NSE7 Enterprise Firewall and VDOMs Practice Test 7 — 15 Questions

Question 1

In a multi-VDOM deployment, an administrator needs to route traffic between VDOM-A and VDOM-B. The administrator creates a VDOM link between the two VDOMs. What additional configuration is required on each VDOM to enable inter-VDOM traffic?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure a static route on each VDOM pointing to the other VDOM's networks via the VDOM link, and create a firewall policy allowing traffic. Inter-VDOM traffic via a VDOM link requires both a static route on each VDOM pointing to the remote VDOM's networks through the VDOM link interface, and a firewall policy on each VDOM that permits the desired traffic. Without the static route, the VDOM does not know how to reach the other VDOM's subnets; without the firewall policy, traffic is blocked by the implicit deny rule. The VDOM link itself provides the Layer 2 or Layer 3 connectivity between the VDOMs, but routing and policy enforcement are mandatory for traffic to flow.

Answer

Only a firewall policy on VDOM-A allowing traffic to VDOM-B

Answer

Assign the VDOM link interfaces to the same VDOM

Answer

Enable 'inter-vdom-routing' under system settings only

Question 2

An administrator is planning a FortiManager deployment to manage multiple FortiGates with multiple VDOMs. The administrator wants to use ADOMs to separate configurations. Which TWO statements about ADOMs are correct? (Choose two.)

Accepted Answer

ADOMs support revision history for tracking configuration changes. ADOMs in FortiManager maintain a revision history for each managed device or VDOM, allowing administrators to track configuration changes over time, compare revisions, and roll back to previous states if needed. This revision control is essential for auditing and troubleshooting in multi-VDOM environments.

Answer

Regular ADOMs can only contain devices with a single VDOM

Answer

Policy packages in an ADOM can be shared across different ADOMs

Answer

ADOMs cannot be renamed after creation

Question 3

A FortiGate has two VDOMs: VDOM-A and VDOM-B. The administrator wants VDOM-A to have administrative access to VDOM-B for troubleshooting. The administrator configures a management VDOM. Which THREE steps are required to allow administrative access from VDOM-A to VDOM-B? (Choose three.)

Accepted Answer

Designate VDOM-A as the management VDOM. Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.

Answer

Enable 'inter-vdom-routing' globally

Answer

Disable 'admin-sport' to allow HTTP access

Question 4

An administrator is troubleshooting a FortiGate in transparent mode. The FortiGate is not forwarding traffic between two segments connected to port1 and port2. The administrator checks the interface configuration. Which TWO configurations are REQUIRED for a transparent mode VDOM to forward traffic? (Choose two.)

Accepted Answer

Both interfaces must be members of the same hardware switch (or software bridge). In transparent mode, FortiGate acts as a Layer 2 bridge, so traffic must be switched between interfaces. Both interfaces must be members of the same hardware switch or software bridge to create a single broadcast domain, allowing frames to be forwarded based on MAC addresses. Without this, the interfaces are isolated and cannot forward traffic at Layer 2.

Answer

Spanning Tree Protocol (STP) must be enabled on both interfaces

Answer

Both interfaces must be assigned IP addresses in the same subnet

Answer

A firewall policy must allow all traffic between the two interfaces

Question 5

A network admin configures inter-VDOM routing between two VDOMs on a FortiGate. The admin creates a firewall policy in VDOM A allowing traffic to VDOM B, but traffic is still not passing. What additional step is required?

Accepted Answer

Create a firewall policy in VDOM B to permit the traffic from VDOM A. Inter-VDOM routing on a FortiGate requires firewall policies in both VDOMs to permit traffic in both directions. Even if VDOM A has a policy allowing traffic to VDOM B, VDOM B must have a corresponding policy to allow the return traffic or the initial traffic from VDOM A to be processed. Without this, the FortiGate drops the packets due to asymmetric policy enforcement.

Answer

Configure a static route in VDOM B pointing back to VDOM A

Answer

Enable inter-VDOM routing under config system global

Answer

Assign the inter-VDOM link to both VDOMs

Question 6

Which FortiManager feature allows an administrator to view the exact CLI commands that will be pushed to a managed FortiGate before installation?

Accepted Answer

Install Preview. Install Preview is the correct answer because it allows an administrator to review the exact CLI commands that FortiManager will push to a managed FortiGate during the next installation. This feature provides a pre-installation view of the configuration changes, enabling verification before committing changes to the device.

Answer

Policy Check

Answer

Revision History

Answer

Device Manager Dashboard

Question 7

An administrator is configuring a FortiGate in transparent mode for an enterprise network. The existing gateway firewall must remain in place. How should the administrator configure the FortiGate's interfaces to ensure minimal disruption?

Accepted Answer

Place both interfaces in the same VDOM and assign a shared management IP. In transparent mode, FortiGate acts as a Layer 2 bridge, so both interfaces must belong to the same VDOM and share a single management IP to allow administrative access without breaking the Layer 2 path. This configuration ensures the existing gateway firewall remains in place and traffic flows uninterrupted, as the FortiGate does not perform routing between its interfaces.

Answer

Enable VDOMs and separate the interfaces into different VDOMs

Answer

Assign each interface a unique IP address on different subnets

Answer

Use 802.1Q trunking on a single physical interface

Question 8

A FortiGate has two VDOMs: Sales and Engineering. The admin wants to allow the Engineering VDOM to manage the Sales VDOM's administrator accounts. What configuration is required?

