NSE7 Enterprise Firewall and VDOMs Practice Test 5 — 15 Questions

Question 1

A security administrator wants to generate a weekly report in FortiAnalyzer that shows the top threats detected by the FortiGate. Which feature should the administrator use to create this report?

Accepted Answer

Reports. The Reports feature in FortiAnalyzer is specifically designed to generate scheduled, customizable reports that aggregate security event data from FortiGate devices. By creating a report template with threat-based charts and tables, the administrator can schedule a weekly output showing top threats, leveraging the ADOM and SQL-based report engine for granular data selection.

Answer

Incidents

Answer

Playbooks

Answer

FortiView

Question 2

An administrator is configuring a new VDOM on a FortiGate and needs to ensure that certain system resources are isolated for that VDOM. Which TWO settings must be configured to achieve resource isolation?

Accepted Answer

Set memory quota. Setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.

Answer

Set disk quota

Answer

Set bandwidth limit

Answer

Set session limit

Question 3

A FortiGate administrator is troubleshooting an issue where certain traffic is not being logged despite having a firewall policy with logging enabled. The administrator checks the policy and confirms logging is set to 'All Sessions'. Which THREE reasons could explain why the traffic is not being logged?

Accepted Answer

The log device (FortiAnalyzer or syslog) is not reachable and the FortiGate is configured to drop logs when the remote server is unavailable. When a FortiGate is configured to drop logs when the remote logging server (FortiAnalyzer or syslog) is unreachable, the logs are discarded locally rather than queued or buffered. This behavior is controlled by the 'log-drop-packet' setting or the 'reliable' vs 'unreliable' logging mode, and if the remote server is down, the logs never leave the FortiGate, resulting in no logging despite the policy being set to log all sessions.

Answer

The log disk is full

Answer

The traffic is denied by a local-in policy

Question 4

A FortiGate administrator is planning to deploy VDOMs to separate customer traffic. The administrator wants to use FortiManager for centralized management. Which TWO prerequisites must be met before the VDOMs can be managed from FortiManager?

Accepted Answer

The FortiGate must be assigned to an ADOM. FortiManager uses ADOMs (Administrative Domains) to logically group managed devices, and a FortiGate must be assigned to an ADOM before its VDOMs can be managed. Option D is correct because the FortiGate must be added to the FortiManager device list (via model or managed registration) to establish communication and allow policy/object provisioning to its VDOMs.

Answer

Inter-VDOM routing must be enabled

Answer

FortiAnalyzer must be registered with FortiManager

Answer

All VDOMs must be in the same ADOM

Question 5

A network administrator needs to create a separate firewall policy for the guest network while keeping management traffic in the main VDOM. Which VDOM type should be configured for the guest network?

Accepted Answer

Traffic VDOM. A Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

Answer

Root VDOM

Answer

Administrative VDOM

Answer

Management VDOM

Question 6

An administrator runs 'diagnose debug vd case <vdom_name>' and receives the error 'VDOM not found'. The VDOM exists and is configured. What is the most likely cause?

Accepted Answer

The VDOM name is misspelled or has incorrect case. The 'diagnose debug vd case' command is case-sensitive and expects the exact VDOM name as configured. Even if the VDOM exists, a mismatch in letter case (e.g., typing 'VDOM1' instead of 'vdom1') will cause the 'VDOM not found' error because the command performs a literal string comparison without case normalization.

Answer

The VDOM is a traffic VDOM and requires a different command

Answer

The VDOM is administratively disabled

Answer

The administrator is in the wrong VDOM context

Question 7

In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?

Accepted Answer

Firewall policies are missing or not allowing the traffic. In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.

Answer

The inter-VDOM routing mode is set to 'nat' instead of 'route'

Answer

The VDOM links are not assigned to the correct VDOM

Answer

The VDOMs are in different administrative domains

Question 8

A FortiGate is operating in transparent mode and is deployed in an enterprise network. The administrator needs to apply a security policy to control traffic between two VLANs. What is a key consideration when configuring policies in transparent mode?

Accepted Answer

The policy is applied to the Layer 2 interface where the traffic enters. In transparent mode, the FortiGate acts as a Layer 2 bridge, and security policies are applied to the ingress interface where traffic enters the device. This allows the firewall to filter traffic between VLANs based on Layer 3 and Layer 4 criteria without requiring IP addresses on the interfaces, as the device is transparent to the network.

