NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate in a multi-VDOM environment has a management VDOM (mgmt-vdom) and a traffic VDOM (corp-vdom). The admin wants to access the FortiGate GUI using IP 10.0.1.1 assigned to port1 in mgmt-vdom. However, the GUI is unreachable. The admin can SSH into mgmt-vdom. What is the most likely cause?
⚠ Common exam trap
Many candidates assume enabling 'allowaccess' on the interface alone is sufficient for GUI access, overlooking the fact that FortiGate's implicit deny in the VDOM's policy layer blocks all inbound traffic unless an explicit permit policy exists.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The management VDOM has an implicit deny policy blocking inbound HTTPS
In a multi-VDOM FortiGate, each VDOM has its own independent firewall policies. Even if HTTPS access is enabled on the interface (set allowaccess https), the management VDOM (mgmt-vdom) still requires an explicit firewall policy to permit inbound HTTPS traffic from the source to the FortiGate's own IP. Without such a policy, the implicit deny rule at the end of the policy list blocks the GUI connection. SSH works because it is typically allowed by a separate policy or by default administrative access rules, but HTTPS is not implicitly permitted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The admin must enable 'set allowaccess https' under the interface configuration
Why it's wrong here
While this is necessary, the question states the GUI is unreachable; the most likely cause is policy blocking, as SSH works.
- ✓
The management VDOM has an implicit deny policy blocking inbound HTTPS
Why this is correct
Even in the management VDOM, a policy must explicitly allow HTTPS access. Without it, the GUI is blocked.
- ✗
The FortiGate is in transparent mode and requires a management IP
Why it's wrong here
No indication of transparent mode.
- ✗
The traffic VDOM's routing table is incorrect
Why it's wrong here
Traffic VDOM routing doesn't affect management VDOM GUI access.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.