NSE7 Enterprise Firewall and VDOMs Practice Test 22 — 15 Questions

Question 1

An administrator has a FortiGate with multiple VDOMs in NAT/route mode. VDOM-1 and VDOM-2 are connected via an inter-VDOM link. The administrator wants to apply security profiles to traffic passing between the VDOMs. However, when checking the policy list in VDOM-1, no policy is shown for traffic destined to VDOM-2. What is the most likely reason?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The administrator must create a policy in each VDOM that allows traffic from the inter-VDOM link interface to the destination interface.. Inter-VDOM traffic requires explicit firewall policies in both the source and destination VDOMs. The administrator must create a policy in VDOM-1 allowing traffic from the internal interface to the inter-VDOM link, and a corresponding policy in VDOM-2 from the inter-VDOM link to the internal interface. Without these, traffic is not allowed and no policy exists.

Answer

The inter-VDOM link interfaces have not been assigned to a zone, so policies cannot reference them.

Answer

Inter-VDOM link traffic is not subject to firewall policies by default.

Answer

The administrator is looking at the wrong VDOM; policies for inter-VDOM traffic are only visible in the root VDOM.

Question 2

A FortiGate is configured with multiple VDOMs. The administrator wants to assign a specific physical interface to a non-management VDOM and ensure that the interface is not visible or configurable from other VDOMs. The interface is currently assigned to the root VDOM. What is the correct procedure to reassign the interface to VDOM-1?

Accepted Answer

In the root VDOM, remove all references to the interface (such as firewall policies and routing entries), then use the global configuration to set the interface's VDOM to VDOM-1.. Reassigning a physical interface to a different VDOM requires removing all references to that interface in its current VDOM, such as firewall policies, routes, and DHCP settings. Once the interface is free of references, you can change its VDOM assignment in the global configuration. This process ensures that the interface is cleanly moved and becomes exclusively available to the target VDOM, maintaining proper isolation between VDOMs.

Answer

In the global configuration, directly change the interface's VDOM to VDOM-1; the FortiGate automatically deletes all references in the root VDOM.

Answer

From VDOM-1, use the command 'config system interface' and edit the interface, then set its VDOM to VDOM-1. The FortiGate automatically removes it from the root VDOM.

Answer

Create a new VDOM link between the root VDOM and VDOM-1, then bridge the physical interface to the VDOM link so that VDOM-1 can use it without reassigning the interface.

Question 3

An administrator has a FortiGate 600E running multiple VDOMs. The administrator wants to ensure that when a VDOM is deleted, all associated firewall policies, addresses, and routes are also removed to avoid orphaned objects. Which action should the administrator take?

Accepted Answer

Ensure the VDOM is not in use by any inter-VDOM links or management services, then delete it; associated objects are removed automatically.. Deleting a VDOM in FortiOS automatically removes all associated configuration objects, but you must first eliminate dependencies like inter-VDOM links. This ensures no orphaned objects remain. The other options either invent non-existent settings, suggest unnecessary manual steps, or propose inefficient workarounds that do not align with FortiGate's native behavior.

Answer

Enable the 'vdom-delete-cascade' setting under system global.

Answer

Export the VDOM configuration, delete the VDOM, then re-import the configuration without the unwanted objects.

Answer

Manually delete all firewall policies, addresses, and routes in the VDOM before deleting the VDOM.

Question 4

An administrator is configuring a FortiGate with multiple VDOMs. The administrator needs to allow a VDOM to use a shared physical interface with another VDOM. Which feature should be used?

Accepted Answer

VLAN subinterface. To share a physical interface among multiple VDOMs, create VLAN subinterfaces on the physical interface and assign each subinterface to a different VDOM. This provides logical separation while using the same physical port. VLANs allow the FortiGate to tag traffic and direct it to the appropriate VDOM, enabling efficient use of physical interfaces in multi-VDOM deployments.

