NSE7 Enterprise Firewall and VDOMs Practice Test 8 — 15 Questions

Question 1

An administrator runs 'diagnose sys session filter dport 443' and sees the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate?

Accepted Answer

The session was established 1 hour ago and will expire in about 1 hour. proto=6 indicates TCP. Fortinet's TCP state encoding: proto_state=01 means ESTABLISHED, not SYN_SENT. This session has been established for 3600 seconds (1 hour) and will expire in 3599 seconds (about 1 hour). Therefore, it is an established TCP session, not half-open.

Answer

The session is a TCP session that has been idle for 1 hour

Answer

The session is a UDP flow

Answer

The session is in a half-open state

Question 2

What is the purpose of header and footer policies in a FortiManager policy package?

Accepted Answer

To apply policies at the top and bottom of the policy list that are not affected by reordering within the package. Header and footer policies in FortiManager policy packages allow administrators to define policies that are automatically placed at the very top (header) and very bottom (footer) of the policy list. These policies remain fixed in position and are not affected by any reordering operations performed on the regular policies within the package, ensuring that critical security controls (e.g., deny-all or allow-specific traffic) are always enforced in the correct order.

Answer

To separate IPv4 and IPv6 policies

Answer

To create backup policies

Answer

To define policies that are only used during installation

Question 3

An administrator needs to configure a FortiGate to allow inter-VDOM routing between VDOM-1 and VDOM-2. Which TWO actions are required? (Choose two.)

Accepted Answer

Configure firewall policies on each VDOM to permit traffic across the VDOM link. Inter-VDOM routing requires explicit firewall policies on each VDOM to control and permit traffic traversing the VDOM link. Without these policies, the FortiGate will drop the traffic at the VDOM boundary, even if the VDOM link is up and IP addresses are configured.

Answer

Disable NAT on all policies

Answer

Enable inter-VDOM routing under system settings

Answer

Assign an IP address to the VDOM link in only one VDOM

Question 4

A FortiGate is deployed in multi-VDOM mode. The administrator wants to use FortiAnalyzer to centralize logging from all VDOMs. Which THREE steps must be performed? (Choose three.)

Accepted Answer

Ensure that the FortiAnalyzer can reach the FortiGate's management IP. Option B is correct because FortiAnalyzer must be able to reach the FortiGate's management IP (or the FortiGate must be able to initiate the connection to FortiAnalyzer) so that log forwarding and registration traffic can flow between the two devices. Option C is correct because the FortiGate must be added and authorized as a device in FortiAnalyzer (via the FortiGate's serial number) before FortiAnalyzer will accept and store its logs. Option D is correct because in multi-VDOM mode each VDOM maintains its own FortiAnalyzer configuration, so the FortiAnalyzer IP (and often the source interface) must be configured under each VDOM that needs to send logs. Option A is wrong because log forwarding must be configured per VDOM, not only on the management VDOM, otherwise other VDOMs' logs would not be sent. Option E is wrong because there is no 'log-all-vdoms' feature on FortiGate; log forwarding to FortiAnalyzer is enabled per VDOM through the FortiAnalyzer settings.

Answer

Enable log forwarding on the management VDOM only

Answer

Enable 'log-all-vdoms' feature on the FortiGate

Question 5

A FortiGate administrator is configuring inter-VDOM routing between two VDOMs: VDOM-A and VDOM-B. The administrator wants to allow traffic from VDOM-A to reach a server in VDOM-B while keeping the VDOMs logically separated. Which configuration step is REQUIRED?

Accepted Answer

Create a VDOM link between VDOM-A and VDOM-B and configure firewall policies on both sides. Inter-VDOM routing on FortiGate requires a VDOM link, which is a logical interface pair that connects two VDOMs. Firewall policies must be configured on both sides of the VDOM link to explicitly allow traffic between the VDOMs, ensuring logical separation while enabling controlled communication. Without these policies, traffic will be dropped even if routes exist.

Answer

Configure a static route in VDOM-A pointing to the server's subnet via the VDOM-B gateway

Answer

Enable inter-VDOM routing under system settings globally

Answer

Assign the same physical interface to both VDOMs and configure routing

Question 6

An administrator runs the following command on a FortiGate: 'diagnose sys session filter dport 443' and sees output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the session?

