NSE7 Enterprise Firewall and VDOMs Practice Test 7 — 15 Questions

Question 1

A FortiGate in HA mode has two VDOMs: VDOM1 and VDOM2. The administrator needs to ensure that if the active unit fails, the standby unit takes over with minimal disruption. Which TWO steps should be taken?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Enable session synchronization. Session synchronization ensures that stateful firewall sessions (e.g., TCP/UDP connections) are replicated from the active FortiGate to the standby unit. In HA active-passive mode, this allows the standby to seamlessly take over active sessions upon failover, minimizing disruption. Without session synchronization, all existing connections would be dropped and must be re-established.

Answer

Set the HA mode to active-active

Answer

Enable HA on each VDOM individually

Answer

Use VDOM link for inter-VDOM traffic

Question 2

An administrator uses FortiManager automation stitches to respond to an incident. The stitch includes a trigger, one or more actions, and conditions. Which THREE components are valid action types in an automation stitch?

Accepted Answer

CLI script execution. In FortiManager automation stitches, valid action types include CLI script execution (A), which runs a saved CLI script on the target FortiGate to apply configuration changes or remediation commands; Remote script execution (B), which runs a script on a remote device such as an endpoint or syslog server via SSH or similar; and Email notification (D), which sends an alert email to specified recipients when the stitch trigger fires. These three are the standard action types available when building a stitch, alongside others like webhook and SNMP trap. FortiGate reboot (C) is not a selectable action type in an automation stitch; rebooting would have to be scripted via CLI, not chosen as a built-in action. FortiAnalyzer report generation (E) is also not an automation stitch action type; reports are generated through FortiAnalyzer's reporting features, not as a stitch action.

Answer

FortiGate reboot

Answer

FortiAnalyzer report generation

Question 3

A company is deploying FortiGate in transparent mode between an existing router and LAN switch. Which TWO statements about transparent mode are true?

Accepted Answer

The FortiGate forwards traffic based on MAC addresses. In transparent mode, FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. It inspects packets at the application layer but does not modify the Layer 3 header, making it transparent to the network.

Answer

Each interface requires an IP address

Answer

The FortiGate can perform routing

Answer

Transparent mode supports multiple VDOMs

Question 4

What is the purpose of a Global ADOM in FortiManager?

Accepted Answer

To share common objects and policies across multiple ADOMs. A Global ADOM in FortiManager is a special administrative domain that stores objects and policies shared across multiple regular ADOMs. This allows administrators to define common objects (e.g., address groups, services, schedules) once in the Global ADOM and then reference them in per-ADOM policies, ensuring consistency and reducing duplication. It does not replace the root ADOM, nor is it limited to backups or single-VDOM management.

Answer

To store backup configurations only

Answer

To manage all FortiGates in a single VDOM

Answer

To replace the root ADOM for system settings

Question 5

An administrator configures a FortiGate in transparent mode with two VDOMs. Each VDOM is assigned to a different VLAN. The administrator wants to apply a common security policy to traffic between the VLANs. What is the correct approach?

Accepted Answer

Use inter-VDOM routing linked to a policy in the global policy set. In transparent mode, FortiGate VDOMs are isolated by default, and traffic between VLANs assigned to different VDOMs must traverse an inter-VDOM link. The correct approach is to use inter-VDOM routing and apply a security policy in the global policy set, which allows a common policy to govern traffic crossing VDOM boundaries. This ensures that the policy is evaluated once for inter-VDOM traffic, rather than requiring separate policies in each VDOM.

Answer

Assign both VLANs to the same VDOM and apply a policy there

Answer

Apply the policy on the management VDOM

Answer

Configure a single policy on the root VDOM that matches all VLANs

Question 6

A network engineer is deploying FortiGate VDOMs and needs to limit the number of VDOMs per FortiGate to comply with licensing. Which command can be used to check the maximum VDOMs allowed?

Accepted Answer

get system status. The 'get system status' command displays the current FortiGate system status, including the maximum number of VDOMs allowed by the installed license. This is the correct command to verify the licensed VDOM limit before deploying additional VDOMs.

Answer

show system vdom

Answer

execute vdom limit

Answer

diagnose sys vdom list

Question 7

A FortiGate administrator needs to configure a new FortiGate in FortiManager for centralized management. Which TWO steps are required to add the device to an ADOM?

Accepted Answer

Add the device to the ADOM using the device manager. The Device Manager in FortiManager is the interface used to add a device to an ADOM. After adding the device, it must be authorized (Option E) to establish a management tunnel and allow configuration synchronization. Without authorization, the device remains in a pending state and cannot be managed.

Answer

Create a policy package before adding the device

Answer

Configure a VDOM link on the FortiGate

Answer

Enable automation stitches on the FortiGate

Question 8

An administrator configures inter-VDOM routing between VDOMs A and B. Both VDOMs are on the same FortiGate. The admin creates a policy allowing traffic from VDOM A to VDOM B. Traffic from VDOM A to VDOM B fails. What is the most likely cause?

Accepted Answer

There is no firewall policy in VDOM B to allow the return traffic. In a FortiGate inter-VDOM routing setup, traffic initiated from VDOM A to VDOM B requires a firewall policy in VDOM B to permit the return traffic. Without this policy, the FortiGate's stateful inspection engine drops the return packets because no session exists in VDOM B's session table. This is a common misconfiguration where administrators only create a policy in the source VDOM.

Answer

VDOM A and VDOM B must be in the same administrative VDOM

Answer

The VDOMs are in transparent mode

Answer

The inter-VDOM link is not configured

Question 9

A FortiGate is operating in transparent mode. Which of the following statements is true about this mode?