Answer

Transparent mode

Answer

Management VDOM

Answer

VDOM link

Question 5

An administrator is configuring a FortiGate with multiple VDOMs in NAT/route mode. The administrator wants to enable inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. Which TWO statements about VDOM links are correct? (Choose two.)

Accepted Answer

Each VDOM link interface must be assigned an IP address to enable routing.. VDOM links are virtual point-to-point interfaces that require manual creation and IP address assignment on each end. They connect exactly two VDOMs and traffic over them is subject to firewall policies in both VDOMs. These characteristics make them suitable for controlled inter-VDOM routing.

Answer

Traffic over a VDOM link is not subject to firewall policies.

Answer

VDOM links are automatically created when a new VDOM is added.

Answer

A VDOM link can connect more than two VDOMs simultaneously.

Question 6

An administrator is setting up a new FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own set of administrators and that administrators of one VDOM cannot view or modify settings in another VDOM. Which feature should the administrator configure to achieve this?

Accepted Answer

VDOM-specific administrator accounts with restricted profiles.. To isolate administrators per VDOM, you create administrator accounts that are restricted to specific VDOMs. Each administrator account can be assigned a profile that limits their permissions to only the VDOM they are responsible for. This ensures that administrators cannot view or modify settings in other VDOMs. This is the standard method for achieving per-VDOM administrative separation on a FortiGate.

Answer

Role-based access control (RBAC) at the global level.

Answer

Administrative domains (ADOMs) on FortiManager.

Answer

Virtual clustering with separate management IPs per VDOM.

Question 7

A FortiGate 600E is configured with multiple VDOMs in NAT mode. The administrator wants to route traffic between VDOM-1 and VDOM-2 without using physical interfaces. They create a VDOM link named 'vlink' with interfaces vlink0 and vlink1, assign vlink0 to VDOM-1 (IP 10.0.1.1/30) and vlink1 to VDOM-2 (IP 10.0.1.2/30). However, traffic from a host in VDOM-1 (192.168.1.0/24) to a server in VDOM-2 (192.168.2.0/24) fails. The administrator has added static routes in both VDOMs pointing to the respective VDOM link IPs. What is the most likely cause of the failure?

Accepted Answer

The VDOM link interfaces require a firewall policy to allow traffic between VDOMs.. Inter-VDOM routing via VDOM links requires both routing and firewall policies. The VDOM link provides the Layer 3 path, and static routes direct traffic, but without a firewall policy allowing traffic from the source to destination VDOM, the FortiGate drops the packets. The administrator must add a policy in VDOM-1 (and possibly VDOM-2 for return traffic) to permit the flow.

Answer

The VDOM link interfaces must be in the same VDOM.

Answer

The IP addresses on the VDOM link interfaces must be in different subnets.

Answer

The static routes must be configured with the VDOM link interface as the outgoing interface, not the next-hop IP.

Question 8

A FortiGate 600E is running multiple VDOMs in NAT/route mode. VDOM-1 and VDOM-2 each have an inter-VDOM link interface named 'ivl-1' and 'ivl-2' respectively, and both are assigned IP addresses in the 10.10.10.0/30 subnet. VDOM-1 has a static route to 192.168.2.0/24 via 10.10.10.2, and VDOM-2 has a static route to 192.168.1.0/24 via 10.10.10.1. A user in VDOM-1 (192.168.1.10) cannot ping a server in VDOM-2 (192.168.2.10). What is the most likely cause?

Accepted Answer

A firewall policy allowing traffic from VDOM-1 to VDOM-2 is missing.. Inter-VDOM link routing requires three elements: correct IP addressing on the link interfaces, static or dynamic routes in each VDOM pointing to the other VDOM's networks, and a firewall policy permitting traffic between the VDOMs. The scenario indicates that routes are already configured, so the missing piece is the firewall policy. Without it, the FortiGate's default deny action blocks the transit traffic.

