NSE7 Enterprise Firewall and VDOMs Practice Test 4 — 15 Questions

Question 1

A FortiManager administrator is planning to deploy a new policy package to a FortiGate that has multiple VDOMs. To ensure the policy package is applied correctly to the target VDOM, which THREE steps should the administrator take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Install the policy package to the FortiGate, selecting the correct VDOM. When installing a policy package to a FortiGate with multiple VDOMs, the administrator must select the correct target VDOM in the installation wizard. This ensures the policy package is applied to the intended VDOM and not to the global or another VDOM, which could cause policy conflicts or security gaps.

Answer

Configure a revision history to track changes

Answer

Enable central management on the FortiGate

Question 2

An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?

Accepted Answer

The log data is in a different datastore than the one configured for the report. FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

Answer

The report schedule is not set

Answer

The FortiAnalyzer is in a different ADOM

Answer

The FortiAnalyzer license has expired

Question 3

A FortiGate is operating in transparent mode for a VDOM. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate operates as a Layer 2 bridge, forwarding frames without modifying source/destination MAC addresses. In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge, forwarding Ethernet frames based on MAC addresses without modifying the source or destination MAC addresses. This allows the FortiGate to inspect traffic between hosts on the same subnet without requiring IP address changes or routing, functioning as a security appliance that is transparent to the network.

Answer

Virtual IP (VIP) objects are supported in transparent mode to map public to private IPs

Answer

Each interface in the VDOM must have an IP address in the same subnet

Answer

The VDOM can have multiple IP subnets on the same broadcast domain, and the FortiGate inspects traffic between them

Question 4

A FortiManager administrator creates an ADOM for the root VDOM and regular VDOMs. The administrator wants to manage only the regular VDOMs from FortiManager. Which ADOM type should be used?

Accepted Answer

Regular ADOM (non-root). A Regular ADOM (non-root) is the correct choice because it allows the administrator to manage only the regular VDOMs (non-root VDOMs) on a FortiGate, excluding the root VDOM. This ADOM type is designed for managing individual VDOMs as separate entities, providing granular control without affecting the root VDOM's global settings or other VDOMs.

Answer

Management VDOM ADOM

Answer

Root ADOM

Answer

Global ADOM

Question 5

An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?

Accepted Answer

Source: all, Destination: all. In transparent mode, the FortiGate operates as a Layer 2 bridge but still inspects Layer 3 headers, so it can match on IP addresses in firewall policies. The correct answer is 'all' for both source and destination because the policy is intended to allow all internal users to any internet destination, and using 'all' ensures the policy applies broadly without unnecessary restrictions. Using specific IP subnets is also possible, but 'all' is simple and commonly used when no further filtering is required.

Answer

Source: the FortiGate's management IP, Destination: the web server's IP

Answer

Source: internal subnet, Destination: external subnet

Answer

Source: internal MAC addresses, Destination: external MAC addresses

Question 6

An administrator is planning a FortiManager deployment to manage multiple FortiGates with multiple VDOMs. The administrator wants to use ADOMs to separate configurations. Which TWO statements about ADOMs are correct? (Choose two.)

Accepted Answer

ADOMs support revision history for tracking configuration changes. ADOMs in FortiManager maintain a revision history for each managed device or VDOM, allowing administrators to track configuration changes over time, compare revisions, and roll back to previous states if needed. This revision control is essential for auditing and troubleshooting in multi-VDOM environments.

Answer

Regular ADOMs can only contain devices with a single VDOM

Answer

Policy packages in an ADOM can be shared across different ADOMs

Answer

ADOMs cannot be renamed after creation

Question 7

A FortiGate has two VDOMs: VDOM-A and VDOM-B. The administrator wants VDOM-A to have administrative access to VDOM-B for troubleshooting. The administrator configures a management VDOM. Which THREE steps are required to allow administrative access from VDOM-A to VDOM-B? (Choose three.)

Accepted Answer

Designate VDOM-A as the management VDOM. Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.

Answer

Enable 'inter-vdom-routing' globally

Answer

Disable 'admin-sport' to allow HTTP access

Question 8

An administrator is troubleshooting a FortiGate in transparent mode. The FortiGate is not forwarding traffic between two segments connected to port1 and port2. The administrator checks the interface configuration. Which TWO configurations are REQUIRED for a transparent mode VDOM to forward traffic? (Choose two.)

Accepted Answer

Both interfaces must be members of the same hardware switch (or software bridge). In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must be switched between interfaces. Both interfaces must be members of the same hardware switch or software bridge to create a single broadcast domain, allowing frames to be forwarded based on MAC addresses. Without this, the interfaces are isolated and cannot forward traffic at Layer 2.

Answer

Spanning Tree Protocol (STP) must be enabled on both interfaces

Answer

Both interfaces must be assigned IP addresses in the same subnet

Answer

A firewall policy must allow all traffic between the two interfaces

Question 9

A network admin configures inter-VDOM routing between two VDOMs on a FortiGate. The admin creates a firewall policy in VDOM A allowing traffic to VDOM B, but traffic is still not passing. What additional step is required?

