NSE7 Enterprise Firewall and VDOMs Practice Test 3 — 15 Questions

Question 1

A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable inter-VDOM routing and create policies allowing traffic between the VDOMs. Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Create a VDOM link between the two VDOMs

Answer

Configure the FortiGate in transparent mode

Question 2

An administrator wants to ensure that all traffic from VDOM 'Guest' is logged to a FortiAnalyzer that is managed by FortiManager. What must be configured in FortiManager to achieve this?

Accepted Answer

Configure the VDOM's log settings and assign the device to an ADOM with log forwarding enabled. FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

Answer

Enable FortiView on the FortiGate

Answer

Configure a log forwarding policy in the Global ADOM

Answer

Create an automation stitch to forward logs

Question 3

A FortiGate administrator notices that traffic from a specific subnet is not being inspected by the Intrusion Prevention System (IPS) profile applied to the firewall policy. The policy is configured with the correct profile, and the IPS engine is enabled. What is the most likely cause?

Accepted Answer

The protocol in the IPS profile is not enabled for the application being used. The most likely cause is that the protocol in the IPS profile is not enabled for the application being used. Even when an IPS profile is applied to a firewall policy and the IPS engine is running, the profile must have the specific protocol (e.g., HTTP, SMTP, FTP) enabled for inspection. If the protocol is disabled or not selected, the IPS engine will bypass traffic of that type, resulting in no intrusion detection or prevention for that traffic.

Answer

The traffic is encrypted and SSL inspection is not enabled

Answer

The IPS profile is configured for signature-based detection only

Answer

The firewall policy is set to accept mode instead of explicit proxy

Question 4

An administrator is configuring a new VDOM on a FortiGate and needs to ensure that certain system resources are isolated for that VDOM. Which TWO settings must be configured to achieve resource isolation?

Accepted Answer

Set memory quota. Setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.

Answer

Set disk quota

Answer

Set bandwidth limit

Answer

Set session limit

Question 5

A FortiGate administrator is troubleshooting an issue where certain traffic is not being logged despite having a firewall policy with logging enabled. The administrator checks the policy and confirms logging is set to 'All Sessions'. Which THREE reasons could explain why the traffic is not being logged?

Accepted Answer

The log device (FortiAnalyzer or syslog) is not reachable and the FortiGate is configured to drop logs when the remote server is unavailable. When a FortiGate is configured to drop logs when the remote logging server (FortiAnalyzer or syslog) is unreachable, the logs are discarded locally rather than queued or buffered. This behavior is controlled by the 'log-drop-packet' setting or the 'reliable' vs 'unreliable' logging mode, and if the remote server is down, the logs never leave the FortiGate, resulting in no logging despite the policy being set to log all sessions.

Answer

The log disk is full

Answer

The traffic is denied by a local-in policy

Question 6

A network administrator needs to create a separate firewall policy for the guest network while keeping management traffic in the main VDOM. Which VDOM type should be configured for the guest network?

Accepted Answer

Traffic VDOM. A Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

Answer

Root VDOM

Answer

Administrative VDOM

Answer

Management VDOM

Question 7

An administrator runs 'diagnose debug vd case <vdom_name>' and receives the error 'VDOM not found'. The VDOM exists and is configured. What is the most likely cause?

Accepted Answer

The VDOM name is misspelled or has incorrect case. The 'diagnose debug vd case' command is case-sensitive and expects the exact VDOM name as configured. Even if the VDOM exists, a mismatch in letter case (e.g., typing 'VDOM1' instead of 'vdom1') will cause the 'VDOM not found' error because the command performs a literal string comparison without case normalization.

Answer

The VDOM is a traffic VDOM and requires a different command

Answer

The VDOM is administratively disabled

Answer

The administrator is in the wrong VDOM context

Question 8

A FortiGate is operating in transparent mode and is deployed in an enterprise network. The administrator needs to apply a security policy to control traffic between two VLANs. What is a key consideration when configuring policies in transparent mode?

Accepted Answer

The policy is applied to the Layer 2 interface where the traffic enters. In transparent mode, the FortiGate acts as a Layer 2 bridge, and security policies are applied to the ingress interface where traffic enters the device. This allows the firewall to filter traffic between VLANs based on Layer 3 and Layer 4 criteria without requiring IP addresses on the interfaces, as the device is transparent to the network.

