NSE7 Enterprise Firewall and VDOMs Practice Test 9 — 15 Questions

Question 1

A FortiGate administrator needs to delegate firewall policy management to different teams for different departments. Each team should have full control over their policies but should not see or modify policies of other departments. Which feature allows this separation?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Administrative profiles (admin profiles) with restricted VDOM access. Administrative profiles with restricted VDOM access allow a FortiGate administrator to assign specific VDOMs to different admin accounts. By creating separate VDOMs for each department and granting admin accounts access only to their respective VDOMs, each team can fully manage firewall policies within their VDOM without seeing or modifying policies in other VDOMs. This leverages FortiGate's VDOM-based multi-tenancy and role-based access control (RBAC) to enforce strict policy isolation.

Answer

ADOMs in FortiAnalyzer

Answer

Policy packages in FortiManager

Answer

Security fabric tags

Question 2

An administrator is troubleshooting a FortiGate in transparent mode where clients cannot reach the internet. The FortiGate has two interfaces in the same VLAN. Which two items must be checked? (Choose two.)

Accepted Answer

The two interfaces are members of the same software switch or VDOM. In transparent mode, the FortiGate acts as a Layer 2 bridge, so the two interfaces carrying the same VLAN must be bound together into a software switch (or otherwise bridged within the same VDOM) for traffic to pass between them; option C is correct because without that binding the frames cannot traverse the FortiGate. Option E is also correct because transparent-mode traffic still requires firewall policies permitting the flow between the internal and external zones; without a matching policy, the bridge forwards nothing and clients cannot reach the internet. Option A is not required for basic connectivity, since SSL inspection is a security feature that does not affect whether traffic is forwarded. Option B is unnecessary because in transparent mode the FortiGate does not route, so a default gateway on the management IP is not needed for client traffic. Option D is incorrect because the management IP is deliberately placed on the same subnet as the bridged network so the FortiGate can be reached for administration.

Answer

SSL inspection is enabled on the policy

Answer

The default gateway is configured on the FortiGate's management IP

Answer

The management IP is on a different subnet from the bridged network

Question 3

An administrator is using FortiAnalyzer to generate a compliance report. The report should include logs from multiple FortiGates in different ADOMs. Which three actions must the administrator take? (Choose three.)

Accepted Answer

Configure a meta field to tag the devices for report filtering. Option A is correct because meta fields in FortiAnalyzer let the administrator tag devices (for example, by compliance scope or location) so the report's filters can select exactly the FortiGates that belong in the compliance report, even when they reside in different ADOMs. Option B is correct because FortiAnalyzer stores and reports on logs per ADOM, so the FortiGates must be logging to FortiAnalyzer within the relevant ADOM(s) — either consolidated in one ADOM or distributed across multiple ADOMs — for their logs to be available to the report. Option E is correct because when creating the report the administrator must set the ADOM scope (single ADOM or all ADOMs) so the report engine includes logs from every ADOM that holds the targeted FortiGates. Option C is not required: an ADOM cannot 'span' devices that are already assigned to other ADOMs, and creating a new ADOM would not automatically include their existing logs. Option D is incorrect because FortiAnalyzer does not use a 'device groups' feature to aggregate logs for reports; grouping/filtering is done through ADOM scope and meta fields.

Answer

Create a new ADOM that spans all the FortiGates

Answer

Use the 'device groups' feature in FortiAnalyzer to aggregate logs

Question 4

A security analyst notices that an automation stitch in FortiManager did not trigger when a specific event occurred on a managed FortiGate. Which three possible reasons could explain why the stitch did not fire? (Choose three.)

Accepted Answer

The trigger event type does not match the actual event. Option A is correct because a stitch only fires when the configured trigger event type exactly matches the event generated on the managed FortiGate; a mismatch (for example, configuring an IOC event trigger when the actual event is a log-based or fabric event) means the trigger never activates. Option C is correct because automation stitches can include conditions (such as matching a specific log field, severity, or value), and if that condition evaluates to false the stitch is suppressed even when the trigger event occurs. Option D is correct because a disabled automation stitch is administratively turned off and will not execute regardless of matching triggers or conditions. Option B is not correct because FortiGate automation stitches are a built-in feature and are not gated by a per-stitch license limit. Option E is not correct because the scenario states the event occurred on the managed FortiGate and the stitch failed to fire; a FortiManager-to-FortiGate connectivity issue would affect communication of the event to FortiManager, but the question asks for reasons the stitch itself did not trigger, and connectivity is not a listed stitch-level cause in this context.

Answer

The FortiGate has reached its license limit for automation stitches

Answer

The automation stitch was configured with a condition that was not met

Question 5

A FortiGate is deployed in a multi-VDOM environment with VDOMs for different tenants. The administrator wants to ensure that each VDOM has its own set of administrators and that administrators of one VDOM cannot view or modify configurations of another VDOM. Additionally, the administrator wants to restrict each VDOM administrator to manage only specific interfaces and firewall addresses within their VDOM. Which feature should the administrator configure to meet these requirements?

