NSE7 Enterprise Firewall and VDOMs Practice Test 6 — 15 Questions

Question 1

An administrator configures an automation stitch on FortiManager to trigger a script when a specific log message is received. After saving, the stitch does not execute. What is a likely cause?

Accepted Answer

The automation stitch is not enabled. Automation stitches on FortiManager are disabled by default after creation. The administrator must explicitly enable the stitch before it will trigger on incoming log events. Without enabling, the stitch remains inactive regardless of other configurations.

Answer

The FortiGate is not in the same ADOM

Answer

The log message is not being sent to FortiManager

Answer

The script is not uploaded to the FortiGate

Question 2

An administrator needs to restrict inter-VDOM traffic between two VDOMs on a FortiGate. Which TWO configurations are required?

Accepted Answer

Create firewall policies in each VDOM to allow/deny traffic. Inter-VDOM traffic on a FortiGate is controlled by firewall policies within each VDOM. By creating policies in each VDOM that specify the VDOM link as the interface, the administrator can explicitly allow or deny traffic between the VDOMs, enforcing security boundaries. Without these policies, traffic would be implicitly denied by the default firewall behavior.

Answer

Enable inter-VDOM routing globally

Answer

Assign an IP address to the VDOM link in each VDOM

Answer

Configure static routes on each VDOM

Question 3

A FortiManager administrator is planning to deploy a new policy package to a FortiGate that has multiple VDOMs. To ensure the policy package is applied correctly to the target VDOM, which THREE steps should the administrator take?

Accepted Answer

Install the policy package to the FortiGate, selecting the correct VDOM. When installing a policy package to a FortiGate with multiple VDOMs, the administrator must select the correct target VDOM in the installation wizard. This ensures the policy package is applied to the intended VDOM and not to the global or another VDOM, which could cause policy conflicts or security gaps.

Answer

Configure a revision history to track changes

Answer

Enable central management on the FortiGate

Question 4

An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?

Accepted Answer

The log data is in a different datastore than the one configured for the report. FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.

Answer

The report schedule is not set

Answer

The FortiAnalyzer is in a different ADOM

Answer

The FortiAnalyzer license has expired

Question 5

An administrator wants to create a separate virtual firewall instance on a FortiGate to isolate a DMZ environment. The DMZ must have its own routing table, firewall policies, and administrators. Which FortiGate feature should be used?

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) are the FortiGate feature that allows the creation of multiple independent virtual firewalls within a single physical appliance. Each VDOM operates with its own separate routing table, firewall policies, and administrative domains, making it the correct choice for isolating a DMZ environment with dedicated administrators and routing.

Answer

Virtual Router Redundancy Protocol (VRRP)

Answer

Virtual LANs (VLANs)

Answer

Security Fabric

Question 6

A FortiGate is operating in transparent mode for a VDOM. Which statement about transparent mode is TRUE?

Accepted Answer

The FortiGate operates as a Layer 2 bridge, forwarding frames without modifying source/destination MAC addresses. In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge, forwarding Ethernet frames based on MAC addresses without modifying the source or destination MAC addresses. This allows the FortiGate to inspect traffic between hosts on the same subnet without requiring IP address changes or routing, functioning as a security appliance that is transparent to the network.

Answer

Virtual IP (VIP) objects are supported in transparent mode to map public to private IPs

Answer

Each interface in the VDOM must have an IP address in the same subnet

Answer

The VDOM can have multiple IP subnets on the same broadcast domain, and the FortiGate inspects traffic between them

Question 7

An administrator runs 'diagnose sys session list' and sees sessions with 'proto=6 proto_state=02' and a long duration. The administrator is troubleshooting why sessions are not being terminated after a policy change that should block the traffic. What does 'proto_state=02' indicate?

Accepted Answer

The session is in established state (TCP connection active). In Fortinet's 'diagnose sys session list' output, 'proto=6' indicates TCP, and 'proto_state=02' maps to the TCP established state (ESTABLISHED). This means the session has completed the three-way handshake and is actively passing data. A long duration in this state explains why the session persists even after a policy change that should block new traffic—the existing session remains in the kernel session table until it times out or is explicitly cleared, because FortiGate's stateful inspection does not retroactively terminate established sessions upon policy modification.

Answer

The session is in TIME_WAIT state

Answer

The session is in SYN_SENT state, waiting for a SYN-ACK

Answer

The session is in FIN_WAIT state, closing the connection

Question 8

An administrator configures inter-VDOM routing between VDOM-A and VDOM-B using a VDOM link. After configuration, traffic from VDOM-A cannot reach VDOM-B. Which configuration step is MOST likely missing?

Accepted Answer

Create a firewall policy on VDOM-A and VDOM-B allowing traffic over the VDOM link interface. VDOM links are special inter-VDOM interfaces that require firewall policies on both VDOMs to permit traffic. Without a policy on VDOM-A and VDOM-B that allows traffic over the VDOM link interface, packets will be dropped by the implicit deny rule. This is the most common missing step when inter-VDOM routing fails.

