NSE7 Enterprise Firewall and VDOMs Practice Test 8 — 15 Questions

Question 1

An administrator configures a multi-VDOM FortiGate in transparent mode. The admin notices that the management IP is reachable from both interfaces, but traffic passing through the device is not being inspected. What is the likely issue?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The VDOM is in transparent mode, but no firewall policy is applied to the traffic. In transparent mode, a FortiGate acts as a Layer 2 bridge, and traffic passing through the device is controlled by firewall policies, not by routing. Even though the management IP is reachable (because it is a separate IP on the bridge interface), no traffic inspection occurs unless an explicit firewall policy is configured to allow and inspect the traffic between the bridge interfaces. Option B correctly identifies that the missing firewall policy is the root cause.

Answer

Inter-VDOM routing is misconfigured

Answer

The FortiGate needs a default route

Answer

The management IP is assigned to the wrong VDOM

Question 2

An administrator needs to configure a FortiGate to ensure that antivirus scanning is performed on SMTP traffic. Which two configuration items are required? (Choose two.)

Accepted Answer

Firewall policy applying the antivirus profile. A firewall policy is required to apply an antivirus profile to SMTP traffic. Without a firewall policy that matches the SMTP traffic (typically on port 25), the FortiGate will not inspect the traffic at all. Option E is correct because the antivirus profile itself defines the scanning settings, signatures, and actions for detecting malware in SMTP attachments and message bodies.

Answer

SSL/SSH inspection profile

Answer

Application control profile

Answer

Email filter profile

Question 3

A company has a FortiGate with multiple VDOMs. The security team wants to use FortiManager to manage policies centrally. Which three steps are necessary to set up VDOM management via FortiManager? (Choose three.)

Accepted Answer

Enable VDOMs on the FortiGate and configure them for FortiManager management. VDOMs must be enabled on the FortiGate and each VDOM must be configured to allow FortiManager management. This is done by setting the 'set vdom mgmt' parameter within each VDOM or globally, which permits FortiManager to push policy and object changes to the specific VDOM context. Without this step, FortiManager cannot authenticate or communicate with the VDOMs, even if the device is added to the ADOM.

Answer

Configure a static route on FortiManager to reach the FortiGate's management IP

Answer

Disable VDOM configuration locking on FortiManager

Question 4

An administrator wants to use FortiAnalyzer to generate reports for compliance. Which two data sources can be included in a FortiAnalyzer report? (Choose two.)

Accepted Answer

Log data from FortiGate. FortiAnalyzer reports are built from log data collected from FortiGate devices, which includes traffic logs, event logs, and security logs. This log data is the primary source for compliance reporting because it provides detailed records of network activity. FortiView traffic statistics are also a valid data source, as they aggregate real-time and historical traffic data from FortiGate logs, allowing reports to include graphical summaries and top-talker information.

Answer

Routing table information from routers

Answer

Configuration backups from FortiManager

Answer

User authentication logs from LDAP servers

Question 5

What is the primary purpose of an administrative VDOM on a FortiGate?

Accepted Answer

To provide independent management and administrative access for different tenants or departments. An administrative VDOM on a FortiGate provides independent management and administrative access for different tenants or departments. Each administrative VDOM has its own administrator accounts, authentication settings, and management interfaces (HTTPS, SSH, SNMP), allowing multi-tenant isolation without requiring separate physical firewalls. This is distinct from traffic-forwarding VDOMs, which handle data plane operations.

Answer

To enable transparent mode operation

Answer

To increase the maximum number of firewall policies

Answer

To route traffic between different VDOMs

Question 6

A network administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator creates a inter-VDOM link and adds routes pointing to the link. However, traffic from VDOM-A to VDOM-B fails. What is the most likely missing configuration?

Accepted Answer

A firewall policy must be created in each VDOM to permit traffic across the inter-VDOM link. In FortiGate, inter-VDOM routing requires firewall policies in each VDOM to explicitly permit traffic across the inter-VDOM link. Without these policies, the FortiGate drops the traffic even if routes are correctly configured, because the inter-VDOM link behaves like a virtual interface that requires policy-based access control.

Answer

Both VDOMs must be in transparent mode

Answer

The inter-VDOM link must be in the same VDOM

Answer

The management VDOM must be enabled

Question 7

An administrator configures a FortiGate in transparent mode for a VDOM. After switching to transparent mode, the administrator notices that the default route disappears and traffic fails. What must be configured to restore routing?

Accepted Answer

A management IP address and default gateway for the VDOM. In transparent mode, a FortiGate VDOM acts as a Layer 2 bridge and does not participate in Layer 3 routing. The default route disappears because the VDOM has no Layer 3 interface to host a routing table. To restore management connectivity and allow the FortiGate to reach remote networks (e.g., for firmware updates or logging), you must configure a management IP address and a default gateway for the VDOM. This management IP is used solely for outbound management traffic and does not affect the bridged data plane.

