) that is currently unused. After creating the VDOM, the administrator navigates to Network > Interfaces in the DMZ VDOM but cannot see port3 in the list of available interfaces to assign. What is the most likely reason for this?

Accepted Answer

The physical interface port3 must be assigned to a VDOM from the global configuration before it appears in the VDOM's interface list.. In a multi-VDOM FortiGate, physical interfaces belong to the global configuration by default. To use an interface within a VDOM, the administrator must explicitly assign it to that VDOM from the global VDOM settings. Until that assignment is made, the interface will not be listed in the VDOM's Network > Interfaces section, preventing configuration.

Answer

The interface port3 is currently used by another VDOM, so it is hidden until it is removed from that VDOM.

Answer

The administrator needs to reboot the FortiGate after creating the VDOM for the interface to become visible.

Answer

The administrator must enable 'VDOM mode' on the interface before it can be seen in the VDOM.