NSE7 Enterprise Firewall and VDOMs Practice Test 21 — 15 Questions

Question 1

An administrator is deploying a FortiGate with multiple VDOMs in NAT/route mode. The administrator needs to configure inter-VDOM routing between VDOM-A and VDOM-B. Which two actions are required to enable traffic to flow between the two VDOMs? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure firewall policies in each VDOM to allow traffic from the source to the destination through the VDOM link.. Inter-VDOM routing requires a VDOM link to provide the Layer 3 connection, and firewall policies in both VDOMs to permit the traffic. The VDOM link acts as a virtual cable between the two VDOMs, and each VDOM must have a policy allowing traffic from the source to the destination via that link. Without both, traffic is blocked by the implicit deny.

Answer

Configure a static route in the global routing table pointing to both VDOMs.

Answer

Enable inter-VDOM routing globally using the command 'config system global' and set 'inter-vdom-routing enable'.

Answer

Assign the same VDOM ID to both VDOMs to allow routing between them.

Question 2

An administrator has a FortiGate with multiple VDOMs in NAT mode. The administrator wants to configure a global policy that applies to all VDOMs to block traffic from a known malicious IP block. Which statement is correct about global policies?

Accepted Answer

Global policies are configured in the global VDOM and are evaluated before VDOM-specific policies.. Global policies are configured at the global level and are evaluated before any VDOM-specific policies. This allows an administrator to enforce a uniform security rule, such as blocking a malicious IP block, across all VDOMs without duplicating the policy in each VDOM. They can be used in both NAT and transparent mode VDOMs and can allow or deny traffic.

Answer

Global policies are only evaluated after VDOM-specific policies, and they can only deny traffic.

Answer

Global policies require that all VDOMs are in transparent mode.

Answer

Global policies can only be applied to traffic entering the management VDOM.

Question 3

An administrator is configuring a FortiGate in multi-VDOM mode. The administrator wants to assign a physical interface to a non-management VDOM. The interface currently belongs to the root VDOM and has an IP address. What must the administrator do first?

Accepted Answer

Remove the IP address and any references from the root VDOM, then assign the interface to the target VDOM.. To move a physical interface from one VDOM to another, the interface must not have an IP address or be referenced in any configuration, such as firewall policies or routing. The administrator must remove the IP address and any references from the current VDOM first. After that, the interface can be assigned to the target VDOM.

Answer

Disable the interface, change its VDOM, and then re-enable it.

Answer

Enable administrative access on the interface and then change its VDOM assignment.

Answer

Create a VDOM link between the root VDOM and the target VDOM, then move the interface.

Question 4

A FortiGate is deployed in multi-VDOM mode with VDOM-1 and VDOM-2. The administrator creates an inter-VDOM link named IVL1 with interface ivl-1-0 in VDOM-1 and ivl-1-1 in VDOM-2. Static routes are configured in both VDOMs to route traffic across the link. However, traffic from VDOM-1 to VDOM-2 is dropped. What is the most likely reason?

Accepted Answer

Firewall policies allowing traffic from VDOM-1 to VDOM-2 across the inter-VDOM link have not been created in both VDOMs.. Inter-VDOM links provide a virtual connection between two VDOMs, but they are not exempt from firewall inspection. After creating the link and configuring static routes, you must add firewall policies in each VDOM to permit traffic from the source interface to the inter-VDOM link interface, and from the inter-VDOM link interface to the destination interface. Without these policies, the FortiGate drops the packets even though routing is correct. This is a common misconfiguration in multi-VDOM deployments.

Answer

The inter-VDOM link pair must be in the same VDOM; splitting them across VDOMs disables the link.

Answer

The inter-VDOM link interfaces must be assigned to a zone before they can pass traffic.

Answer

Inter-VDOM links do not support static routing; dynamic routing protocols must be used.

Question 5

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to ensure that the VDOMs can use overlapping IP addresses on their respective interfaces. Which setting must be enabled to allow this?

Accepted Answer

Enable 'allow-subnet-overlap' in each VDOM that requires overlapping subnets.. To use overlapping IP addresses in different VDOMs, you must enable 'allow-subnet-overlap' in each VDOM that requires it. This setting allows the FortiGate to accept the same subnet on interfaces in different VDOMs. It is configured within each VDOM's system settings, not globally. This is useful in multi-tenant environments where customers may use the same private IP ranges.

Answer

Assign the interfaces to different zones within the same VDOM to allow overlapping IPs.

Answer

Configure the interfaces to use different VDOM link IP addresses to avoid overlap.

Answer

Enable 'allow-subnet-overlap' globally in the system settings, which applies to all VDOMs.