Answer

Transparent mode does not support firewall policies

Answer

The policy must be applied to the management IP address

Answer

Policies must be configured using MAC addresses only

Question 9

A FortiManager administrator is configuring ADOMs to manage multiple FortiGates. The administrator wants to ensure that changes to the central management policy package are automatically pushed to managed devices. Which setting should be enabled?

Accepted Answer

Enable 'Auto-update' in the policy package. Enabling 'Auto-update' in the policy package on FortiManager ensures that any changes made to the central management policy package are automatically pushed to all managed FortiGates. This setting triggers an immediate installation of the policy package to the devices whenever a change is committed, eliminating the need for manual installation. It is specifically designed for centralized policy management in ADOM environments.

Answer

Enable 'Auto-link' on the device

Answer

Configure a schedule for policy installation

Answer

Enable 'Central Management' on the FortiGate

Question 10

A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?

Accepted Answer

The traffic is being processed by a different VDOM than expected. FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.

Answer

The session is already established and the policy change is not applied to existing sessions

Answer

The policy is disabled

Answer

The policy has an incorrect schedule

Question 11

An administrator configured a new policy package in FortiManager and assigned it to a FortiGate. After installing the policy package, the FortiGate shows the new policies, but traffic is not matching them. What could be the reason?

Accepted Answer

The policy package is installed to the root VDOM instead of the target VDOM. When a policy package is installed to a FortiGate via FortiManager, the installation target must match the VDOM context of the FortiGate. If the administrator assigns the policy package to the root VDOM (or a different VDOM) instead of the specific VDOM where traffic is being processed, the policies will appear in the FortiGate's configuration but will not be applied to the correct VDOM's traffic. FortiManager installs policies per VDOM, and mismatched VDOM assignment causes the policies to be ignored by the traffic path.

Answer

The policy package has not been committed

Answer

The FortiGate has not been added to the ADOM

Answer

The FortiGate is in transparent mode

Question 12

A FortiGate administrator wants to use FortiAnalyzer to generate a report on top talkers in the network. Which FortiView feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides real-time and historical traffic visibility, including top talkers, directly from the FortiGate's session table and logs. FortiView's 'Top Talkers' widget aggregates traffic by source IP, destination IP, or application, allowing the administrator to generate reports on the highest bandwidth consumers without needing to run complex queries in Log Analytics.

Answer

Log Analytics

Answer

Playbooks

Answer

Incidents

Question 13

During a security audit, it is found that traffic between two VDOMs is allowed even though no inter-VDOM routing policy is configured. The VDOMs are connected via a VDOM link. What could explain this behavior?

Accepted Answer

The VDOM link is operating in transparent mode. When a VDOM link operates in transparent mode, it acts as a Layer 2 bridge between the connected VDOMs. In transparent mode, the VDOM link does not require an inter-VDOM routing policy because traffic is forwarded based on MAC addresses rather than IP routing, effectively allowing all traffic between the VDOMs unless explicitly filtered by firewall policies. This explains why traffic flows even without a configured inter-VDOM routing policy.

Answer

The FortiGate is in NAT mode

Answer

The VDOMs are in the same administrative domain

Answer

The VDOM link is using the same interface IP

Question 14

An administrator configures an automation stitch on FortiManager to trigger a script when a specific log message is received. After saving, the stitch does not execute. What is a likely cause?

Accepted Answer

The automation stitch is not enabled. Automation stitches on FortiManager are disabled by default after creation. The administrator must explicitly enable the stitch before it will trigger on incoming log events. Without enabling, the stitch remains inactive regardless of other configurations.

Answer

The FortiGate is not in the same ADOM

Answer

The log message is not being sent to FortiManager

Answer

The script is not uploaded to the FortiGate

Question 15

An administrator needs to restrict inter-VDOM traffic between two VDOMs on a FortiGate. Which TWO configurations are required?

Accepted Answer

Create firewall policies in each VDOM to allow/deny traffic. Inter-VDOM traffic on a FortiGate is controlled by firewall policies within each VDOM. By creating policies in each VDOM that specify the VDOM link as the interface, the administrator can explicitly allow or deny traffic between the VDOMs, enforcing security boundaries. Without these policies, traffic would be implicitly denied by the default firewall behavior.

Answer

Enable inter-VDOM routing globally

Answer

Assign an IP address to the VDOM link in each VDOM

Answer

Configure static routes on each VDOM