NSE7 Enterprise Firewall and VDOMs Practice Test 4 — 15 Questions

Question 1

An administrator configures a VDOM on a FortiGate and assigns two interfaces (port1, port2) to it. The administrator wants to route traffic between two different subnets within the same VDOM. Which configuration is required?

Accepted Answer

Configure static or dynamic routing. Option D is correct because routing between two subnets within the same VDOM is standard intra-VDOM routing. Since both interfaces (port1, port2) belong to the same VDOM, no inter-VDOM constructs are needed; the FortiGate simply requires a route (static or dynamic) to forward packets between the subnets. A firewall policy allowing the traffic is also necessary, but the question specifically asks for the routing configuration.

Answer

Configure a VDOM link

Answer

Create a policy with inter-VDOM link

Answer

Enable inter-VDOM routing

Question 2

A FortiGate in transparent mode with multiple VDOMs is deployed at a customer site. The customer reports that traffic between two VLANs on the same physical segment is not being forwarded. The administrator verifies that the firewall policies are configured correctly. What is the most likely cause?

Accepted Answer

The FortiGate is in transparent mode and does not route between VLANs without a VLAN interface. In transparent mode, a FortiGate acts as a Layer 2 bridge and does not perform IP routing. To forward traffic between VLANs on the same physical segment, you must create VLAN subinterfaces on the FortiGate and assign them to the appropriate VDOMs. Without these VLAN interfaces, the FortiGate cannot distinguish or forward traffic between the VLANs, even if firewall policies are correctly configured.

Answer

The VDOMs are not configured with management IP addresses

Answer

The VDOM limit has been exceeded

Answer

Inter-VDOM routing is disabled between the VDOMs

Question 3

A network administrator wants to delegate management of a specific VDOM to a junior administrator. The junior should be able to modify firewall policies and objects within that VDOM but not change system settings or other VDOMs. Which administrative access configuration meets this requirement?

Accepted Answer

Create a local user with an admin profile that has permissions for that VDOM only. Option D is correct because FortiGate allows you to create a local user with an admin profile that has permissions scoped to a specific VDOM. By assigning the junior administrator to that VDOM-only profile, they can modify firewall policies and objects within that VDOM but cannot change system settings or access other VDOMs. This is the standard method for delegating VDOM-specific administrative access without granting global or multi-VDOM privileges.

Answer

Place the VDOM in transparent mode to allow full access

Answer

Create a RADIUS user that is assigned to the VDOM group

Answer

Use the management VDOM feature to assign the junior admin to the VDOM

Question 4

An administrator runs the command 'diagnose sys session filter dport 443' on a FortiGate and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state, meaning the three-way handshake is incomplete. The output shows `proto=6` (TCP), `proto_state=01`, `duration=3600`, and `expire=3599`. In FortiGate's session table, `proto_state=01` represents the TCP state `SYN_SENT`, which means the session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete. The `expire=3599` indicates the session will time out in 3599 seconds if the handshake does not complete, but the session is not yet established.

Answer

The session is fully established and will expire in about 3599 seconds

Answer

The traffic is being blocked by the firewall policy

Answer

The session is using HTTPS and has been inspected

Question 5

A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?

Accepted Answer

Enable inter-VDOM routing and create policies allowing traffic between the VDOMs. Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.

Answer

Place both VDOMs in the same ADOM in FortiManager

Answer

Create a VDOM link between the two VDOMs

Answer

Configure the FortiGate in transparent mode

Question 6

An administrator wants to ensure that all traffic from VDOM 'Guest' is logged to a FortiAnalyzer that is managed by FortiManager. What must be configured in FortiManager to achieve this?

Accepted Answer

Configure the VDOM's log settings and assign the device to an ADOM with log forwarding enabled. Option D is correct because FortiManager manages log forwarding at the ADOM level. To forward logs from a specific VDOM (Guest) to FortiAnalyzer, the administrator must configure the VDOM's log settings to send logs to FortiAnalyzer and assign the FortiGate to an ADOM that has log forwarding enabled. This ensures that logs from the Guest VDOM are properly forwarded to the FortiAnalyzer managed by FortiManager.

Answer

Enable FortiView on the FortiGate

Answer

Configure a log forwarding policy in the Global ADOM

Answer

Create an automation stitch to forward logs

Question 7

A FortiGate administrator notices that traffic from a specific subnet is not being inspected by the Intrusion Prevention System (IPS) profile applied to the firewall policy. The policy is configured with the correct profile, and the IPS engine is enabled. What is the most likely cause?

Accepted Answer

The protocol in the IPS profile is not enabled for the application being used. The most likely cause is that the protocol in the IPS profile is not enabled for the application being used. Even when an IPS profile is applied to a firewall policy and the IPS engine is running, the profile must have the specific protocol (e.g., HTTP, SMTP, FTP) enabled for inspection. If the protocol is disabled or not selected, the IPS engine will bypass traffic of that type, resulting in no intrusion detection or prevention for that traffic.

