Courseiva
Enterprise Firewall and VDOMshardMultiple ChoiceObjective-mapped

NSE7 Enterprise Firewall and VDOMs Practice Question

A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?

⚠ Common exam trap

It's easy for candidates to assume a permit policy anywhere in the system applies to all traffic, forgetting that VDOMs create strict administrative boundaries where policies are not shared or visible across VDOMs.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The traffic is being processed by a different VDOM than expected

FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The session is already established and the policy change is not applied to existing sessions

    Why it's wrong here

    Policy changes affect new sessions, not existing ones; but the log shows drops, not existing sessions.

  • The policy is disabled

    Why it's wrong here

    The administrator would see it as disabled in the list.

  • The policy has an incorrect schedule

    Why it's wrong here

    A schedule mismatch would cause 'policy deny' only if the schedule is outside allowed time.

  • The traffic is being processed by a different VDOM than expected

    Why this is correct

    If traffic is entering the wrong VDOM, it may not match the intended policy.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.