The answer is to designate VDOM-A as the management VDOM, create a firewall policy on VDOM-B allowing administrative access from VDOM-A’s management IP, and ensure the administrator accesses VDOM-B using VDOM-A’s management IP. This works because a management VDOM acts as a privileged administrative container that can initiate cross-VDOM administrative access management VDOM sessions; without this designation, VDOM-A lacks the inherent privilege to reach into VDOM-B. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how FortiOS isolates administrative planes while still enabling controlled troubleshooting—a common trap is forgetting that the firewall policy must be placed on the target VDOM (VDOM-B), not the source. Remember the mnemonic “MIP-FP”: Management VDOM, IP source, Firewall Policy on the target.
NSE7 Enterprise Firewall and VDOMs Practice Question
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate has two VDOMs: VDOM-A and VDOM-B. The administrator wants VDOM-A to have administrative access to VDOM-B for troubleshooting. The administrator configures a management VDOM. Which THREE steps are required to allow administrative access from VDOM-A to VDOM-B? (Choose three.)
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Designate VDOM-A as the management VDOM
Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✓
Designate VDOM-A as the management VDOM
Why this is correct
Management VDOM provides central administrative access to other VDOMs.
Related concept
Read the scenario before looking for a memorised answer.
✗
Enable 'inter-vdom-routing' globally
Why it's wrong here
Inter-VDOM routing is for data traffic between VDOMs, not for management access. Management VDOM uses its own routing.
✓
Configure static routes on the management VDOM to reach VDOM-B's management network
Why this is correct
Routes are needed for connectivity between the management VDOM and VDOM-B.
Related concept
Read the scenario before looking for a memorised answer.
✓
Create a firewall policy on VDOM-B allowing administrative access from VDOM-A's management IP
Why this is correct
Without a policy, traffic to VDOM-B's management interface is blocked.
Related concept
Read the scenario before looking for a memorised answer.
✗
Disable 'admin-sport' to allow HTTP access
Why it's wrong here
admin-sport is for specifying admin access port; not specifically related to cross-VDOM access.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often confuse inter-VDOM routing (for data traffic) with the management VDOM feature (for administrative access), leading them to incorrectly select Option B as a required step.
Detailed technical explanation
How to think about this question
When a management VDOM is configured, FortiOS uses the management VDOM's routing table and firewall policies to reach the management IP addresses of other VDOMs. The management VDOM acts as a jump host, and the administrator must configure static routes on the management VDOM to reach the management network of VDOM-B, and a firewall policy on VDOM-B must explicitly permit administrative access (e.g., HTTPS, SSH) from the management VDOM's source IP. This design ensures strict separation of management traffic from data traffic, a key requirement in multi-tenant environments like MSP deployments.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Designate VDOM-A as the management VDOM — Designating VDOM-A as the management VDOM is the first required step because it establishes VDOM-A as the administrative container that can access other VDOMs. In FortiOS, a management VDOM is a special VDOM that has visibility and control over other VDOMs for management purposes. Without this designation, VDOM-A would not have the inherent privilege to initiate administrative sessions into VDOM-B.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A multi-tenant FortiGate uses VDOMs. The administrator notices that logins via SSH to the management VDOM succeed, but attempts to SSH to a traffic VDOM's management IP fail. The traffic VDOM has an administrative user configured. What is the most likely cause?
medium
A.The traffic VDOM does not have a license
B.The traffic VDOM is in transparent mode
C.The admin user is not in the correct trust group
✓ D.SSH access is not enabled on the traffic VDOM's management interface
Why D: Option D is correct because SSH access to a VDOM's management IP requires that the management interface explicitly permits SSH administrative access. In a multi-tenant FortiGate with VDOMs, each VDOM's management interface has its own independent administrative access settings. Even if the admin user exists and the VDOM is licensed, SSH will be rejected if the management interface does not have SSH access enabled under config system interface or via the GUI. The fact that SSH to the management VDOM succeeds but fails to the traffic VDOM's management IP points directly to this per-interface access control.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.