Question 6

A FortiGate is deployed in multi-VDOM mode with two VDOMs: VDOM-1 and VDOM-2. The administrator needs to enable communication between these VDOMs using a VDOM link. Which TWO statements about VDOM link configuration are correct? (Choose two.)

Accepted Answer

Firewall policies must be configured in each VDOM to allow traffic to traverse the VDOM link.. Creating a VDOM link automatically generates a pair of interfaces, one in each VDOM, and firewall policies must be configured in both VDOMs to allow traffic. These two statements are correct. The other options contain misconceptions about subnet requirements, operational modes, or link limitations.

Answer

The VDOM link interfaces must be assigned IP addresses in the same subnet for routing to work.

Answer

Only one VDOM link can exist between two VDOMs at a time.

Answer

The VDOM link interfaces are always in transparent mode and cannot be assigned IP addresses.

Question 7

A network administrator is deploying a FortiGate in multi-VDOM mode. The administrator wants to restrict a specific VDOM so that it can only use a maximum of 2 GB of system memory and 10% of the total CPU resources. Which FortiGate feature should the administrator use?

Accepted Answer

VDOM resource limits under System > VDOM > Edit > Resource Limits. FortiGate multi-VDOM mode includes per-VDOM resource limits that allow administrators to set maximum and guaranteed amounts of memory, CPU, and sessions. These limits are configured in the VDOM settings. By setting a maximum memory of 2 GB and CPU of 10%, the administrator can prevent the VDOM from consuming more than its share. This feature is essential for multi-tenant environments where resource isolation is required.

Answer

Traffic shaping profiles applied to the VDOM's interfaces

Answer

Administrative profiles assigned to VDOM administrators

Answer

QoS queues configured on the VDOM's inter-VDOM links

Question 8

A FortiGate is configured with multiple VDOMs. The administrator wants to enable inter-VDOM routing between VDOM-A and VDOM-B. The administrator creates an inter-VDOM link and assigns IP addresses to both ends. Which additional configuration is required to allow traffic to pass between the VDOMs?

Accepted Answer

Create a firewall policy in VDOM-A allowing traffic from the source interface to the inter-VDOM link interface, and a policy in VDOM-B allowing traffic from the inter-VDOM link interface to the destination interface.. To enable inter-VDOM routing, you must create an inter-VDOM link and assign IP addresses. Then, you must add firewall policies in each VDOM to permit traffic across the link. Specifically, a policy in the source VDOM allowing traffic from the internal interface to the inter-VDOM link interface, and a policy in the destination VDOM allowing traffic from the inter-VDOM link interface to the destination interface. These policies are required because each VDOM inspects traffic independently.

Answer

Enable inter-VDOM routing globally under System > Settings.

Answer

Assign both inter-VDOM link interfaces to the same zone.

Answer

Configure a static route in each VDOM pointing to the inter-VDOM link, and enable 'allow inter-VDOM traffic' on the link.

Question 9

A FortiGate is configured with multiple VDOMs. The administrator wants to assign a physical interface to a specific VDOM so that it can be used for that VDOM's traffic. Which configuration step is required?

Accepted Answer

In the global configuration, edit the physical interface and set the VDOM to the desired VDOM.. Assigning a physical interface to a VDOM requires editing the interface in the global configuration and setting its VDOM attribute. This moves the interface to the target VDOM, where it can be used for that VDOM's traffic. Other methods like VLANs or VDOM-specific interface lists do not achieve the same result.

Answer

Create a VLAN subinterface on the physical interface and assign the VLAN to the VDOM.

Answer

Use the 'set vdom' command under the interface configuration in the root VDOM.

Answer

In the VDOM configuration, add the physical interface to the VDOM's interface list.

Question 10

An administrator is deploying a FortiGate with multiple VDOMs in NAT/route mode. The administrator needs to configure inter-VDOM routing between VDOM-A and VDOM-B. Which two actions are required to enable traffic to flow between the two VDOMs? (Choose two.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable inter-VDOM routing and create a firewall policy between the VDOM links.. Inter-VDOM routing requires VDOM links, which are virtual interfaces that connect VDOMs. To inspect inter-VDOM traffic, firewall policies must be created on each VDOM to allow and apply security profiles to traffic traversing the VDOM link. This ensures that all inter-VDOM traffic is subject to the same security policies as external traffic, preventing bypass.

Answer

Enable VDOM partitioning and assign interfaces to each VDOM.

Answer

Enable ASIC offloading for inter-VDOM traffic to ensure inspection.

Answer

Configure a single firewall policy with all interfaces as source and destination.

Question 11

A FortiGate is deployed with multiple VDOMs in NAT/route mode. The administrator wants VDOM-A and VDOM-B to exchange routing information dynamically without using static routes. The administrator has already created a VDOM link named 'vlink' between the two VDOMs and assigned IP addresses 10.0.0.1/30 and 10.0.0.2/30 to the respective interfaces. Which additional configuration is required on each VDOM to enable OSPF adjacency over the VDOM link?

