NSE7 Enterprise Firewall and VDOMs Practice Test 9 — 15 Questions

Question 1

A network administrator wants to logically separate two departments on a single FortiGate. Each department must have its own firewall policies, routing table, and administrators. Which feature should be used?

Accepted Answer

Virtual Domains (VDOMs). Virtual Domains (VDOMs) allow a single FortiGate to be partitioned into multiple independent virtual firewalls, each with its own firewall policies, routing table, and administrative access. This meets the requirement for logical separation of departments with isolated policy and routing domains.

Answer

Policy Packages

Answer

Administrative Domains (ADOMs)

Answer

VLANs

Question 2

An enterprise uses multiple VDOMs on a FortiGate. The administrator needs to route traffic between VDOM-A and VDOM-B using a firewall policy. What is the correct configuration step?

Accepted Answer

Configure a VDOM link between the two VDOMs and create a policy allowing traffic. Option C is correct because a VDOM link creates a direct Layer 2 or Layer 3 connection between two VDOMs, allowing traffic to be controlled by firewall policies. This is the only method that enables policy-based inter-VDOM routing without requiring external cables or complex routing configurations.

Answer

Place both VDOMs in the same virtual router and use regular policies

Answer

Create a static route in each VDOM pointing to the other VDOM's virtual interface

Answer

Enable inter-VDOM routing globally under system settings

Question 3

A FortiGate has VDOMs enabled. An administrator runs 'get system status' and sees only one VDOM listed. However, the administrator configured two VDOMs earlier. What is the most likely cause?

Accepted Answer

The command only shows the management VDOM; use 'config vdom' to see all. When VDOMs are enabled, the 'get system status' command displays only the management VDOM (the VDOM from which the administrator is currently logged in). To see all configured VDOMs, the administrator must use the 'config vdom' command followed by 'show' or 'get system status' within the global context. Option D correctly identifies this behavior, as the second VDOM is not deleted or hidden by a bug; it simply is not shown by that command.

Answer

The second VDOM was deleted by another administrator

Answer

VDOM mode is not enabled globally

Answer

The second VDOM has a different name and is hidden due to a bug

Question 4

An administrator is configuring a FortiGate in transparent mode for a data center segment. Which of the following is true about transparent mode operation in an enterprise environment?

Accepted Answer

Transparent mode operates at Layer 2, so no IP configuration is needed on the FortiGate interfaces. In transparent mode, the FortiGate operates as a Layer 2 bridge, forwarding traffic based on MAC addresses rather than IP addresses. This means the FortiGate interfaces do not require IP addresses for traffic forwarding; a management IP is configured on a VLAN interface or the root VDOM for administrative access only. Option B correctly identifies that transparent mode functions at Layer 2, so no IP configuration is needed on the physical interfaces for data plane operation.

Answer

The FortiGate requires an IP address on each interface to route between VLANs

Answer

Transparent mode is only available on specific hardware models

Answer

Transparent mode supports NAT and VPN termination

Question 5

A FortiGate administrator needs to manage multiple FortiGate devices centrally. They want to deploy policy packages from FortiManager to specific VDOMs on each device. Which FortiManager object must be configured first?

Accepted Answer

Administrative Domain (ADOM). The Administrative Domain (ADOM) is the top-level container in FortiManager that defines the management boundary for a set of FortiGate devices and their VDOMs. Before you can create or assign policy packages to specific VDOMs on managed devices, you must first configure the ADOM to enable multi-tenancy and VDOM-level management. Without an ADOM, FortiManager cannot isolate or target individual VDOMs for policy deployment.

Answer

Device Group

Answer

Install Preview

Answer

Policy Package

Question 6

An administrator runs 'diagnose debug application fnbam 3' and sees many entries with state 'sctp'. The FortiGate has flow-based inspection enabled. What is being indicated?

Accepted Answer

Traffic is being fast-forwarded without security profile inspection. The 'diagnose debug application fnbam 3' command shows the FortiGate's flow-based Network Processor (NPU) session offload status. When entries show state 'sctp', it indicates that the traffic is being handled by the SCTP (Session Control Traffic Path) fast-path, meaning the session is offloaded to the NPU for hardware acceleration and bypasses security profile inspection. This is normal for flow-based inspection when traffic matches fast-path criteria, not an indication of SCTP protocol inspection or attacks.

Answer

The FortiGate is performing SCTP deep inspection

Answer

The FortiGate is using proxy-based inspection

Answer

There is an SCTP-based attack in progress

Question 7

What is the purpose of a management VDOM in a multi-VDOM FortiGate?

Accepted Answer

To provide a dedicated VDOM for system administration and management traffic. A management VDOM is a dedicated administrative VDOM that isolates system management traffic (e.g., SSH, HTTPS, SNMP, syslog) from data-plane VDOMs. This ensures that administrative access and logging remain available even if a data VDOM fails or is misconfigured, and it prevents management traffic from competing with production traffic for resources.

Answer

To apply security profiles for all VDOMs

Answer

To route all inter-VDOM traffic

Answer

To host customer-facing services

Question 8

A FortiGate administrator configures inter-VDOM routing. Traffic from VDOM-A to VDOM-B is blocked. The administrator checks the policy in VDOM-A allowing traffic to the VDOM link interface. What else must be verified?

