Courseiva
Enterprise Firewall and VDOMshardMultiple ChoiceObjective-mapped

NSE7 Enterprise Firewall and VDOMs Practice Question

A FortiGate in a multi-VDOM environment has a management VDOM (mgmt-vdom) and a traffic VDOM (corp-vdom). The admin wants to access the FortiGate GUI using IP 10.0.1.1 assigned to port1 in mgmt-vdom. However, the GUI is unreachable. The admin can SSH into mgmt-vdom. What is the most likely cause?

⚠ Common exam trap

Many candidates assume enabling 'allowaccess' on the interface alone is sufficient for GUI access, overlooking the fact that FortiGate's implicit deny in the VDOM's policy layer blocks all inbound traffic unless an explicit permit policy exists.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

The management VDOM has an implicit deny policy blocking inbound HTTPS

In a multi-VDOM FortiGate, each VDOM has its own independent firewall policies. Even if HTTPS access is enabled on the interface (set allowaccess https), the management VDOM (mgmt-vdom) still requires an explicit firewall policy to permit inbound HTTPS traffic from the source to the FortiGate's own IP. Without such a policy, the implicit deny rule at the end of the policy list blocks the GUI connection. SSH works because it is typically allowed by a separate policy or by default administrative access rules, but HTTPS is not implicitly permitted.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • The admin must enable 'set allowaccess https' under the interface configuration

    Why it's wrong here

    While this is necessary, the question states the GUI is unreachable; the most likely cause is policy blocking, as SSH works.

  • The management VDOM has an implicit deny policy blocking inbound HTTPS

    Why this is correct

    Even in the management VDOM, a policy must explicitly allow HTTPS access. Without it, the GUI is blocked.

  • The FortiGate is in transparent mode and requires a management IP

    Why it's wrong here

    No indication of transparent mode.

  • The traffic VDOM's routing table is incorrect

    Why it's wrong here

    Traffic VDOM routing doesn't affect management VDOM GUI access.

Visual reference

Source Router + ACL permit 10.0.0.0/8 deny any Server 10.0.0.5 ✓ 192.168.1.1 ✗ dropped ACLs evaluate top-down; first match wins — implicit deny all at end

About these practice questions

Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.