NSE7 Enterprise Firewall and VDOMs Practice Test 6 — 15 Questions

Question 1

A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Trigger. An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.

Answer

FortiView dashboard

Answer

ADOM

Question 2

A FortiGate with multiple VDOMs is experiencing inter-VDOM routing issues. The admin has created inter-VDOM links between VDOMs and configured firewall policies allowing traffic. However, traffic from VDOM_A to VDOM_B is not reaching the destination. What is the most likely cause?

Accepted Answer

The routing table in VDOM_A does not have a route to VDOM_B's subnet via the inter-VDOM link. Inter-VDOM routing requires explicit routes in each VDOM's routing table pointing to the destination subnet via the inter-VDOM link interface. Even with inter-VDOM links and firewall policies configured, if VDOM_A lacks a route to VDOM_B's subnet through that link, traffic will be dropped or forwarded incorrectly. The routing table must contain a static or dynamic route for the destination network with the next-hop set to the inter-VDOM link's IP address on the VDOM_A side.

Answer

The inter-VDOM link's administrative status is down

Answer

VDOM_B does not have an interface in the same subnet as the inter-VDOM link

Answer

The traffic is blocked by an implicit deny policy in VDOM_B

Question 3

A FortiGate admin runs the following command: 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto_state=01' and 'duration=3600, expire=3599'. What does this indicate about the session?

Accepted Answer

The session is established and has been active for 3600 seconds. The command 'diagnose sys session filter dport 443' filters sessions with destination port 443 (HTTPS). The output shows 'duration=3600, expire=3599', meaning the session has been active for 3600 seconds and will expire in 3599 seconds. The 'proto_state=01' indicates a TCP session in the established state (state 1 = TCP_ESTABLISHED). This confirms the session is fully established and actively tracked by the FortiGate session table.

Answer

The session has timed out and is being removed

Answer

The session is in a closing state

Answer

The session is in a half-open state

Question 4

A FortiGate administrator needs to inspect traffic between two VLANs in the same VDOM. The administrator has configured a firewall policy that applies an antivirus profile, but traffic is passing without inspection. What should the administrator check first?

Accepted Answer

That the firewall policy's source and destination interfaces match the VLAN interfaces. The most common reason for traffic passing without inspection in a VDOM is a misconfiguration in the firewall policy's interface matching. Since the traffic is between two VLANs, the policy must explicitly specify the correct source and destination VLAN interfaces. If the policy uses the wrong interfaces (e.g., a physical interface instead of the VLAN subinterface), the traffic will bypass the policy and its associated security profiles entirely.

Answer

The FortiGuard subscription status

Answer

Whether the antivirus profile is configured to use flow-based inspection

Answer

The antivirus profile's scan mode

Question 5

An administrator notices that after making changes to a policy package in FortiManager, the 'Install Preview' shows that the changes will modify policies on a FortiGate. However, the admin wants to verify what the exact changes will be before installing. What should the admin do?

Accepted Answer

Use the 'Revision History' to compare the current configuration with the previous version. The Revision History feature in FortiManager allows an administrator to compare the current configuration of a policy package with a previous version, showing a detailed diff of exactly which policies will be added, removed, or modified. This provides a precise verification of changes before installation, unlike the Install Preview which only indicates that changes exist without showing the specific modifications.

Answer

Check the 'Audit Log' for recent changes

Answer

Run 'diagnose dvm device list' on FortiManager

Answer

Use the 'Install Preview' and then click 'View Details' on each device

Question 6

A FortiGate with VDOMs enabled has a management VDOM (mgmt-vdom) and a traffic VDOM (traffic-vdom). The admin wants to manage the FortiGate via HTTPS from a network in traffic-vdom. What configuration is needed?

Accepted Answer

Add the interface from traffic-vdom to the management VDOM using 'set vdom mgmt-vdom' in the interface configuration. When VDOMs are enabled, the management VDOM owns the management IP addresses for the entire FortiGate. To allow HTTPS management from an interface in a non-management VDOM (traffic-vdom), that interface must be reassigned to the management VDOM using the 'set vdom mgmt-vdom' command. This makes the interface part of the management VDOM while still passing traffic for the original VDOM, enabling administrative access from that network.

