NSE7 Enterprise Firewall and VDOMs Practice Test 5 — 15 Questions

Question 1

A network administrator needs to create a separate firewall policy for the guest network while keeping management traffic in the main VDOM. Which VDOM type should be configured for the guest network?

Accepted Answer

Traffic VDOM. Option D is correct because a Traffic VDOM is a lightweight VDOM type designed specifically to handle user traffic, such as guest network traffic, without the overhead of management-plane functions. It allows the administrator to separate guest traffic into its own firewall policy domain while keeping management traffic (e.g., SSH, HTTPS, SNMP) in the main Root VDOM, ensuring that guest users cannot access the management interface or configuration.

Answer

Root VDOM

Answer

Administrative VDOM

Answer

Management VDOM

Question 2

An administrator runs 'diagnose debug vd case <vdom_name>' and receives the error 'VDOM not found'. The VDOM exists and is configured. What is the most likely cause?

Accepted Answer

The VDOM name is misspelled or has incorrect case. The 'diagnose debug vd case' command is case-sensitive and expects the exact VDOM name as configured. Even if the VDOM exists, a mismatch in letter case (e.g., typing 'VDOM1' instead of 'vdom1') will cause the 'VDOM not found' error because the command performs a literal string comparison without case normalization.

Answer

The VDOM is a traffic VDOM and requires a different command

Answer

The VDOM is administratively disabled

Answer

The administrator is in the wrong VDOM context

Question 3

In a multi-VDOM deployment, inter-VDOM routing is configured using VDOM links. After configuring the VDOM links and adding static routes, traffic between VDOMs is not working. The administrator verifies that the VDOM link interfaces are up and have correct IP addresses. What is the most likely missing configuration?

Accepted Answer

Firewall policies are missing or not allowing the traffic. In a FortiGate multi-VDOM deployment, VDOM links create a direct Layer 3 connection between VDOMs, but traffic is still subject to firewall policies. Even with correct IP addresses and static routes, inter-VDOM traffic will be dropped unless explicit firewall policies are configured on both VDOMs to permit the traffic. This is because FortiGate enforces stateful inspection at every VDOM boundary, including VDOM links.

Answer

The inter-VDOM routing mode is set to 'nat' instead of 'route'

Answer

The VDOM links are not assigned to the correct VDOM

Answer

The VDOMs are in different administrative domains

Question 4

A FortiGate is operating in transparent mode and is deployed in an enterprise network. The administrator needs to apply a security policy to control traffic between two VLANs. What is a key consideration when configuring policies in transparent mode?

Accepted Answer

The policy is applied to the Layer 2 interface where the traffic enters. In transparent mode, the FortiGate acts as a Layer 2 bridge, and security policies are applied to the ingress interface where traffic enters the device. This allows the firewall to filter traffic between VLANs based on Layer 3 and Layer 4 criteria without requiring IP addresses on the interfaces, as the device is transparent to the network.

Answer

Transparent mode does not support firewall policies

Answer

The policy must be applied to the management IP address

Answer

Policies must be configured using MAC addresses only

Question 5

A FortiManager administrator is configuring ADOMs to manage multiple FortiGates. The administrator wants to ensure that changes to the central management policy package are automatically pushed to managed devices. Which setting should be enabled?

Accepted Answer

Enable 'Auto-update' in the policy package. Option B is correct because enabling 'Auto-update' in the policy package on FortiManager ensures that any changes made to the central management policy package are automatically pushed to all managed FortiGates. This setting triggers an immediate installation of the policy package to the devices whenever a change is committed, eliminating the need for manual installation. It is specifically designed for centralized policy management in ADOM environments.

Answer

Enable 'Auto-link' on the device

Answer

Configure a schedule for policy installation

Answer

Enable 'Central Management' on the FortiGate

Question 6

A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?

Accepted Answer

The traffic is being processed by a different VDOM than expected. Option D is correct because FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.

Answer

The session is already established and the policy change is not applied to existing sessions

Answer

The policy is disabled

Answer

The policy has an incorrect schedule

Question 7

What is the purpose of a management VDOM on a FortiGate?

Accepted Answer

To provide a dedicated environment for administrative access and management protocols. A management VDOM is a dedicated virtual domain that isolates administrative traffic (e.g., HTTPS, SSH, SNMP, syslog) from data-plane traffic. This ensures that management access and protocols like RADIUS or TACACS+ authentication are processed in a separate context, preventing interference with production VDOMs and allowing granular administrative access control.

