NSE7 Enterprise Firewall and VDOMs Practice Test 9 — 15 Questions

Question 1

An administrator sees the following error when trying to commit changes from FortiManager to a FortiGate: 'Policy check failed: Policy ID 5 uses a zone that does not exist on the device.' What is the most likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The zone referenced in the policy is not yet created on the FortiGate. The error 'Policy check failed: Policy ID 5 uses a zone that does not exist on the device' indicates that the FortiGate does not have the zone object referenced in the policy. When FortiManager pushes a policy that references a zone, the zone must already exist on the managed FortiGate; otherwise, the commit fails. Option B correctly identifies that the zone is missing on the FortiGate.

Answer

The policy package is locked by another administrator

Answer

The FortiGate is not running the same firmware version as FortiManager

Answer

The administrator has insufficient permissions

Question 2

A network engineer needs to collect logs from multiple FortiGates and generate compliance reports. Which TWO FortiAnalyzer features should be used?

Accepted Answer

Log analytics. Log analytics (option B) is correct because it provides the ability to search, filter, and visualize logs from multiple FortiGates, enabling the identification of trends and anomalies necessary for compliance reporting. Reports (option C) is correct because FortiAnalyzer includes a dedicated reporting engine that can generate scheduled or on-demand compliance reports based on collected logs, with pre-defined templates for standards like PCI DSS, HIPAA, and SOX.

Answer

ADOM configuration

Answer

Automation stitches

Answer

Policy packages

Question 3

An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?

Accepted Answer

Inspection profiles applied to the policies. Inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.

Answer

Enable SSL inspection on the inter-VDOM link interface

Answer

Static routes on both VDOMs pointing to the inter-VDOM link

Question 4

An administrator is troubleshooting a VPN tunnel that fails to establish. The administrator has verified that pre-shared keys match and phase 1 parameters are correct. Which TWO additional items should be checked?

Accepted Answer

NAT traversal configuration. NAT traversal (NAT-T) is required when a VPN tunnel passes through a device performing Network Address Translation (NAT). NAT-T encapsulates ESP packets inside UDP 4500 to avoid issues with NAT modifying IP headers. Even if phase 1 parameters match, without NAT-T enabled on both peers, the tunnel may fail to establish if a NAT device is detected between them.

Answer

The phase 2 proposal

Answer

The NTP server configuration

Answer

The FortiGate's hostname

Question 5

A network administrator wants to logically separate two departments on a single FortiGate. Each department must have its own firewall policies, routing table, and administrators. Which feature should be used?

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own firewall policies, routing table, and administrative access. This meets the requirement for logical separation of departments with isolated policy and routing domains.

Answer

Policy Packages

Answer

Administrative Domains (ADOMs)

Answer

VLANs

Question 6

An enterprise uses multiple VDOMs on a FortiGate. The administrator needs to route traffic between VDOM-A and VDOM-B using a firewall policy. What is the correct configuration step?

Accepted Answer

Configure a VDOM link between the two VDOMs and create a policy allowing traffic. A VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

Answer

Place both VDOMs in the same virtual router and use regular policies

Answer

Create a static route in each VDOM pointing to the other VDOM's virtual interface

Answer

Enable inter-VDOM routing globally under system settings

Question 7

A FortiGate has VDOMs enabled. An administrator runs 'get system status' and sees only one VDOM listed. However, the administrator configured two VDOMs earlier. What is the most likely cause?

Accepted Answer

The command only shows the management VDOM; use 'config vdom' to see all. When VDOMs are enabled, the 'get system status' command displays only the management VDOM (the VDOM from which the administrator is currently logged in). To see all configured VDOMs, the administrator must use the 'config vdom' command followed by 'show' or 'get system status' within the global context. Option D correctly identifies this behavior, as the second VDOM is not deleted or hidden by a bug; it simply is not shown by that command.

Answer

The second VDOM was deleted by another administrator

Answer

VDOM mode is not enabled globally

Answer

The second VDOM has a different name and is hidden due to a bug

Question 8

An administrator is configuring a FortiGate in transparent mode for a data center segment. Which of the following is true about transparent mode operation in an enterprise environment?