Accepted Answer

Administrative profiles with VDOM-level access and custom permissions for interfaces and firewall addresses.. Administrative profiles with VDOM-level access and custom permissions allow precise control over which VDOMs an administrator can access and which objects within those VDOMs they can manage. This meets both the isolation and granular restriction requirements. Other options either grant too much access or lack the necessary granularity.

Answer

VDOM-specific administrative accounts with super_admin profile.

Answer

Global admin accounts with VDOM exceptions defined in the admin profile.

Answer

RADIUS authentication with VDOM attributes mapped to user groups.

Question 6

A FortiGate 600E is configured with multiple VDOMs in NAT mode. The administrator wants to allow a server in VDOM-INT to be accessed from VDOM-EXT using a single public IP address, but without exposing the server's real IP. The administrator creates a VDOM link between the two VDOMs. Which additional configuration is required on VDOM-EXT to achieve this?

Accepted Answer

Configure a VIP on VDOM-EXT that maps the public IP to the server's private IP in VDOM-INT, and ensure a firewall policy on VDOM-INT allows the traffic from the VDOM link.. To allow external access to a server behind a FortiGate VDOM while hiding its real IP, you configure a VIP on the ingress VDOM that maps the public IP to the server's private IP. The traffic then traverses the inter-VDOM link to the server's VDOM, where a firewall policy must explicitly allow it. The VDOM link does not perform NAT; NAT must be applied on the ingress VDOM using a VIP.

Answer

Enable NAT on the VDOM link interface in VDOM-EXT and add a static route for the server's subnet pointing to the VDOM link.

Answer

Configure a VIP on VDOM-EXT that maps the public IP to the VDOM link interface IP of VDOM-INT.

Answer

Create a central SNAT policy on VDOM-EXT that translates the public IP to the server's private IP and apply it to the VDOM link interface.

Question 7

An administrator deploys a FortiGate with three VDOMs: root, Sales, and Engineering. The root VDOM is configured as the management VDOM. The administrator wants to allow SNMP polling of the FortiGate from the management network. Which configuration is required?

Accepted Answer

Enable SNMP on each VDOM that should be monitored, including enabling the SNMP agent on the management VDOM's interface.. FortiGate multi-VDOM mode requires SNMP to be enabled per VDOM. The management VDOM provides administrative access, but to poll OIDs from Sales or Engineering, SNMP must be enabled on those VDOMs as well. The interface used for management must also have the SNMP agent enabled to respond to queries.

Answer

Enable SNMP on the root VDOM and configure the management interface with the snmp-agent setting.

Answer

Configure an SNMP community on the root VDOM and set the source-ip to the management interface IP address.

Answer

Only enable SNMP on the management VDOM; other VDOMs are automatically included in SNMP queries.

Question 8

An administrator is deploying a FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own independent routing table and can use different default gateways. Which VDOM mode must be used?

Accepted Answer

NAT mode. NAT mode VDOMs are layer-3 routing domains with their own interfaces, routing tables, and default gateways. Transparent mode VDOMs are layer-2 and share a single IP subnet, so they cannot have independent default gateways. Management VDOM is a role, not a mode. Therefore, NAT mode is required to meet the design goal.

Answer

Transparent mode

Answer

Multi-VDOM transparent mode

Answer

Management VDOM mode

Question 9

An administrator is configuring a new FortiGate in multi-VDOM mode. The administrator wants to ensure that the management VDOM can manage all other VDOMs and that administrators can log in to the management VDOM to configure the entire device. Which statement about the management VDOM is correct?

Accepted Answer

The management VDOM can be any VDOM, and it allows administrators to manage all VDOMs from a single interface.. The management VDOM is a designated VDOM that provides centralized management access to all other VDOMs. It can be any VDOM, not necessarily the root, and it allows administrators to configure the entire device from a single login. This is essential for efficient administration in multi-VDOM environments.

Answer

Only the root VDOM can be the management VDOM, and it provides access to all other VDOMs.

Answer

The management VDOM is automatically created when multi-VDOM mode is enabled and is named 'mgmt'.

Answer

The management VDOM must be the root VDOM, and it has full access to all other VDOMs by default.

Question 10

An administrator configures a FortiGate in multi-VDOM mode. The root VDOM is the management VDOM. The administrator wants to restrict administrative access so that only the management VDOM's interface can be used for HTTPS GUI access. Which configuration achieves this?

Accepted Answer

On each non-management VDOM, disable HTTPS administrative access on all interfaces.. Administrative access protocols like HTTPS are enabled per interface. To ensure only the management VDOM can be used for GUI access, disable HTTPS on interfaces in all other VDOMs. This leaves the management VDOM interface as the sole entry point for GUI management, satisfying the restriction.

Answer

Create an administrator account with the management VDOM as the associated VDOM and set the trusthost to the management subnet.

Answer

Set the management VDOM to root and enable the dedicated-management setting under system global.

Answer

Disable the GUI on all VDOMs except the management VDOM by using the set gui-disable command.