Answer

To log all administrative actions

Answer

To route traffic between different VDOMs

Answer

To increase the number of available firewall policies

Question 8

An administrator configured a new policy package in FortiManager and assigned it to a FortiGate. After installing the policy package, the FortiGate shows the new policies, but traffic is not matching them. What could be the reason?

Accepted Answer

The policy package is installed to the root VDOM instead of the target VDOM. If the policy package uses a different ADOM or the device is not properly synchronized, the policies may not apply correctly. The most common issue is that the policy package is not installed to the correct VDOM on the FortiGate.

Answer

The policy package has not been committed

Answer

The FortiGate has not been added to the ADOM

Answer

The FortiGate is in transparent mode

Question 9

In FortiManager, what is the difference between a Global ADOM and a regular ADOM?

Accepted Answer

Global ADOM allows sharing of global objects across all ADOMs. In FortiManager, a Global ADOM is a special administrative domain that stores global objects (such as address objects, services, and policies) that can be shared and referenced by all regular ADOMs. This centralizes management of common resources, reducing duplication and ensuring consistency across multiple ADOMs. Regular ADOMs are isolated from each other by default, but they can import objects from the Global ADOM, which is the key distinction.

Answer

Regular ADOM supports automation stitches while Global ADOM does not

Answer

Regular ADOM can only manage one FortiGate

Answer

Global ADOM is used for managing FortiGates in a single VDOM environment

Question 10

A FortiGate administrator wants to use FortiAnalyzer to generate a report on top talkers in the network. Which FortiView feature should be used?

Accepted Answer

FortiView. FortiView is the correct feature because it provides real-time and historical traffic visibility, including top talkers, directly from the FortiGate's session table and logs. FortiView's 'Top Talkers' widget aggregates traffic by source IP, destination IP, or application, allowing the administrator to generate reports on the highest bandwidth consumers without needing to run complex queries in Log Analytics.

Answer

Log Analytics

Answer

Playbooks

Answer

Incidents

Question 11

During a security audit, it is found that traffic between two VDOMs is allowed even though no inter-VDOM routing policy is configured. The VDOMs are connected via a VDOM link. What could explain this behavior?

Accepted Answer

The VDOM link is operating in transparent mode. If the VDOM link is configured with the same VLAN ID and IP subnet, traffic may be bridged at Layer 2, bypassing Layer 3 policies. Alternatively, a policy might be implicitly allowing traffic.

Answer

The FortiGate is in NAT mode

Answer

The VDOMs are in the same administrative domain

Answer

The VDOM link is using the same interface IP

Question 12

An administrator configures an automation stitch on FortiManager to trigger a script when a specific log message is received. After saving, the stitch does not execute. What is a likely cause?

Accepted Answer

The automation stitch is not enabled. Option D is correct because automation stitches on FortiManager are disabled by default after creation. The administrator must explicitly enable the stitch before it will trigger on incoming log events. Without enabling, the stitch remains inactive regardless of other configurations.

Answer

The FortiGate is not in the same ADOM

Answer

The log message is not being sent to FortiManager

Answer

The script is not uploaded to the FortiGate

Question 13

An administrator needs to restrict inter-VDOM traffic between two VDOMs on a FortiGate. Which TWO configurations are required?

Accepted Answer

Create firewall policies in each VDOM to allow/deny traffic. Option A is correct because inter-VDOM traffic on a FortiGate is controlled by firewall policies within each VDOM. By creating policies in each VDOM that specify the VDOM link as the interface, the administrator can explicitly allow or deny traffic between the VDOMs, enforcing security boundaries. Without these policies, traffic would be implicitly denied by the default firewall behavior.

Answer

Enable inter-VDOM routing globally

Answer

Assign an IP address to the VDOM link in each VDOM

Answer

Configure static routes on each VDOM

Question 14

A FortiManager administrator is planning to deploy a new policy package to a FortiGate that has multiple VDOMs. To ensure the policy package is applied correctly to the target VDOM, which THREE steps should the administrator take?

Accepted Answer

Install the policy package to the FortiGate, selecting the correct VDOM. Option A is correct because when installing a policy package to a FortiGate with multiple VDOMs, the administrator must select the correct target VDOM in the installation wizard. This ensures the policy package is applied to the intended VDOM and not to the global or another VDOM, which could cause policy conflicts or security gaps.

Answer

Configure a revision history to track changes

Answer

Enable central management on the FortiGate

Question 15

An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?

Accepted Answer

The log data is in a different datastore than the one configured for the report. Option A is correct because FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

Answer

The report schedule is not set

Answer

The FortiAnalyzer is in a different ADOM

Answer

The FortiAnalyzer license has expired