Accepted Answer

Create a firewall policy in VDOM B to permit the traffic from VDOM A. Inter-VDOM routing on a FortiGate requires firewall policies in both VDOMs to permit traffic in both directions. Even if VDOM A has a policy allowing traffic to VDOM B, VDOM B must have a corresponding policy to allow the return traffic or the initial traffic from VDOM A to be processed. Without this, the FortiGate drops the packets due to asymmetric policy enforcement.

Answer

Configure a static route in VDOM B pointing back to VDOM A

Answer

Enable inter-VDOM routing under config system global

Answer

Assign the inter-VDOM link to both VDOMs

Question 10

An administrator is configuring a FortiGate in transparent mode for an enterprise network. The existing gateway firewall must remain in place. How should the administrator configure the FortiGate's interfaces to ensure minimal disruption?

Accepted Answer

Place both interfaces in the same VDOM and assign a shared management IP. In transparent mode, FortiGate acts as a Layer 2 bridge, so both interfaces must belong to the same VDOM and share a single management IP to allow administrative access without breaking the Layer 2 path. This configuration ensures the existing gateway firewall remains in place and traffic flows uninterrupted, as the FortiGate does not perform routing between its interfaces.

Answer

Enable VDOMs and separate the interfaces into different VDOMs

Answer

Assign each interface a unique IP address on different subnets

Answer

Use 802.1Q trunking on a single physical interface

Question 11

A FortiGate has two VDOMs: Sales and Engineering. The admin wants to allow the Engineering VDOM to manage the Sales VDOM's administrator accounts. What configuration is required?

Accepted Answer

Set the management VDOM to Engineering and configure Sales to accept admin connections from Engineering's IP. To allow the Engineering VDOM to manage the Sales VDOM's administrator accounts, the management VDOM must be set to Engineering, and the Sales VDOM must be configured to accept admin connections from Engineering's IP address. This is done via the 'set management-vdom' command under the Sales VDOM and ensuring the Sales VDOM's local-in policy permits HTTPS/SSH traffic from the Engineering VDOM's management IP. This enables cross-VDOM administrative management without requiring inter-VDOM routing or shared policies.

Answer

Use inter-VDOM routing to forward admin traffic

Answer

Enable VDOM sharing on the local-in policy

Answer

Create a super_admin account in Sales VDOM

Question 12

An administrator runs 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

Accepted Answer

The session is in TCP SYN_SENT state. The output shows proto=6 (TCP) and proto_state=01 (SYN_SENT). However, a session with a duration of 3600 seconds cannot remain in SYN_SENT state; it would have timed out or transitioned to ESTABLISHED. Therefore, the output is contradictory and none of the provided options correctly describe the session. Option A is wrong because proto=6 is TCP, not UDP. Option B is wrong because a session alive for an hour cannot be in SYN_SENT. Option C is wrong because 'expire' is in seconds, not milliseconds. Option D is wrong because 'duration' is the total session time, not idle time.

Answer

The session is a UDP flow

Answer

The session will expire in 3599 milliseconds

Answer

The session has been idle for 3600 seconds

Question 13

What is the maximum number of VDOMs supported on a FortiGate 600F (assuming license)?

Accepted Answer

500. The FortiGate 600F, when properly licensed, supports up to 500 VDOMs. This is because the 600F is a mid-range enterprise appliance designed for large-scale multi-tenant environments, and its hardware resources (CPU, memory, and NP7 processors) are provisioned to handle the control-plane and data-plane overhead of up to 500 virtual domains. The license unlocks the VDOM feature, but the maximum count is a hardware-imposed limit, not a software cap.

Answer

10

Answer

50

Answer

100

Question 14

A FortiGate admin configures automation stitches in FortiManager to trigger a script when a specific incident occurs. The script runs but does not produce the expected result. Which FortiAnalyzer feature should the admin use to verify the automation stitch executed correctly?

Accepted Answer

Incident Management. Incident Management in FortiAnalyzer provides a detailed log of automation stitch execution, including trigger events, script actions, and any errors. This allows the admin to verify whether the stitch ran as expected and to diagnose why the script did not produce the intended result.

Answer

Reports

Answer

FortiView

Answer

Playbooks

Question 15

An administrator needs to configure a FortiGate to ensure that antivirus scanning is performed on SMTP traffic. Which two configuration items are required? (Choose two.)

Accepted Answer

Firewall policy applying the antivirus profile. A firewall policy is required to apply an antivirus profile to SMTP traffic. Without a firewall policy that matches the SMTP traffic (typically on port 25), the FortiGate will not inspect the traffic at all. Option E is correct because the antivirus profile itself defines the scanning settings, signatures, and actions for detecting malware in SMTP attachments and message bodies.

Answer

SSL/SSH inspection profile

Answer

Application control profile

Answer

Email filter profile