Accepted Answer

Set the management VDOM to Engineering and configure Sales to accept admin connections from Engineering's IP. To allow the Engineering VDOM to manage the Sales VDOM's administrator accounts, the management VDOM must be set to Engineering, and the Sales VDOM must be configured to accept admin connections from Engineering's IP address. This is done via the 'set management-vdom' command under the Sales VDOM and ensuring the Sales VDOM's local-in policy permits HTTPS/SSH traffic from the Engineering VDOM's management IP. This enables cross-VDOM administrative management without requiring inter-VDOM routing or shared policies.

Answer

Use inter-VDOM routing to forward admin traffic

Answer

Enable VDOM sharing on the local-in policy

Answer

Create a super_admin account in Sales VDOM

Question 9

An administrator runs 'diagnose sys session filter dport 443' and sees 'proto=6 proto_state=01 duration=3600 expire=3599'. What does this indicate?

Accepted Answer

The session is in TCP SYN_SENT state. The output shows proto=6 (TCP) and proto_state=01 (SYN_SENT). However, a session with a duration of 3600 seconds cannot remain in SYN_SENT state; it would have timed out or transitioned to ESTABLISHED. Therefore, the output is contradictory and none of the provided options correctly describe the session. Option A is wrong because proto=6 is TCP, not UDP. Option B is wrong because a session alive for an hour cannot be in SYN_SENT. Option C is wrong because 'expire' is in seconds, not milliseconds. Option D is wrong because 'duration' is the total session time, not idle time.

Answer

The session is a UDP flow

Answer

The session will expire in 3599 milliseconds

Answer

The session has been idle for 3600 seconds

Question 10

What is the primary function of FortiAnalyzer's FortiView feature?

Accepted Answer

Real-time traffic monitoring and visualization. FortiView on FortiAnalyzer provides real-time traffic monitoring and visualization by aggregating logs from FortiGate devices and displaying them in graphical dashboards. It allows administrators to instantly view top talkers, applications, threats, and other network activity without needing to run manual queries, making it the primary function for live traffic analysis.

Answer

Centralized device configuration management

Answer

Scheduling and generating compliance reports

Answer

Automated remediation of security incidents

Question 11

A FortiGate admin configures a policy package with header and footer policies in FortiManager. What is the purpose of header policies?

Accepted Answer

They are evaluated before other policies in the same policy package. Header policies in FortiManager are evaluated before any other policies in the same policy package. This allows administrators to enforce mandatory rules—such as blocking specific traffic or applying global inspection—that must be processed first, ensuring they are not bypassed by more specific policies later in the sequence.

Answer

They are used for NAT policies only

Answer

They provide default logging for all traffic

Answer

They apply only to the root VDOM

Question 12

An organization has multiple ADOMs in FortiManager. The admin wants to share a set of firewall objects across all ADOMs. What is the best approach?

Accepted Answer

Use the Global ADOM to create global objects. The Global ADOM in FortiManager is specifically designed to create and manage global objects (such as address objects, services, and schedules) that can be shared across all regular ADOMs. When an object is created in the Global ADOM, it is automatically available in all ADOMs that are linked to it, eliminating the need for duplication. This is the only native, supported method for sharing objects across multiple ADOMs in FortiManager.

Answer

Create a meta field and assign objects

Answer

Manually recreate the objects in each ADOM

Answer

Enable object sharing in the system settings

Question 13

An admin needs to configure a FortiGate to send logs to FortiAnalyzer for a specific VDOM only. How can this be achieved?

Accepted Answer

Set the FortiAnalyzer IP in the specific VDOM's log settings. FortiGate allows per-VDOM log configuration, including the FortiAnalyzer IP address, under the VDOM's log settings. This ensures that only logs from that specific VDOM are sent to the designated FortiAnalyzer, while other VDOMs remain unaffected.

Answer

Create a separate ADOM in FortiAnalyzer for that VDOM

Answer

Configure log forwarding globally; it applies to all VDOMs

Answer

Use a firewall policy to filter logs to FortiAnalyzer

Question 14

What is the maximum number of VDOMs supported on a FortiGate 600F (assuming license)?

Accepted Answer

500. The FortiGate 600F, when properly licensed, supports up to 500 VDOMs. This is because the 600F is a mid-range enterprise appliance designed for large-scale multi-tenant environments, and its hardware resources (CPU, memory, and NP7 processors) are provisioned to handle the control-plane and data-plane overhead of up to 500 virtual domains. The license unlocks the VDOM feature, but the maximum count is a hardware-imposed limit, not a software cap.

Answer

10

Answer

50

Answer

100

Question 15

A FortiGate admin configures automation stitches in FortiManager to trigger a script when a specific incident occurs. The script runs but does not produce the expected result. Which FortiAnalyzer feature should the admin use to verify the automation stitch executed correctly?

Accepted Answer

Incident Management. Incident Management in FortiAnalyzer provides a detailed log of automation stitch execution, including trigger events, script actions, and any errors. This allows the admin to verify whether the stitch ran as expected and to diagnose why the script did not produce the intended result.

Answer

Reports

Answer

FortiView

Answer

Playbooks