Answer

Configure a static route in the management VDOM to reach traffic-vdom subnets

Answer

Enable 'admin-sport' in the global system settings

Answer

Create a firewall policy in traffic-vdom allowing HTTPS to the FortiGate's IP

Question 7

An administrator needs to ensure that traffic between two VDOMs (VDOM_A and VDOM_B) is inspected by an IPS profile. Which TWO configuration elements are required? (Choose TWO.)

Accepted Answer

An inter-VDOM link with IP addresses in the same subnet. To pass and inspect traffic between two VDOMs on a FortiGate, you must first create an inter-VDOM link (a virtual interface pair) and assign IP addresses on both ends in the same subnet, which makes option A correct because it establishes the Layer 3 connectivity between VDOM_A and VDOM_B. IPS inspection is then enforced by a firewall policy that matches the traffic and has an IPS security profile attached; option E is correct because placing the policy on VDOM_A with the inter-VDOM link as the destination interface and the IPS profile applied ensures the inter-VDOM traffic is scanned. Option B is not required because NAT is not needed for inter-VDOM routing and would not by itself enable IPS inspection. Option C is incorrect because a policy on VDOM_B with the source as the inter-VDOM link would match the return direction, not the initiating traffic, and the question requires the policy that applies the IPS profile to the inspected flow. Option D is unnecessary because an IPsec VPN is for encrypted tunnels between sites or devices, not for routing between VDOMs on the same FortiGate.

Answer

NAT enabled on the inter-VDOM link

Answer

A firewall policy on VDOM_B with the source as the inter-VDOM link

Answer

An IPsec VPN between the VDOMs

Question 8

A FortiGate administrator uses FortiManager automation stitches to respond to a security incident. Which THREE components must be defined in an automation stitch? (Choose THREE.)

Accepted Answer

Trigger condition (e.g., an event or log). In FortiManager, an automation stitch is built from three required elements: a trigger, an action, and the target devices on which the stitch operates. Option A (Trigger condition) is correct because the stitch must be initiated by a defined event or log, such as a specific log ID or FortiGate event, which starts the automation workflow. Option D (Target devices) is correct because the stitch must specify which managed FortiGates or device groups the action applies to, ensuring the response is executed on the intended devices. Option E (Action) is correct because the stitch must define what happens when the trigger fires, such as running a CLI script, sending an email, or invoking a webhook. Option B (A report template) is not required for an automation stitch; report templates are used for scheduled reports, not incident response automation. Option C (A schedule for the stitch to run) is not required because automation stitches are event-driven and execute when the trigger condition occurs, not on a time-based schedule.

Answer

A report template

Answer

A schedule for the stitch to run

Question 9

Which TWO statements about VDOM limits on FortiGate are correct? (Choose TWO.)

Accepted Answer

VDOM support requires a valid FortiGate license. VDOM support on FortiGate is a licensed feature. Without a valid FortiGate license (e.g., an Advanced or Enterprise license bundle), the VDOM functionality is disabled, and the device operates in a single-VDOM (split-task) mode. This licensing requirement ensures that only authorized models and configurations can utilize VDOM isolation.

Answer

VDOMs can be created only in NAT mode

Answer

All FortiGate models support at least 10 VDOMs

Answer

VDOMs can be added without additional memory

Question 10

A FortiGate in a multi-VDOM environment has a management VDOM (mgmt-vdom) and a traffic VDOM (corp-vdom). The admin wants to access the FortiGate GUI using IP 10.0.1.1 assigned to port1 in mgmt-vdom. However, the GUI is unreachable. The admin can SSH into mgmt-vdom. What is the most likely cause?

Accepted Answer

The management VDOM has an implicit deny policy blocking inbound HTTPS. In a multi-VDOM FortiGate, each VDOM has its own independent firewall policies. Even if HTTPS access is enabled on the interface (set allowaccess https), the management VDOM (mgmt-vdom) still requires an explicit firewall policy to permit inbound HTTPS traffic from the source to the FortiGate's own IP. Without such a policy, the implicit deny rule at the end of the policy list blocks the GUI connection. SSH works because it is typically allowed by a separate policy or by default administrative access rules, but HTTPS is not implicitly permitted.