Accepted Answer

That there is a corresponding policy in VDOM-B allowing traffic from the VDOM link to the destination. In inter-VDOM routing, traffic traverses a VDOM link, which consists of two interfaces—one in each VDOM. A policy in VDOM-A permits traffic to the VDOM link interface, but the packet must also be allowed by a policy in VDOM-B from the VDOM link interface to the destination. Without this second policy, VDOM-B will drop the traffic, even if VDOM-A's policy is correct.

Answer

That the VDOM link uses a different interface type

Answer

That the VDOM link interface is in the same subnet

Answer

That inter-VDOM routing is enabled in system settings

Question 9

An administrator configures VDOMs on a FortiGate and assigns port1 to VDOM-A and port2 to VDOM-B. The administrator then creates a firewall policy in VDOM-A to allow traffic from port1 to the VDOM link. Traffic from VDOM-A to VDOM-B is still failing. What is the most likely missing configuration?

Accepted Answer

A VDOM link connecting VDOM-A and VDOM-B. The most likely missing configuration is a VDOM link, which is the logical interconnecting interface required to route traffic between VDOMs. Without a VDOM link, VDOM-A and VDOM-B are isolated from each other, and no firewall policy or route can forward traffic between them. The administrator must create a VDOM link (e.g., using the 'config system vdom-link' command) to establish the Layer 3 adjacency needed for inter-VDOM communication.

Answer

An inter-VDOM routing policy under system settings

Answer

A policy in VDOM-B allowing traffic from the VDOM link to port2

Answer

A static route in VDOM-A pointing to VDOM-B's subnet

Question 10

A FortiManager administrator wants to deploy a policy package that contains shared header and footer policies across multiple devices. How should these policies be configured in FortiManager?

Accepted Answer

Configure the policies as header/footer policies within the policy package. In FortiManager, header and footer policies are specifically designed to be shared across multiple devices within a policy package. By configuring them as header/footer policies, the administrator ensures that these common rules are applied consistently at the top and bottom of the device-specific policy tables, while the middle policies can vary per device. This is the correct method for deploying shared policies without duplicating them in each device's policy set.

Answer

Define the policies in the ADOM's default policy package

Answer

Create a global policy package and assign it to all devices

Answer

Use the 'install preview' feature to merge policies

Question 11

What is the function of FortiAnalyzer in a Fortinet Security Fabric?

Accepted Answer

To collect logs and generate reports and incidents. FortiAnalyzer is the centralized logging and reporting appliance within the Fortinet Security Fabric. It collects logs from FortiGate and other Fabric components, correlates events, generates compliance reports, and creates incidents for security analysis. This aligns directly with option A, as its primary function is log aggregation and report generation, not real-time management or VPN termination.

Answer

To manage VDOM configurations

Answer

To act as a VPN concentrator

Answer

To provide real-time firewall management

Question 12

An administrator creates a new VDOM and assigns interfaces. The VDOM is intended to operate in transparent mode. Which additional step is required?

Accepted Answer

Set the VDOM's mode to transparent under config system settings. A VDOM does not default to transparent mode; it must be explicitly configured. The command 'config system settings' with 'set vdom-type transparent' changes the VDOM's operational mode from the default NAT/route mode to transparent mode, which is required for the VDOM to function as a Layer 2 bridge.

Answer

Disable NAT on all policies

Answer

Configure a management IP for the VDOM

Answer

No additional steps; VDOMs default to transparent mode

Question 13

A FortiGate administrator is planning a multi-VDOM deployment for a service provider. Which TWO statements are true about VDOM limitations and best practices?

Accepted Answer

It is recommended to use a dedicated management VDOM. Option C is correct because using a dedicated management VDOM is a best practice in multi-VDOM deployments. It isolates administrative traffic (e.g., HTTPS, SSH, SNMP) from data-plane VDOMs, ensuring that management access remains available even if a data VDOM fails or is misconfigured. This also simplifies auditing and RBAC by centralizing admin access without exposing production traffic.

Answer

There is no limit to the number of VDOMs supported

Answer

All VDOMs must share the same routing table

Answer

VDOMs cannot operate in transparent mode

Question 14

An administrator configures FortiManager automation stitches to respond to high CPU usage on a FortiGate. The stitch should trigger a script to run diagnostics. Which THREE components are required in an automation stitch?

Accepted Answer

Trigger (e.g., event type). Option B is correct because an automation stitch in FortiManager requires a trigger to define the event that initiates the stitch, such as a high CPU usage event. The trigger specifies the event type (e.g., 'CPU Usage High') that the FortiGate reports, which then activates the stitch. Without a trigger, the automation stitch has no starting point to respond to the condition.

Answer

Condition (e.g., severity threshold)

Answer

Result (e.g., email notification)

Question 15

A FortiGate administrator wants to use FortiAnalyzer to view traffic logs from multiple VDOMs. Which TWO steps must the administrator perform on FortiAnalyzer?

Accepted Answer

Add the FortiGate as a device in FortiAnalyzer. Option B is correct because FortiAnalyzer must have the FortiGate added as a managed device in order to receive and process logs from it. This registration establishes the trust relationship and log-receiving configuration between the two systems.

Answer

Install a security profile on FortiAnalyzer

Answer

Create a separate ADOM for each VDOM

Answer

Enable FortiAnalyzer's built-in firewall