Answer

A static route on the upstream router

Answer

Enable NAT mode to allow routing

Answer

Assign an IP address to each interface

Question 8

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session has been active for 1 hour and will expire in approximately 1 hour. The output shows 'duration=3600' and 'expire=3599', meaning the session has been active for 3600 seconds (1 hour) and will expire in 3599 seconds (approximately 1 hour). The 'proto=6' indicates TCP, and 'proto_state=01' is the TCP state code for an established connection (ESTABLISHED), not a half-open state. This is a normal, healthy session.

Answer

The session is a UDP session for DNS

Answer

The session is in a half-open state (SYN_RCVD)

Answer

The session is blocked because duration exceeds the timeout

Question 9

A FortiManager administrator wants to push policy package changes to a managed FortiGate, but wants to see what changes will be applied before committing. Which FortiManager feature should the administrator use?

Accepted Answer

Install preview. Install preview is the correct feature because it allows the administrator to simulate the installation of policy package changes on a managed FortiGate without actually applying them. This provides a detailed diff of what will be added, modified, or removed, enabling verification before committing the changes. It is specifically designed for pre-commit validation in FortiManager's centralized management workflow.

Answer

Meta fields

Answer

Automation stitch

Answer

Revision history

Question 10

An administrator needs to ensure that all firewall policies in a FortiGate VDOM have a common set of inspection profiles added at the end of the policy list. Which FortiManager feature best achieves this?

Accepted Answer

Policy package header/footer policies. Policy package header/footer policies in FortiManager allow you to define a set of policies that are automatically appended (or prepended) to every policy package within an ADOM or VDOM. This ensures that all firewall policies in the VDOM share a common set of inspection profiles at the end of the policy list, without manually editing each policy. It is the only feature designed specifically for this use case.

Answer

ADOM overrides

Answer

Central SNAT

Answer

Revision history

Question 11

A multi-VDOM FortiGate is running low on memory. The administrator suspects that the management VDOM is consuming excessive resources. How can the administrator limit the memory usage of the management VDOM?

Accepted Answer

Enable VDOM resource limits and configure a memory cap for the management VDOM. FortiGate VDOM resource limits allow an administrator to set a specific memory cap for each VDOM, including the management VDOM. By enabling VDOM resource limits and configuring a memory cap, the management VDOM is prevented from consuming excessive memory, ensuring fair resource allocation across all VDOMs. This is the only option that directly limits memory usage at the VDOM level without requiring hardware changes or disabling features.

Answer

Convert the management VDOM to a traffic VDOM

Answer

Move the management VDOM to a separate physical FortiGate

Answer

Disable unused features in the management VDOM

Question 12

What is the purpose of a global ADOM in FortiManager?

Accepted Answer

To provide a common object repository that can be referenced by other ADOMs. A global ADOM in FortiManager serves as a shared object repository (e.g., addresses, services, schedules) that can be referenced by other ADOMs, enabling centralized management of common objects across multiple administrative domains. This avoids duplication and ensures consistency, as changes in the global ADOM propagate to all ADOMs that reference those objects. It does not directly create or push firewall policies; instead, it provides the building blocks for policies within individual ADOMs.

Answer

To create global firewall policies applicable to all devices

Answer

To manage all devices in a single ADOM regardless of location

Answer

To store global logs from all FortiGates

Question 13

An administrator wants to group firewall objects by department (e.g., Sales, Engineering) and easily filter them in FortiManager policy packages. Which feature should be used?

Accepted Answer

Meta fields. Meta fields in FortiManager allow administrators to define custom attributes (e.g., Department) for firewall objects. These fields can then be used to group and filter objects within policy packages, enabling efficient management by department without requiring separate ADOMs or VDOMs.

Answer

Tags in FortiGate

Answer

ADOM overrides

Answer

Policy package folders

Question 14

In FortiManager, what is an automation stitch?

Accepted Answer

A sequence of automated actions triggered by a specific event. An automation stitch in FortiManager is a sequence of automated actions (such as running scripts, sending alerts, or executing CLI commands) that are triggered by a specific event (e.g., a log message, a SNMP trap, or a schedule). This allows administrators to automate incident response and policy changes without manual intervention, directly within the FortiManager fabric.

Answer

A feature to stitch multiple ADOMs together

Answer

A set of scripts that run on a schedule

Answer

A method to combine multiple policy packages

Question 15

A FortiGate in NAT mode has a VDOM with interface port1 (10.0.1.0/24) and port2 (203.0.113.0/24). A policy allows traffic from port1 to port2 with source NAT using the IP of port2. A user at 10.0.1.10 initiates a connection to a web server at 198.51.100.1. What will be the source IP after NAT?

Accepted Answer

The IP address of port2 (e.g., 203.0.113.1). When source NAT is configured to use the IP address of the egress interface (port2), the FortiGate performs dynamic PAT (Port Address Translation) and translates the source IP of the packet to the primary IP address of port2 (203.0.113.1). This is the default behavior when 'set srcaddr' is set to the interface IP in the firewall policy. The user at 10.0.1.10 will therefore appear to the web server at 198.51.100.1 as coming from 203.0.113.1.

Answer

A random IP from the port2 subnet

Answer

10.0.1.10

Answer

198.51.100.1