Answer

Enable 'inter-vdom-routing' under system settings

Answer

Configure a static route on VDOM-A pointing to VDOM-B's subnet via the VDOM link

Answer

Assign both VDOM link interfaces to the same VDOM

Question 9

A FortiManager administrator creates an ADOM for the root VDOM and regular VDOMs. The administrator wants to manage only the regular VDOMs from FortiManager. Which ADOM type should be used?

Accepted Answer

Regular ADOM (non-root). A Regular ADOM (non-root) is the correct choice because it allows the administrator to manage only the regular VDOMs (non-root VDOMs) on a FortiGate, excluding the root VDOM. This ADOM type is designed for managing individual VDOMs as separate entities, providing granular control without affecting the root VDOM's global settings or other VDOMs.

Answer

Management VDOM ADOM

Answer

Root ADOM

Answer

Global ADOM

Question 10

An administrator wants to use FortiManager to push a new firewall policy to a managed FortiGate. Before installing, the administrator wants to review what changes will be applied. Which FortiManager feature should be used?

Accepted Answer

Install Preview. Install Preview (Option A) is the correct feature because it allows the administrator to see a detailed, side-by-side comparison of the current configuration on the managed FortiGate versus the pending changes that FortiManager will push. This preview is generated by FortiManager's policy compilation engine, which calculates the exact CLI commands and object modifications required to synchronize the device database (ADOM) with the managed FortiGate. It provides a safe, non-disruptive way to validate changes before committing them, reducing the risk of misconfiguration.

Answer

Policy & Objects - Install Wizard

Answer

Configuration Rollback

Answer

Revision History

Question 11

An administrator configures a firewall policy with an application control profile to block social media. The administrator observes that some social media traffic is still passing through. The traffic is HTTPS. What additional configuration is REQUIRED for application control to effectively block HTTPS-based social media?

Accepted Answer

Enable 'ssl-ssh-profile' with deep inspection on the policy. Application control requires visibility into the application layer to identify HTTPS-based traffic. Without SSL inspection, the firewall cannot decrypt the HTTPS payload to inspect the application signatures. Enabling an 'ssl-ssh-profile' with deep inspection on the policy allows the FortiGate to decrypt the traffic, apply the application control profile, and effectively block social media applications.

Answer

Set application control to proxy-based inspection

Answer

Enable 'allow-ssl-inspection' under system settings

Answer

Add a DNS filter to block social media domains

Question 12

A FortiGate in HA active-passive mode has two VDOMs. VDOM-1 is configured for management (management VDOM). The administrator connects to the management VDOM IP to manage the device. What is a characteristic of the management VDOM?

Accepted Answer

It provides administrative access and is separate from data VDOMs. In an HA active-passive setup with multiple VDOMs, a management VDOM is dedicated to administrative access (e.g., SSH, HTTPS, SNMP) and is logically separated from data VDOMs that handle production traffic. This separation ensures that management traffic does not interfere with data plane operations and that administrative access remains available even if data VDOMs experience issues. The management VDOM can be any VDOM, not necessarily the root, and its configuration is not automatically synchronized to other VDOMs.

Answer

It automatically synchronizes configuration to other VDOMs

Answer

It must be the root VDOM

Answer

It can only be accessed via the console port

Question 13

An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?

Accepted Answer

Source: all, Destination: all. In transparent mode, the FortiGate operates as a Layer 2 bridge but still inspects Layer 3 headers, so it can match on IP addresses in firewall policies. The correct answer is 'all' for both source and destination because the policy is intended to allow all internal users to any internet destination, and using 'all' ensures the policy applies broadly without unnecessary restrictions. Using specific IP subnets is also possible, but 'all' is simple and commonly used when no further filtering is required.

Answer

Source: the FortiGate's management IP, Destination: the web server's IP

Answer

Source: internal subnet, Destination: external subnet

Answer

Source: internal MAC addresses, Destination: external MAC addresses

Question 14

A FortiGate administrator configures a VDOM with a limit on the number of firewall policies. The VDOM has 200 policies, and the limit is set to 250. The administrator attempts to add a new policy but receives an error indicating the limit has been reached. What is the MOST likely reason?

Accepted Answer

The limit includes IPv4, IPv6, and other policy types. The FortiGate VDOM policy limit includes all policy types—IPv4, IPv6, and others (e.g., local-in policies, authentication policies). Even if the administrator has only 200 IPv4 policies, the total count of all policy types combined may already reach the 250 limit, preventing the addition of a new policy. This is why the error occurs despite the VDOM appearing to have room under the configured limit.

Answer

The administrator must reboot the FortiGate for the limit to take effect

Answer

The VDOM has reached the maximum number of objects, not policies

Answer

The limit is per VDOM and cannot be changed

Question 15

An administrator wants to use FortiAnalyzer to generate weekly compliance reports for all managed FortiGates. Which FortiAnalyzer feature should be used?

Accepted Answer

Reports. FortiAnalyzer's Reports feature is specifically designed to generate scheduled, customizable compliance reports that aggregate data from multiple managed FortiGates. This allows administrators to produce weekly reports aligned with regulatory standards (e.g., PCI DSS, HIPAA) without manual effort, leveraging pre-defined or custom report templates.

Answer

Incidents

Answer

FortiView

Answer

Log Analytics