NSE7 Enterprise Firewall and VDOMs Practice Test 5 — 15 Questions

Question 1

An administrator wants to use FortiAnalyzer to generate reports for compliance. Which two data sources can be included in a FortiAnalyzer report? (Choose two.)

Accepted Answer

Log data from FortiGate. FortiAnalyzer reports are built from log data collected from FortiGate devices, which includes traffic logs, event logs, and security logs. This log data is the primary source for compliance reporting because it provides detailed records of network activity. FortiView traffic statistics are also a valid data source, as they aggregate real-time and historical traffic data from FortiGate logs, allowing reports to include graphical summaries and top-talker information.

Answer

Routing table information from routers

Answer

Configuration backups from FortiManager

Answer

User authentication logs from LDAP servers

Question 2

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in approximately 1 hour. The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds (approximately 1 hour). The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP state code for an established connection (ESTABLISHED), not a half-open state. This is a normal, healthy session.

Answer

The session is a UDP session for DNS

Answer

The session is in a half-open state (SYN_RCVD)

Answer

The session is blocked because duration exceeds the timeout

Question 3

A multi-VDOM FortiGate is running low on memory. The administrator suspects that the management VDOM is consuming excessive resources. How can the administrator limit the memory usage of the management VDOM?

Accepted Answer

Enable VDOM resource limits and configure a memory cap for the management VDOM. FortiGate VDOM resource limits allow an administrator to set a specific memory cap for each VDOM, including the management VDOM. By enabling VDOM resource limits and configuring a memory cap, the management VDOM is prevented from consuming excessive memory, ensuring fair resource allocation across all VDOMs. This is the only option that directly limits memory usage at the VDOM level without requiring hardware changes or disabling features.

Answer

Convert the management VDOM to a traffic VDOM

Answer

Move the management VDOM to a separate physical FortiGate

Answer

Disable unused features in the management VDOM

Question 4

A FortiGate in NAT mode has a VDOM with interface port1 (10.0.1.0/24) and port2 (203.0.113.0/24). A policy allows traffic from port1 to port2 with source NAT using the IP of port2. A user at 10.0.1.10 initiates a connection to a web server at 198.51.100.1. What will be the source IP after NAT?

Accepted Answer

The IP address of port2 (e.g., 203.0.113.1). When source NAT is configured to use the IP address of the egress interface (port2), the FortiGate performs dynamic PAT (Port Address Translation) and translates the source IP of the packet to the primary IP address of port2 (203.0.113.1). This is the default behavior when 'set srcaddr' is set to the interface IP in the firewall policy. The user at 10.0.1.10 will therefore appear to the web server at 198.51.100.1 as coming from 203.0.113.1.

Answer

A random IP from the port2 subnet

Answer

10.0.1.10

Answer

198.51.100.1

Question 5

An administrator is troubleshooting a VPN tunnel that fails to establish. The administrator has verified that pre-shared keys match and phase 1 parameters are correct. Which TWO additional items should be checked?

Accepted Answer

NAT traversal configuration. NAT traversal (NAT-T) is required when a VPN tunnel passes through a device performing Network Address Translation (NAT). NAT-T encapsulates ESP packets inside UDP 4500 to avoid issues with NAT modifying IP headers. Even if phase 1 parameters match, without NAT-T enabled on both peers, the tunnel may fail to establish if a NAT device is detected between them.

Answer

The phase 2 proposal

Answer

The NTP server configuration

Answer

The FortiGate's hostname

Question 6

A FortiGate has VDOMs enabled. An administrator runs 'get system status' and sees only one VDOM listed. However, the administrator configured two VDOMs earlier. What is the most likely cause?

Accepted Answer

The command only shows the management VDOM; use 'config vdom' to see all. When VDOMs are enabled, the 'get system status' command displays only the management VDOM (the VDOM from which the administrator is currently logged in). To see all configured VDOMs, the administrator must use the 'config vdom' command followed by 'show' or 'get system status' within the global context. Option D correctly identifies this behavior, as the second VDOM is not deleted or hidden by a bug; it simply is not shown by that command.

Answer

The second VDOM was deleted by another administrator

Answer

VDOM mode is not enabled globally

Answer

The second VDOM has a different name and is hidden due to a bug

Question 7

A FortiGate administrator needs to manage multiple FortiGate devices centrally. They want to deploy policy packages from FortiManager to specific VDOMs on each device. Which FortiManager object must be configured first?

Accepted Answer

Administrative Domain (ADOM). The Administrative Domain (ADOM) is the top-level container in FortiManager that defines the management boundary for a set of FortiGate devices and their VDOMs. Before you can create or assign policy packages to specific VDOMs on managed devices, you must first configure the ADOM to enable multi-tenancy and VDOM-level management. Without an ADOM, FortiManager cannot isolate or target individual VDOMs for policy deployment.

Answer

Device Group

Answer

Install Preview

Answer

Policy Package

Question 8

An administrator runs 'diagnose debug application fnbam 3' and sees many entries with state 'sctp'. The FortiGate has flow-based inspection enabled. What is being indicated?

Accepted Answer

Traffic is being fast-forwarded without security profile inspection. The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.

Answer

The FortiGate is performing SCTP deep inspection

Answer

The FortiGate is using proxy-based inspection

Answer

There is an SCTP-based attack in progress

Question 9

An administrator configures VDOMs on a FortiGate and assigns port1 to VDOM-A and port2 to VDOM-B. The administrator then creates a firewall policy in VDOM-A to allow traffic from port1 to the VDOM link. Traffic from VDOM-A to VDOM-B is still failing. What is the most likely missing configuration?