Answer

The inter-VDOM link interfaces must be configured with the same VDOM ID.

Answer

The inter-VDOM link interfaces do not have 'set allowaccess ping' enabled.

Answer

The inter-VDOM link interfaces are not assigned to a zone.

Question 9

An administrator is configuring a FortiGate with multiple VDOMs. The administrator wants to assign a physical interface to a specific VDOM and ensure that the interface is dedicated to that VDOM only. Which action should the administrator take?

Accepted Answer

In the interface configuration, set the VDOM field to the desired VDOM.. To dedicate a physical interface to a VDOM, you assign the interface to that VDOM by setting its VDOM field in the interface configuration. This removes the interface from other VDOMs and makes it exclusively available to the assigned VDOM. Other methods like VLANs are used for sharing, and there is no 'dedicated' option.

Answer

Enable the 'dedicated' option in the interface settings and select the VDOM.

Answer

Create a VLAN interface on the physical interface and assign the VLAN interface to the desired VDOM.

Answer

Use the 'set vdom' command in the global configuration to move the interface to the desired VDOM.

Question 10

An administrator has a FortiGate with two VDOMs: 'root' and 'VDOM-A'. The administrator wants to assign a physical interface to VDOM-A, but the interface is currently assigned to the root VDOM and is in use by a firewall policy. What must the administrator do before changing the interface's VDOM assignment?

Accepted Answer

Delete all firewall policies and routes that reference the interface.. On a FortiGate, a physical interface is bound to a VDOM. To reassign it, the interface must not be referenced by any configuration objects in its current VDOM, such as firewall policies, routes, or DHCP servers. The administrator must identify and delete those references. Only then can the interface's VDOM assignment be changed. This prevents configuration inconsistencies and potential security gaps.

Answer

Move the interface to a zone first, then change its VDOM.

Answer

Shut down the interface administratively, then change its VDOM.

Answer

Enable 'set vdom-override' on the interface.

Question 11

An administrator has a FortiGate in multi-VDOM mode. VDOM-1 is assigned to the marketing team and VDOM-2 to the finance team. The administrator wants both VDOMs to be able to reach a shared DNS server at 10.10.10.53 that sits behind the root VDOM's wan1 interface, without giving either team access to the other's traffic. Which configuration accomplishes this?

Accepted Answer

Create a VDOM link between root and VDOM-1 and another between root and VDOM-2, then add static routes in VDOM-1 and VDOM-2 pointing to the root side of their respective VDOM links, and configure firewall policies on root to allow DNS to 10.10.10.53.. Inter-VDOM links create a private point-to-point Layer 3 path between exactly two VDOMs. By giving each team VDOM its own link to the root VDOM and controlling traffic with root-side policies, the administrator provides selective shared-service access while preventing any direct path between the two teams. Sharing one physical interface or one VDOM link across three VDOMs is not supported and would compromise isolation.

Answer

Configure a static route in VDOM-1 and VDOM-2 with the destination 10.10.10.53/32 and the outgoing interface set to wan1, then add a firewall policy in each VDOM allowing DNS outbound.

Answer

Assign wan1 as a secondary IP on VDOM-1 and VDOM-2 so both VDOMs share the same physical interface, then add a policy route on root that forwards DNS traffic to 10.10.10.53.

Answer

Enable inter-VDOM routing globally and create a single VDOM link shared by VDOM-1, VDOM-2, and root, then place all three VDOMs in the same OSPF area to exchange routes to 10.10.10.53.

Question 12

A FortiGate is configured with three VDOMs: root, Sales, and Engineering. The administrator wants to ensure that the Sales VDOM can access the internet through the root VDOM, but the Engineering VDOM must not have any internet access. All VDOMs are currently in NAT mode. Which configuration is required to achieve this?