Accepted Answer

Enable OSPF on the VDOM link interface and assign both interfaces to the same OSPF area.. To enable OSPF over a VDOM link, you must configure OSPF on the link interfaces and ensure they are in the same area. This allows the two VDOMs to form an adjacency and exchange routes dynamically. The VDOM link provides the Layer 3 connectivity, but the routing protocol configuration is what enables dynamic route exchange.

Answer

Create a firewall policy allowing OSPF (protocol 89) between the VDOM link interfaces.

Answer

Set the VDOM link interfaces to 'wan' role and enable OSPF on the physical interfaces.

Answer

Configure a static route on each VDOM pointing to the other VDOM's interface IP address.

Question 12

An administrator has a FortiGate 600E running multiple VDOMs in NAT mode. The security team wants to inspect inter-VDOM traffic between VDOM-A and VDOM-B with a firewall policy that applies UTM profiles. The administrator has already created a VDOM link named vlink1 with interfaces vlink1-A in VDOM-A and vlink1-B in VDOM-B. What must the administrator do to ensure that inter-VDOM traffic is inspected by a security policy?

Accepted Answer

Create a firewall policy in VDOM-A from the internal interface to vlink1-A and a matching policy in VDOM-B from vlink1-B to the internal interface, and apply UTM profiles to both policies.. Inter-VDOM traffic is routed through VDOM link interfaces and is subject to the firewall policies of each VDOM it enters. To inspect traffic from VDOM-A to VDOM-B, a policy in VDOM-A must allow traffic from the source interface to vlink1-A, and a policy in VDOM-B must allow traffic from vlink1-B to the destination interface. UTM profiles can be applied to either or both policies, depending on where inspection is desired. This ensures that inter-VDOM traffic is not implicitly allowed and can be inspected.

Answer

Enable UTM inspection on the VDOM link interface in VDOM-A only, because traffic is inspected once as it leaves the source VDOM.

Answer

Assign the VDOM link interfaces to a zone in each VDOM, then create a single global firewall policy that applies to both VDOMs and includes UTM profiles.

Answer

Create a single firewall policy in VDOM-A from the internal interface to vlink1-A, and rely on the implicit inter-VDOM link policy to allow return traffic without inspection.

Question 13

An administrator is configuring a FortiGate in multi-VDOM mode. The administrator needs to ensure that a specific VDOM can use more system resources, such as sessions and CPU, than other VDOMs. Which FortiGate feature should the administrator use?

Accepted Answer

Configure per-VDOM resource limits in the VDOM settings.. To allocate more system resources to a specific VDOM, the administrator should configure per-VDOM resource limits. FortiGate allows setting maximum sessions, CPU usage, memory, and other resources on a per-VDOM basis. This ensures that the VDOM has sufficient resources while preventing it from monopolizing system resources. This is the correct feature for resource allocation in multi-VDOM deployments.

Answer

Enable NPU offloading for the VDOM to increase its throughput.

Answer

Create a separate administrative profile for the VDOM with elevated privileges.

Answer

Assign a higher priority to the VDOM in the global VDOM configuration.

Question 14

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own separate routing table. Which statement is correct?

Accepted Answer

Each VDOM maintains its own independent routing table, and routes are not shared between VDOMs by default.. In a multi-VDOM FortiGate, each VDOM has its own independent routing table. Routes are not shared between VDOMs by default, ensuring isolation. This allows each VDOM to have separate routing policies and next-hop gateways. Inter-VDOM routing must be explicitly configured using VDOM links if communication between VDOMs is required.

Answer

All VDOMs share a single global routing table, but policies can filter routes.

Answer

Only the management VDOM has a routing table; other VDOMs use the management VDOM's routing table.

Answer

Routes are automatically synchronized between VDOMs to ensure consistent routing.

Question 15

An administrator is configuring a FortiGate with VDOMs. The administrator wants to ensure that each VDOM has its own independent routing table and that routes in one VDOM do not affect another. Which statement about VDOM routing is correct?

Accepted Answer

Each VDOM maintains its own separate routing table, and routes are isolated per VDOM.. VDOMs on a FortiGate are independent virtual instances, each with its own routing table. This means that routes configured in one VDOM are not shared with or visible to other VDOMs. This isolation is a key benefit of VDOMs, allowing separate routing domains for different departments or customers without interference.

Answer

All VDOMs share a single global routing table, but route entries are tagged with VDOM IDs.

Answer

Only the root VDOM can have a default route; other VDOMs must use inter-VDOM links for all traffic.

Answer

Routes are automatically synchronized between VDOMs to ensure consistent routing.