NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate administrator is troubleshooting an issue where IPsec VPN traffic is not being forwarded correctly in a multi-VDOM environment. Which TWO factors should the administrator verify?
⚠ Common exam trap
Many candidates assume inter-VDOM routing is a global feature that must be enabled, when in fact it is handled by per-VDOM configurations such as inter-VDOM links or policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy for the VPN traffic is present in the correct VDOM
A is correct because firewall policies are VDOM-scoped; even if the VPN tunnel is up, traffic will not be forwarded unless a policy explicitly permits it within the VDOM that owns the VPN interface. The administrator must verify that the policy allowing the IPsec traffic exists in the correct VDOM, as policies from one VDOM cannot control traffic in another.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The firewall policy for the VPN traffic is present in the correct VDOM
Why this is correct
Policy must be in the VDOM where traffic flows.
- ✓
The VPN tunnel is configured in the correct VDOM
Why this is correct
VPN configuration is VDOM-specific.
- ✗
Inter-VDOM routing is enabled globally
Why it's wrong here
Not required for VPN within same VDOM.
- ✗
The management VDOM has an IPsec policy
Why it's wrong here
Management VDOM does not handle data VPNs.
- ✗
The FortiGate is in transparent mode
Why it's wrong here
Transparent mode is not relevant to IPsec VPN.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.