Accepted Answer

Transparent mode operates at Layer 2, so no IP configuration is needed on the FortiGate interfaces. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This means the FortiGate interfaces do not require IP addresses for traffic forwarding; a management IP is configured on a VLAN interface or the root VDOM for administrative access only. Option B correctly identifies that transparent mode functions at Layer 2, so no IP configuration is needed on the physical interfaces for data plane operation.

Answer

The FortiGate requires an IP address on each interface to route between VLANs

Answer

Transparent mode is only available on specific hardware models

Answer

Transparent mode supports NAT and VPN termination

Question 9

A FortiGate administrator needs to manage multiple FortiGate devices centrally. They want to deploy policy packages from FortiManager to specific VDOMs on each device. Which FortiManager object must be configured first?

Accepted Answer

Administrative Domain (ADOM). The Administrative Domain (ADOM) is the top-level container in FortiManager that defines the management boundary for a set of FortiGate devices and their VDOMs. Before you can create or assign policy packages to specific VDOMs on managed devices, you must first configure the ADOM to enable multi-tenancy and VDOM-level management. Without an ADOM, FortiManager cannot isolate or target individual VDOMs for policy deployment.

Answer

Device Group

Answer

Install Preview

Answer

Policy Package

Question 10

An administrator runs 'diagnose debug application fnbam 3' and sees many entries with state 'sctp'. The FortiGate has flow-based inspection enabled. What is being indicated?

Accepted Answer

Traffic is being fast-forwarded without security profile inspection. The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.

Answer

The FortiGate is performing SCTP deep inspection

Answer

The FortiGate is using proxy-based inspection

Answer

There is an SCTP-based attack in progress

Question 11

What is the purpose of a management VDOM in a multi-VDOM FortiGate?

Accepted Answer

To provide a dedicated VDOM for system administration and management traffic. A management VDOM is a dedicated administrative VDOM that isolates system management traffic (e.g., SSH, HTTPS, SNMP, syslog) from data-plane VDOMs. This ensures that administrative access and logging remain available even if a data VDOM fails or is misconfigured, and it prevents management traffic from competing with production traffic for resources.

Answer

To apply security profiles for all VDOMs

Answer

To route all inter-VDOM traffic

Answer

To host customer-facing services

Question 12

A FortiGate administrator configures inter-VDOM routing. Traffic from VDOM-A to VDOM-B is blocked. The administrator checks the policy in VDOM-A allowing traffic to the VDOM link interface. What else must be verified?

Accepted Answer

That there is a corresponding policy in VDOM-B allowing traffic from the VDOM link to the destination. In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Answer

That the VDOM link uses a different interface type

Answer

That the VDOM link interface is in the same subnet

Answer

That inter-VDOM routing is enabled in system settings

Question 13

An administrator configures VDOMs on a FortiGate and assigns port1 to VDOM-A and port2 to VDOM-B. The administrator then creates a firewall policy in VDOM-A to allow traffic from port1 to the VDOM link. Traffic from VDOM-A to VDOM-B is still failing. What is the most likely missing configuration?

Accepted Answer

A VDOM link connecting VDOM-A and VDOM-B. The most likely missing configuration is a VDOM link, which is the logical interconnecting interface required to route traffic between VDOMs. Without a VDOM link, VDOM-A and VDOM-B are isolated from each other, and no firewall policy or route can forward traffic between them. The administrator must create a VDOM link (e.g., using the 'config system vdom-link' command) to establish the Layer 3 adjacency needed for inter-VDOM communication.

Answer

An inter-VDOM routing policy under system settings

Answer

A policy in VDOM-B allowing traffic from the VDOM link to port2

Answer

A static route in VDOM-A pointing to VDOM-B's subnet

Question 14

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 15

What is the function of FortiAnalyzer in a Fortinet Security Fabric?

Accepted Answer

To collect logs and generate reports and incidents. FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Answer

To manage VDOM configurations

Answer

To act as a VPN concentrator

Answer

To provide real-time firewall management