Question 11

A FortiGate is configured with multiple VDOMs. The administrator has created an inter-VDOM link between VDOM-A and VDOM-B. VDOM-A is used for the internal network and VDOM-B for the DMZ. The administrator wants to allow HTTP traffic from the internal network to a web server in the DMZ. The administrator has added a firewall policy in VDOM-A from the internal interface to the inter-VDOM link interface, and a firewall policy in VDOM-B from the inter-VDOM link interface to the DMZ interface. However, traffic is not passing. What is the most likely cause?

Accepted Answer

The inter-VDOM link interfaces must be assigned IP addresses in the same subnet, and a route must be configured in each VDOM pointing to the other VDOM's inter-VDOM link IP.. Inter-VDOM links require IP addresses on each end and routing entries in each VDOM to direct traffic to the remote network. Firewall policies alone are insufficient; without routes, the FortiGate does not know how to forward packets between the VDOMs. The administrator must assign IPs to the link interfaces and add static or dynamic routes.

Answer

Firewall policies between VDOMs require a special 'inter-VDOM' policy type that must be created in the global VDOM.

Answer

The administrator must enable 'inter-VDOM routing' globally under System > Settings before traffic can pass.

Answer

The inter-VDOM link must be configured as a VLAN trunk to carry traffic between VDOMs.

Question 12

A FortiGate is configured with multiple VDOMs. The administrator wants to enable inter-VDOM routing between VDOM-1 and VDOM-2, but also wants to inspect the traffic with a security profile. Which configuration is required to apply a security profile to inter-VDOM traffic?

Accepted Answer

Apply the security profile to the firewall policy on VDOM-1 that allows traffic from the internal interface to the VDOM link interface.. To inspect inter-VDOM traffic with security profiles, the administrator must apply the profiles to a firewall policy that handles the traffic. Typically, this is the policy on the originating VDOM that allows traffic from the internal network to the VDOM link interface. This ensures that the traffic is inspected before it crosses the VDOM link. The destination VDOM's policy can also have profiles, but the ingress policy is the primary point.

Answer

Enable UTM on the VDOM link interface using the config system interface command.

Answer

Apply the security profile to the firewall policy on VDOM-2 that allows traffic from the VDOM link interface to the server.

Answer

Apply the security profile to the VDOM link interface directly, as it is a virtual interface.

Question 13

A FortiGate is configured with multiple VDOMs. The administrator needs to assign a physical interface to a VDOM but also wants to use that same interface for management access to the FortiGate. Which configuration is required?

Accepted Answer

Enable administrative access protocols (HTTPS, SSH, etc.) on the interface and ensure the VDOM has management access enabled.. To use a physical interface assigned to a VDOM for management access, enable administrative protocols like HTTPS or SSH on that interface. Also, ensure the VDOM is allowed to have management access. This allows the interface to handle both data traffic and management traffic, providing flexibility in multi-VDOM deployments without requiring a separate management interface.

Answer

Create a VLAN subinterface on the physical interface, assign the VLAN to the VDOM, and use the physical interface for management.

Answer

Enable the dedicated management interface and assign it to the management VDOM.

Answer

Configure the interface as a management interface using the 'set management-interface' command under the VDOM.

Question 14

A FortiGate has three VDOMs: root, VDOM-A, and VDOM-B. The administrator wants to limit the maximum number of sessions allowed in VDOM-A to 100,000 and in VDOM-B to 50,000. Which configuration step accomplishes this?

Accepted Answer

Edit each VDOM and set the session limit using the 'set session-limit' command under config vdom.. Per-VDOM session limits are configured by editing the VDOM and setting the session-limit value. This caps the total number of concurrent sessions allowed in that VDOM. The setting is found under 'config vdom' > 'edit <vdom>' > 'set session-limit'. It is independent for each VDOM, so VDOM-A and VDOM-B can have different limits.

Answer

In each VDOM, configure the session limit under config system session-ttl or similar.

Answer

Create a firewall policy with a session limit in each VDOM and apply it to all traffic.

Answer

Enable session limits per VDOM under system global and set the values in each VDOM's settings.

Question 15

A FortiGate is configured with multiple VDOMs. The administrator has created an inter-VDOM link between VDOM-1 and VDOM-2 and assigned IP addresses. Traffic between the VDOMs is still failing. Which two configurations are required to allow traffic to pass? (Choose two.)

Accepted Answer

A firewall policy in VDOM-1 that allows traffic from the source interface to the inter-VDOM link interface.. For inter-VDOM traffic to pass, firewall policies are required in both VDOMs. In the source VDOM, a policy must allow traffic from the internal interface to the inter-VDOM link interface. In the destination VDOM, a policy must allow traffic from the inter-VDOM link interface to the destination interface. These two policies are mandatory. Routing must also be correct, but the question asks for the configurations required to allow traffic to pass, and the policies are the definitive missing elements in this scenario.

Answer

Enable 'inter-VDOM routing' globally in the FortiGate system settings.

Answer

A static route in VDOM-1 pointing to the inter-VDOM link interface as the next-hop for the remote subnet.

Answer

Assign both inter-VDOM link interfaces to a common zone to simplify policy creation.