Accepted Answer

The FortiGate does not modify the MAC addresses of packets. In transparent mode, the FortiGate acts as a Layer 2 bridge, forwarding frames based on MAC addresses without modifying them (making option A correct). It operates as a Layer 2 device and does not require IP addresses on its interfaces for traffic forwarding, though management IP addresses can be assigned (making option D correct). Options B and C are incorrect because transparent mode does not perform routing or NAT; those functions are used in NAT/Route mode.

Answer

The FortiGate can route between different VLANs

Answer

The FortiGate can perform NAT

Question 10

An administrator configures a FortiGate with a management VDOM. Which of the following is true about the management VDOM?

Accepted Answer

The management VDOM cannot have any firewall policies. The management VDOM is a special-purpose VDOM used exclusively for out-of-band management traffic (e.g., GUI, SSH, SNMP). It operates in a separate management plane and cannot contain firewall policies because it is not designed to inspect or forward data-plane traffic. This isolation ensures that management access remains available even if the data-plane VDOMs are overloaded or misconfigured.

Answer

The management VDOM supports inter-VDOM routing

Answer

The management VDOM can be used to route production traffic

Answer

The management VDOM can be shared across multiple FortiGates in a HA cluster

Question 11

A network administrator is configuring FortiManager to manage multiple FortiGates with different VDOMs. The admin needs to ensure that each FortiGate's VDOMs can be independently managed. What is the correct configuration step?

Accepted Answer

Enable per-VDOM ADOM mode in FortiManager to manage each VDOM as a separate ADOM. FortiManager's per-VDOM ADOM mode allows each VDOM on a FortiGate to be treated as an independent ADOM, enabling separate management of policies, objects, and settings per VDOM. This is essential when different VDOMs serve distinct tenants or departments and must not share configuration contexts.

Answer

Use a single ADOM for all FortiGates

Answer

Configure each FortiGate as a separate device in the Global ADOM

Answer

Use the same policy package for all VDOMs

Question 12

An administrator wants to limit the number of VDOMs that can be created on a FortiGate. What should the administrator configure?

Accepted Answer

Set the 'max-vdom' option under 'config system global'. The 'max-vdom' option under 'config system global' directly limits the number of VDOMs that can be created on a FortiGate. This setting enforces a hard cap on the total VDOM count, regardless of licensing or administrative roles. By default, the value is set to 10 on most models, but it can be increased up to the maximum supported by the platform or license.

Answer

Use the 'config vdom' command to delete unused VDOMs

Answer

Configure the VDOM license on FortiManager

Answer

Set the 'vdom-admin' option to 'enable'

Question 13

A FortiGate administrator receives an error when trying to create a new VDOM: 'Maximum number of VDOMs reached.' However, the FortiGate model supports more VDOMs. What could be the issue?

Accepted Answer

The VDOM license is not installed or is expired. The error 'Maximum number of VDOMs reached' occurs when the FortiGate attempts to exceed the licensed VDOM count, even if the hardware model supports more. FortiGate VDOM licensing is enforced via a separate license file; without a valid, non-expired license, the device restricts VDOM creation to the default (often 1 or 2) or previously licensed limit. This is a common issue when a license has expired or was never installed.

Answer

The administrator is in the wrong VDOM context

Answer

The FortiGate is in transparent mode

Answer

The FortiGate needs a firmware upgrade

Question 14

An administrator is configuring FortiManager to manage a multi-VDOM FortiGate. The administrator wants to ensure that policy changes are not accidentally applied without review. Which THREE measures should be taken? (Choose three.)

Accepted Answer

Use install preview to review changes before deploying. Option C is correct because FortiManager's install preview (Install Wizard preview) shows exactly which policy packages, objects, and configuration changes will be pushed to the managed FortiGate before the install is committed, allowing the administrator to review and reject unintended changes. Option D is correct because disabling automatic policy installation prevents FortiManager from pushing policy changes to the FortiGate without an explicit administrator-initiated install, which is the core safeguard against unreviewed deployments. Option E is correct because ADOM locking prevents other administrators from making concurrent modifications to the same ADOM, avoiding conflicting or unreviewed edits being merged into the policy set. Option A is not appropriate because sharing the same password across all devices is a security weakness and does nothing to enforce change review. Option B is not relevant because meta fields are only descriptive tags for organizing and searching devices, not a control that blocks or reviews policy installation.

Answer

Use the same password for all devices

Answer

Configure meta fields to track device location

Question 15

A FortiGate administrator wants to use FortiAnalyzer to generate reports on traffic patterns for each VDOM separately. Which TWO configuration steps are required? (Choose two.)

Accepted Answer

Enable per-VDOM logging on the FortiGate. Option C is correct because FortiGate must have per-VDOM logging enabled (config log setting / set vdom-mode or enabling VDOM log separation) so that each VDOM generates and tags its own log entries rather than aggregating them under the global/root context. Option E is correct because each VDOM must be configured with log forwarding to FortiAnalyzer (config log fortianalyzer setting under each VDOM, or per-VDOM log forwarding) so FortiAnalyzer actually receives the VDOM-specific logs needed for per-VDOM reports. Option A is incorrect because a single FortiAnalyzer can receive logs from multiple VDOMs; separate FortiAnalyzer appliances are not required. Option B is incorrect because disabling logging on the FortiGate would prevent any logs from reaching FortiAnalyzer, defeating the reporting goal. Option D is incorrect because although ADOMs can help organize devices/VDOMs, creating a separate ADOM per VDOM is not a mandatory configuration step to generate per-VDOM traffic reports.

Answer

Configure each VDOM to send logs to a different FortiAnalyzer

Answer

Disable logging on the FortiGate system

Answer

Create separate ADOMs for each VDOM on FortiAnalyzer