Accepted Answer

A VDOM link connecting VDOM-A and VDOM-B. The most likely missing configuration is a VDOM link, which is the logical interconnecting interface required to route traffic between VDOMs. Without a VDOM link, VDOM-A and VDOM-B are isolated from each other, and no firewall policy or route can forward traffic between them. The administrator must create a VDOM link (e.g., using the 'config system vdom-link' command) to establish the Layer 3 adjacency needed for inter-VDOM communication.

Answer

An inter-VDOM routing policy under system settings

Answer

A policy in VDOM-B allowing traffic from the VDOM link to port2

Answer

A static route in VDOM-A pointing to VDOM-B's subnet

Question 10

An administrator creates a new VDOM and assigns interfaces. The VDOM is intended to operate in transparent mode. Which additional step is required?

Accepted Answer

Set the VDOM's mode to transparent under config system settings. A VDOM does not default to transparent mode; it must be explicitly configured. The command 'config system settings' with 'set vdom-type transparent' changes the VDOM's operational mode from the default NAT/route mode to transparent mode, which is required for the VDOM to function as a Layer 2 bridge.

Answer

Disable NAT on all policies

Answer

Configure a management IP for the VDOM

Answer

No additional steps; VDOMs default to transparent mode

Question 11

You deploy a FortiGate in transparent mode for a retail branch. The upstream router's ARP table shows the FortiGate's management IP, but end users cannot reach the internet. The FortiGate's management IP is on the same subnet as the users. What should you verify first?

Accepted Answer

The firewall policy allows traffic from internal to external. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not require a routing table for user traffic; forwarding decisions are based on firewall policies. Since the management IP is on the same subnet as users, the upstream router can ARP for it, but user traffic must be explicitly allowed by a firewall policy from the internal to external zone. Without such a policy, packets are dropped even if Layer 2 connectivity exists.

Answer

The upstream router is forwarding traffic to the FortiGate's management MAC

Answer

The FortiGate's routing table has a default route

Answer

The FortiGate's management interface is in the same VDOM as user traffic

Question 12

A network admin runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. The output shows `duration=3600`, meaning the session has been active for 3600 seconds (1 hour), and `expire=3599`, meaning the session will expire in 3599 seconds (approximately 1 hour). The `proto=6` indicates TCP (protocol 6), and `proto_state=01` corresponds to TCP state ESTABLISHED. Therefore, the session was established 1 hour ago and will expire in about 1 hour, making option A correct.

Answer

The session is using UDP port 443

Answer

The session is for HTTP traffic and has 3599 seconds left

Answer

The session is for HTTPS traffic and is halfway through its expected lifetime

Question 13

In a multi-VDOM deployment, an administrator needs to centralize logging for all VDOMs. Which FortiGate feature should be used to send logs to a central FortiAnalyzer?

Accepted Answer

Log configuration under each VDOM's settings. In a multi-VDOM FortiGate deployment, each VDOM operates as an independent virtual firewall with its own log settings. To centralize logging to a FortiAnalyzer, you must configure the log settings individually under each VDOM, specifying the FortiAnalyzer as the log destination. This ensures that logs from all VDOMs are forwarded to the central FortiAnalyzer, as global log settings do not apply across VDOMs.

Answer

FortiGate Cloud

Answer

Global log settings

Answer

Syslog server

Question 14

An administrator wants to use FortiManager to deploy a common set of firewall rules to all VDOMs on a single FortiGate. The rules will be the same except for the source and destination addresses, which differ per VDOM. What FortiManager feature allows the administrator to reuse a policy package and customize per-VDOM objects?

Accepted Answer

Meta fields. Meta fields in FortiManager allow you to define custom variables that can be assigned to managed devices or VDOMs. When a policy package is installed, these meta fields are substituted with the per-VDOM values, enabling the reuse of a single policy package with different source and destination addresses for each VDOM. This avoids the need to create separate policy packages for each VDOM.

Answer

Policy package header/footer

Answer

Automation stitches

Answer

Global ADOM

Question 15

An administrator is configuring a FortiGate in transparent mode for a retail store. The store has a flat network with a single subnet. Which TWO of the following statements about transparent mode are correct? (Select TWO.)

Accepted Answer

The FortiGate uses a management IP address for administrative access. Option B is correct because in transparent mode the FortiGate does not act as a router for user traffic; instead, each interface is bridged and the device is reachable for management (HTTPS, SSH, etc.) through a dedicated management IP address assigned to the bridge or an interface. Option E is correct because transparent-mode FortiGates still enforce firewall policies, and policies are applied between the bridge interfaces (or between the bridge and its member interfaces) to permit or deny traffic, so security inspection and control are preserved. Option A is incorrect because VIPs for destination NAT are a routing/NAT-mode feature; transparent mode forwards frames at Layer 2 and does not use VIP-based destination NAT in the same way. Option C is incorrect because transparent mode does not perform inter-VLAN routing; the FortiGate bridges interfaces within the same subnet rather than routing between VLANs. Option D is incorrect because a default route is not required to forward user traffic in transparent mode, since forwarding is based on Layer 2 bridging rather than Layer 3 routing decisions.

Answer

Virtual IPs (VIPs) can be used for destination NAT

Answer

The FortiGate will perform routing between VLANs

Answer

The FortiGate requires a default route to forward user traffic