NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate administrator is planning to use policy packages in FortiManager to manage firewall policies for multiple devices. Which TWO statements about policy packages are true?
⚠ Common exam trap
It's easy for candidates to assume policy packages are automatically applied upon creation (Option B) or that they cannot contain NAT rules (Option C), but FortiManager requires explicit installation and fully supports NAT policies within the same package.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Header and footer policies can be used to enforce common rules across all policies
Header and footer policies in FortiManager allow administrators to enforce common rules across all policies in a policy package. Header policies are evaluated before the main policy set, and footer policies are evaluated after, ensuring consistent security controls such as logging or traffic shaping are applied universally without manual duplication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Header and footer policies can be used to enforce common rules across all policies
Why this is correct
Header policies are processed first, footer policies last, allowing consistent enforcement.
- ✗
Policy packages are automatically applied to the device upon creation
Why it's wrong here
Policy packages must be explicitly installed to the managed device.
- ✗
Policy packages cannot include NAT policies
Why it's wrong here
Policy packages can include all policy types, including NAT, VIP, and security policies.
- ✓
A policy package can be shared among multiple FortiGate devices
Why this is correct
Policy packages are template-like and can be installed on many devices in the same ADOM.
- ✗
A policy package can contain policies for different VDOMs
Why it's wrong here
Policy packages are per ADOM, which is typically one VDOM per device. They do not span multiple VDOMs.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.