Answer

The traffic is encrypted and SSL inspection is not enabled

Answer

The IPS profile is configured for signature-based detection only

Answer

The firewall policy is set to accept mode instead of explicit proxy

Question 8

An administrator is deploying a FortiGate in transparent mode to seamlessly integrate into an existing network. The administrator needs to manage the FortiGate remotely over the network. Which configuration is required?

Accepted Answer

Configure a management IP address under the VDOM settings. In transparent mode, FortiGate operates as a Layer 2 bridge and does not route traffic, so physical interfaces cannot have IP addresses. To enable remote management, a dedicated management IP must be configured under the VDOM settings, which allows the FortiGate to be reachable via protocols like HTTPS, SSH, or SNMP without participating in Layer 3 forwarding.

Answer

Create a VLAN interface and assign an IP

Answer

Assign an IP address to the physical interfaces

Answer

Enable DHCP client on the interfaces

Question 9

An administrator needs to back up the configuration of a FortiGate managed by FortiManager before making major changes. Which feature in FortiManager should the administrator use?

Accepted Answer

Revision history. Revision History in FortiManager allows administrators to create, view, and restore previous configuration versions of managed FortiGate devices. This is the correct feature for backing up a configuration before making major changes, as it provides a point-in-time snapshot that can be rolled back if needed.

Answer

Policy package import/export

Answer

Automation stitch

Answer

Install preview

Question 10

In FortiManager, an administrator wants to apply a set of firewall policies to multiple FortiGates in different ADOMs. The policies must be centrally managed. What is the best approach?

Accepted Answer

Use the Global ADOM to define global policies that apply to all ADOMs. The Global ADOM in FortiManager allows administrators to define firewall policies that are automatically inherited by all ADOMs, ensuring consistent, centrally managed policy enforcement across multiple FortiGates without manual duplication. This approach leverages FortiManager's hierarchical policy model, where global policies are pushed to each ADOM's policy packages and take precedence over local policies unless overridden.

Answer

Create a policy package in each ADOM and use the same policies

Answer

Configure the policies directly on each FortiGate

Answer

Use automation stitches to copy policies between ADOMs

Question 11

An administrator configures an automation stitch in FortiManager to execute a CLI script on a FortiGate when a specific event is triggered. The automation stitch is enabled but does not run when the event occurs. What is the most likely cause?

Accepted Answer

The automation stitch has not been installed to the FortiGate. Option C is correct because in FortiManager, automation stitches are created and stored in the central management database but must be explicitly installed to the managed FortiGate via the 'Install Wizard' or a direct policy/object install. Until the stitch is installed, the FortiGate does not have the configuration locally, so even if the stitch is enabled in FortiManager and the event occurs, the FortiGate will not execute the CLI script. This is a common oversight where administrators assume enabling the stitch in FortiManager automatically pushes it to the device.

Answer

The event trigger is set to high severity only

Answer

The FortiGate does not support automation stitches

Answer

The CLI script contains an invalid command

Question 12

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

Accepted Answer

Reports. The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Answer

Incidents

Answer

Playbooks

Answer

FortiView

Question 13

An administrator is configuring a new VDOM on a FortiGate and needs to ensure that certain system resources are isolated for that VDOM. Which TWO settings must be configured to achieve resource isolation?

Accepted Answer

Set memory quota. Option B is correct because setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.

Answer

Set disk quota

Answer

Set bandwidth limit

Answer

Set session limit

Question 14

A FortiGate administrator is troubleshooting an issue where certain traffic is not being logged despite having a firewall policy with logging enabled. The administrator checks the policy and confirms logging is set to 'All Sessions'. Which THREE reasons could explain why the traffic is not being logged?

Accepted Answer

The log device (FortiAnalyzer or syslog) is not reachable and the FortiGate is configured to drop logs when the remote server is unavailable. Option C is correct because when a FortiGate is configured to drop logs when the remote logging server (FortiAnalyzer or syslog) is unreachable, the logs are discarded locally rather than queued or buffered. This behavior is controlled by the 'log-drop-packet' setting or the 'reliable' vs 'unreliable' logging mode, and if the remote server is down, the logs never leave the FortiGate, resulting in no logging despite the policy being set to log all sessions.

Answer

The log disk is full

Answer

The traffic is denied by a local-in policy

Question 15

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Accepted Answer

The FortiGate must be assigned to an ADOM. Option C is correct because FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Answer

Inter-VDOM routing must be enabled

Answer

FortiAnalyzer must be registered with FortiManager

Answer

All VDOMs must be in the same ADOM