Accepted Answer

Create an inter-VDOM link between Sales and root. Assign a default route in Sales pointing to the inter-VDOM link. Do not create any inter-VDOM link or default route for Engineering.. The correct configuration is to provide internet access only to the Sales VDOM by creating an inter-VDOM link to the root VDOM and assigning a default route in Sales pointing to that link. Engineering should not have any inter-VDOM link or default route, ensuring it has no path to the internet. This method is deterministic and avoids reliance on firewall policies that could be misconfigured.

Answer

Create an inter-VDOM link between Sales and root, and another between Engineering and root. Assign default routes in both Sales and Engineering pointing to the inter-VDOM link. Apply a firewall policy in root that denies traffic from Engineering to the internet.

Answer

Create an inter-VDOM link between Engineering and root. Assign a default route in Engineering pointing to the inter-VDOM link. Apply a firewall policy in root that denies traffic from Engineering to the internet. Do not configure anything for Sales.

Answer

Place all VDOMs in transparent mode. Create VLANs for each VDOM and assign them to the root VDOM. Configure firewall policies in root to allow Sales to the internet and deny Engineering.

Question 13

An administrator is configuring a new FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own independent routing table and that traffic between VDOMs is inspected by firewall policies. Which TWO statements about inter-VDOM routing are correct? (Choose two.)

Accepted Answer

Inter-VDOM links are virtual interfaces that must be created in pairs, with each end assigned to a different VDOM.. Inter-VDOM links are virtual point-to-point interfaces that connect two VDOMs, allowing each VDOM to have its own routing table. Traffic across these links is inspected by firewall policies and can have UTM profiles applied. They do not use VLAN tagging and are not used in transparent mode VDOMs. These characteristics make them suitable for secure inter-VDOM communication.

Answer

Inter-VDOM links require the use of 802.1Q VLAN tagging to differentiate traffic.

Answer

Inter-VDOM links can be configured in transparent mode VDOMs without IP addresses.

Answer

A single inter-VDOM link can connect more than two VDOMs simultaneously.

Question 14

A FortiGate 600F is running in multi-VDOM mode with VDOMs named 'root', 'finance', and 'guest'. The administrator notices that a firewall policy created in the 'finance' VDOM does not appear when logging into the 'guest' VDOM and wants to confirm that policies, address objects, and routing tables are kept completely separate per VDOM. Which FortiGate feature provides this separation by default?

Accepted Answer

Per-VDOM configuration databases that store firewall policies, objects, and routing tables independently. Each VDOM on a FortiGate keeps its own configuration database, so firewall policies, address objects, and routing tables are isolated by design. That is exactly why a policy built in the finance VDOM cannot be seen from the guest VDOM. Global configuration and administrative profiles affect management and shared objects but do not merge or split VDOM policy tables.

Answer

Global VDOM configuration that synchronizes policies across all VDOMs

Answer

Virtual clustering that partitions the cluster into separate configuration domains

Answer

Administrative profiles that restrict which VDOMs an administrator can view

Question 15

An administrator has a FortiGate with VDOMs 'VDOM-A' and 'VDOM-B' connected by an inter-VDOM link. Users in VDOM-A can reach a web server in VDOM-B, but return traffic from the server to clients is being dropped. The administrator has already created policies in both directions. Which action should the administrator take to resolve the dropped return traffic?

Accepted Answer

Add a static route in VDOM-B that points the client subnet to the inter-VDOM link interface as next-hop. Inter-VDOM links require routing in both directions. Even with policies in both VDOMs, VDOM-B must have a route for the client subnet pointing to the inter-VDOM link interface so the server's replies can return. Missing that route is the classic cause of one-way inter-VDOM traffic, and adding it restores bidirectional communication.

Answer

Enable asymmetric routing on both VDOMs with 'config system settings' and 'set asymmetric-route enable'

Answer

Increase the TCP session timeout in VDOM-B so return packets are not aged out before arrival

Answer

Configure a firewall policy in VDOM-B with NAT enabled to translate the server address to the inter-VDOM link address