Accepted Answer

The session is fully established and has been active for 1 hour. The output shows proto=6 (TCP) and proto_state=01, which in FortiGate's session table corresponds to TCP state ESTABLISHED. The duration=3600 indicates the session has existed for 3600 seconds (1 hour), and expire=3599 shows it will expire in 3599 seconds. This confirms the session is fully established, making option A correct.

Answer

The session will expire in 3600 seconds and has been active for 3599 seconds

Answer

The session is in a TCP SYN-SENT state and has not completed the three-way handshake

Answer

The session is using UDP on port 443

Question 7

A FortiGate administrator is configuring automation stitches in FortiManager to trigger a script when a specific log event occurs. The automation stitch includes a trigger, a set of conditions, and an action. The administrator wants the script to run only if the event is generated by devices in a specific ADOM. Which element should be configured in the trigger condition?

Accepted Answer

Add a condition for the ADOM name in the trigger. Automation stitches in FortiManager can include conditions that filter on ADOM, device group, or device name. To restrict to a specific ADOM, the condition should specify the ADOM name. This ensures only events from that ADOM trigger the action.

Answer

Configure the script to check the ADOM at runtime

Answer

Use a meta field to tag the devices and filter by meta field

Answer

Assign the automation stitch to a specific ADOM in the settings

Question 8

A FortiGate in NAT mode has multiple VDOMs. The administrator wants to centralize logging from all VDOMs to a single FortiAnalyzer. What configuration is required on the FortiGate to ensure logs from all VDOMs are sent?

Accepted Answer

Configure FortiAnalyzer logging in each VDOM individually. In a multi-VDOM FortiGate, each VDOM operates as an independent firewall with its own logging configuration. To send logs from all VDOMs to a single FortiAnalyzer, you must configure the FortiAnalyzer IP and logging settings within each VDOM individually. This ensures that each VDOM's logs are forwarded directly to the FortiAnalyzer, as there is no global or centralized log-forwarding mechanism that aggregates logs across VDOMs.

Answer

Configure the FortiAnalyzer IP under system global settings

Answer

Use the management VDOM as a log relay to FortiAnalyzer

Answer

Enable centralized logging under config log setting

Question 9

A FortiGate administrator wants to generate customized reports in FortiAnalyzer for different departments. The administrator needs to ensure that each department can only see its own logs. Which TWO configurations are necessary?

Accepted Answer

Create separate ADOMs for each department. Option B is correct because FortiAnalyzer uses ADOMs (Administrative Domains) as the primary logical container for separating logs and configuration data; creating a separate ADOM per department ensures each department's logs are isolated and only visible within that ADOM. Option C is correct because dataset filters in FortiView/reports restrict the data returned to only the relevant device group, so a report generated for one department cannot expose another department's logs even within a shared ADOM context. Option A is not required because meta fields are used for log enrichment and filtering, not for enforcing log visibility boundaries between departments. Option D is not required because per-device logging on FortiGate controls whether logs are sent, not who can view them in FortiAnalyzer. Option E is incorrect because assigning the super_admin profile grants full administrative access to all ADOMs and logs, which directly violates the requirement that each department see only its own logs.

Answer

Configure meta fields on FortiGate objects

Answer

Enable per-device logging on FortiGate

Answer

Assign each administrator the 'super_admin' profile

Question 10

A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?

Accepted Answer

Trigger. In FortiManager automation stitches, the Trigger (A) is the mandatory event-detection component that fires the stitch when the specified log event occurs on the managed FortiGate, so it must be configured. Conditions (C) are required to filter or match the specific event/log criteria so the stitch only runs for the intended threat scenario rather than every event. The Action (E) is where the CLI script is defined and executed on the managed FortiGate, which is exactly the remediation behavior the administrator wants. A Schedule (B) is not required because stitches are event-driven, not time-driven, and a Recovery action (D) is an optional component used to undo or restore state after the stitch, not a mandatory element for running a CLI script on an event.

Answer

Schedule

Answer

Recovery action

Question 11

A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?