Answer

Transparent mode does not support firewall policies

Answer

The policy must be applied to the management IP address

Answer

Policies must be configured using MAC addresses only

Question 9

A FortiManager administrator is configuring ADOMs to manage multiple FortiGates. The administrator wants to ensure that changes to the central management policy package are automatically pushed to managed devices. Which setting should be enabled?

Accepted Answer

Enable 'Auto-update' in the policy package. Enabling 'Auto-update' in the policy package on FortiManager ensures that any changes made to the central management policy package are automatically pushed to all managed FortiGates. This setting triggers an immediate installation of the policy package to the devices whenever a change is committed, eliminating the need for manual installation. It is specifically designed for centralized policy management in ADOM environments.

Answer

Enable 'Auto-link' on the device

Answer

Configure a schedule for policy installation

Answer

Enable 'Central Management' on the FortiGate

Question 10

A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?

Accepted Answer

The traffic is being processed by a different VDOM than expected. FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.

Answer

The session is already established and the policy change is not applied to existing sessions

Answer

The policy is disabled

Answer

The policy has an incorrect schedule

Question 11

What is the purpose of a management VDOM on a FortiGate?

Accepted Answer

To provide a dedicated environment for administrative access and management protocols. A management VDOM is a dedicated virtual domain that isolates administrative traffic (e.g., HTTPS, SSH, SNMP, syslog) from data-plane traffic. This ensures that management access and protocols like RADIUS or TACACS+ authentication are processed in a separate context, preventing interference with production VDOMs and allowing granular administrative access control.

Answer

To log all administrative actions

Answer

To route traffic between different VDOMs

Answer

To increase the number of available firewall policies

Question 12

An administrator configured a new policy package in FortiManager and assigned it to a FortiGate. After installing the policy package, the FortiGate shows the new policies, but traffic is not matching them. What could be the reason?

Accepted Answer

The policy package is installed to the root VDOM instead of the target VDOM. When a policy package is installed to a FortiGate via FortiManager, the installation target must match the VDOM context of the FortiGate. If the administrator assigns the policy package to the root VDOM (or a different VDOM) instead of the specific VDOM where traffic is being processed, the policies will appear in the FortiGate's configuration but will not be applied to the correct VDOM's traffic. FortiManager installs policies per VDOM, and mismatched VDOM assignment causes the policies to be ignored by the traffic path.

Answer

The policy package has not been committed

Answer

The FortiGate has not been added to the ADOM

Answer

The FortiGate is in transparent mode

Question 13

In FortiManager, what is the difference between a Global ADOM and a regular ADOM?

Accepted Answer

Global ADOM allows sharing of global objects across all ADOMs. In FortiManager, a Global ADOM is a special administrative domain that stores global objects (such as address objects, services, and policies) that can be shared and referenced by all regular ADOMs. This centralizes management of common resources, reducing duplication and ensuring consistency across multiple ADOMs. Regular ADOMs are isolated from each other by default, but they can import objects from the Global ADOM, which is the key distinction.

Answer

Regular ADOM supports automation stitches while Global ADOM does not

Answer

Regular ADOM can only manage one FortiGate

Answer

Global ADOM is used for managing FortiGates in a single VDOM environment

Question 14

A FortiGate administrator wants to use FortiAnalyzer to generate a report on top talkers in the network. Which FortiView feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides real-time and historical traffic visibility, including top talkers, directly from the FortiGate's session table and logs. FortiView's 'Top Talkers' widget aggregates traffic by source IP, destination IP, or application, allowing the administrator to generate reports on the highest bandwidth consumers without needing to run complex queries in Log Analytics.

Answer

Log Analytics

Answer

Playbooks

Answer

Incidents

Question 15

During a security audit, it is found that traffic between two VDOMs is allowed even though no inter-VDOM routing policy is configured. The VDOMs are connected via a VDOM link. What could explain this behavior?

Accepted Answer

The VDOM link is operating in transparent mode. When a VDOM link operates in transparent mode, it acts as a Layer 2 bridge between the connected VDOMs. In transparent mode, the VDOM link does not require an inter-VDOM routing policy because traffic is forwarded based on MAC addresses rather than IP routing, effectively allowing all traffic between the VDOMs unless explicitly filtered by firewall policies. This explains why traffic flows even without a configured inter-VDOM routing policy.

Answer

The FortiGate is in NAT mode

Answer

The VDOMs are in the same administrative domain

Answer

The VDOM link is using the same interface IP