NSE7 Enterprise Firewall and VDOMs Practice Question
A company has deployed two FortiGate-600Es in an active-passive HA cluster. The cluster is configured with three VDOMs: VDOM-A (corporate LAN), VDOM-B (guest Wi-Fi), and VDOM-C (DMZ). Each VDOM has its own set of interfaces and policies. The cluster is also configured to use FGCP with session pickup enabled. Recently, the network team noticed that after a failover event, some user sessions in VDOM-B are not being picked up, causing disruption for guest users. The session pickup feature is enabled globally. The administrator checks the configuration and finds the following settings on the primary FortiGate:
- config system ha set session-pickup enable set session-pickup-connectionless enable end
- config vdom edit VDOM-A config system ha set session-pickup enable end next edit VDOM-B config system ha set session-pickup disable end next edit VDOM-C config system ha set session-pickup enable end next
Based on this configuration, what is the most likely reason that sessions in VDOM-B are not being picked up?
⚠ Common exam trap
Many exam-takers assume global session pickup settings apply uniformly to all VDOMs, overlooking that per-VDOM HA settings override the global configuration, which is a common misconfiguration in multi-VDOM HA deployments.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.
The per-VDOM HA configuration for VDOM-B explicitly disables session pickup with 'set session-pickup disable'. Even though the global HA settings enable session pickup, the per-VDOM setting overrides the global setting for that VDOM. As a result, after a failover, sessions in VDOM-B are not synchronized to the standby FortiGate and are not picked up, causing disruption for guest users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The HA priority of the cluster is set too low, causing session pickup to fail for VDOM-B.
Why it's wrong here
HA priority does not affect session pickup functionality.
- ✗
Session pickup for connectionless protocols is not enabled, so UDP sessions in VDOM-B are not picked up.
Why it's wrong here
Session-pickup-connectionless is enabled globally, so UDP sessions should be picked up unless disabled per VDOM.
- ✓
Session pickup is disabled specifically for VDOM-B in the per-VDOM HA configuration.
Why this is correct
The per-VDOM setting overrides the global setting, so session pickup is disabled for VDOM-B.
- ✗
The interfaces assigned to VDOM-B do not have session pickup enabled.
Why it's wrong here
Session pickup is a VDOM-level setting, not per-interface.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.