Accepted Answer

Header and footer policies can be used to enforce common rules across all policies. Option A is correct because FortiManager policy packages support header and footer policies, which are global policy sections placed at the top and bottom of the policy list to enforce common rules (such as global deny or logging rules) consistently across all policies in the package. Option D is correct because a single policy package in FortiManager can be assigned to and installed on multiple managed FortiGate devices, which is the core purpose of policy packages for centralized, consistent policy management. Option B is incorrect because policy packages are not automatically pushed to devices upon creation; the administrator must explicitly install the policy package to the target device(s). Option C is incorrect because policy packages fully support NAT policies, including source NAT and destination NAT, as part of the firewall policy configuration. Option E is incorrect because a policy package is associated with a single VDOM context per device; policies for different VDOMs require separate policy packages.

Answer

Policy packages are automatically applied to the device upon creation

Answer

Policy packages cannot include NAT policies

Answer

A policy package can contain policies for different VDOMs

Question 12

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate?

Accepted Answer

The session is in FIN_WAIT_2 state. In FortiOS session diagnostics, the 'proto_state' field displays a hexadecimal value representing the TCP state. The value 0x0a (decimal 10) corresponds to the TCP FIN_WAIT_2 state. TIME_WAIT corresponds to 0x0b, not 0x0a. Therefore, the session is in FIN_WAIT_2 state. An excessive number of sessions in FIN_WAIT_2 may indicate that remote peers are not properly closing connections.

Answer

The session has been reset

Answer

The session is in TIME_WAIT state

Answer

The session is actively transferring data

Answer

The session is in SYN_RECEIVED state

Question 13

A FortiGate administrator wants to use FortiManager to push configuration changes to a managed FortiGate. To ensure changes are applied correctly, the administrator wants to review the exact CLI commands that will be sent. Which TWO tools can be used for this purpose?

Accepted Answer

Install preview. Option C, Install preview, is correct because FortiManager's Install Wizard provides a preview step that displays the exact CLI configuration commands (the diff) that will be pushed to the managed FortiGate before the administrator commits the install, allowing review and cancellation. Option D, Revision history, is correct because FortiManager stores configuration revisions for each managed device, and an administrator can open a revision to view or compare the CLI configuration (including the commands/diff between revisions) that was or will be applied. Option A, Device manager dashboard, is incorrect because it only shows status/monitoring widgets and summary information, not the exact CLI commands to be installed. Option B, Policy consistency check, is incorrect because it only validates policy objects/consistency across ADOMs or devices and does not display the CLI install commands. Option E, ADOM lock, is incorrect because locking an ADOM only prevents concurrent administrative changes; it does not show the CLI commands that will be sent.

Answer

Device manager dashboard

Answer

Policy consistency check

Answer

ADOM lock

Question 14

An enterprise FortiGate is configured with multiple VDOMs, including a management VDOM. The admin logs in to the management VDOM and wants to create a new VDOM and assign interfaces. However, the 'config vdom' command requires entering a VDOM name that is not 'root'. What is the correct next step?

Accepted Answer

Run 'config global' from the management VDOM to enter the global context. The management VDOM operates within the multi-VDOM context, but VDOM creation and interface assignment are global-level operations. The 'config vdom' command to create a new VDOM must be executed from the global configuration context, not from within any VDOM (including the management VDOM). Therefore, the admin must first run 'config global' to exit the management VDOM and enter the global context, where VDOMs can be created and managed.

Answer

Configure a VDOM link between the management VDOM and the new VDOM

Answer

Use the 'config vdom' command directly in the management VDOM CLI

Answer

Reboot the FortiGate in multi-VDOM mode

Question 15

A FortiGate in transparent mode is deployed in a data center. The admin notices that ARP requests from a downstream switch for the default gateway are not being answered. The FortiGate's management IP is configured on the same subnet as the switch. What is the most likely cause?

Accepted Answer

The management IP is configured on the same VLAN as the downstream switch, causing a conflict. In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in ARP for traffic passing through it. However, the management IP is used for administrative access and must be unique on the network. If the management IP is configured on the same VLAN as the downstream switch, it creates an IP address conflict with the switch's own interface or the default gateway, causing the switch to either ignore or not forward ARP requests for that IP. The FortiGate will not respond to ARP requests for the management IP if it detects a duplicate IP on the same broadcast domain, as per RFC 5227.

Answer

The downstream switch has port security enabled

Answer

The FortiGate has a firewall policy blocking ARP

Answer

The FortiGate's ARP table is full