Answer

The admin must enable 'set allowaccess https' under the interface configuration

Answer

The FortiGate is in transparent mode and requires a management IP

Answer

The traffic VDOM's routing table is incorrect

Question 11

An administrator deploys a FortiGate in transparent mode with two VDOMs: one for the internal network and one for DMZ. The admin notices that ARP requests from internal hosts are not reaching the DMZ servers even though they are on the same VLAN. What is the most likely cause?

Accepted Answer

VDOMs in transparent mode are isolated layer 2 domains; inter-VDOM routing is required for communication. In transparent mode, each VDOM acts as an independent Layer 2 forwarding domain with its own MAC address table and VLAN database. ARP requests are broadcast frames that are confined to the VDOM where they originate; they are not forwarded to other VDOMs. Therefore, even if the internal and DMZ interfaces are on the same VLAN, the ARP request from an internal host will never reach a DMZ server unless inter-VDOM routing (Layer 3 forwarding between VDOMs) is explicitly configured.

Answer

The FortiGate is not configured to proxy ARP

Answer

The internal and DMZ VDOMs are in different VLANs on the same physical interface

Answer

Transparent mode does not support VDOMs

Question 12

An administrator runs 'diagnose sys session filter dport 443' and sees:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is in SYN_SENT state. The output shows `proto=6`, indicating TCP. The `proto_state=01` corresponds to the TCP SYN_SENT state, meaning the session is in the process of establishing a connection. The `duration=3600` and `expire=3599` show the session has been active for 3600 seconds and will expire in 3599 seconds, which is typical for a session in SYN_SENT state that has not yet transitioned to ESTABLISHED. Therefore, option C is correct.

Answer

The session is a UDP session

Answer

The session is in TIME_WAIT state

Answer

The session is in ESTABLISHED state

Question 13

A FortiGate administrator is troubleshooting why a new firewall policy is not being applied to traffic. The policy has been created and installed via FortiManager. What is the quickest way to verify the current state of the policy on the FortiGate?

Accepted Answer

Run 'show firewall policy'. Running 'show firewall policy' on the FortiGate CLI displays the currently active policy set in the kernel, including the policy ID and its enabled/disabled status. This is the quickest way to confirm whether the policy installed via FortiManager is actually present and active on the FortiGate, without generating debug logs or querying the management plane.

Answer

Use 'diagnose debug flow'

Answer

Run 'execute fortimanager reindex'

Answer

Check FortiManager revision history

Question 14

A FortiGate VDOM is configured with a WAN interface (port1) and LAN interface (internal). The admin creates a policy allowing HTTP from internal to WAN with an antivirus profile applied. Users report that HTTP throughput is very slow. The admin checks the session table and sees many sessions with state 11 (TCP_CLOSE_WAIT). What is causing the performance issue?

Accepted Answer

The HTTP server is not properly closing connections, and the FortiGate is waiting for FIN from client. State 11 (TCP_CLOSE_WAIT) indicates that the FortiGate has received a FIN from the server (WAN side) and is waiting for a FIN from the client (internal side) to complete the TCP connection closure. When the HTTP server does not properly close connections, the FortiGate holds these sessions open, consuming session table resources and causing performance degradation. The antivirus profile is not the direct cause; the issue is the accumulation of sessions stuck in CLOSE_WAIT due to incomplete TCP teardown.

Answer

The antivirus profile is performing file scanning, causing delays

Answer

The policy is missing a timeout setting for TCP half-close

Answer

The FortiGate is using proxy-based inspection, which delays session closure

Question 15

An administrator uses FortiManager to deploy a new security policy to a remote FortiGate. The administrator selects 'Install Preview' and sees that the policy will be created. After confirming, the installation fails with 'Device not reachable'. What is the most likely reason?

Accepted Answer

The FortiGate is behind a NAT device that blocks FGFM traffic. The 'Device not reachable' error during an Install Preview operation indicates that FortiManager cannot establish or maintain the FGFM (FortiGate-to-FortiManager) tunnel with the remote FortiGate. When the FortiGate is behind a NAT device, the NAT may alter the source IP or port of FGFM traffic, causing the tunnel to break or preventing the FortiManager from reaching the FortiGate's management IP. This is the most common cause of such reachability failures in remote deployments.

Answer

The FortiGate has insufficient memory

Answer

The policy package is locked by another administrator

Answer

The FortiGate's configuration revision has changed since the last sync