NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate is configured with multiple VDOMs. The administrator wants to assign a physical interface to a specific VDOM so that it can be used for that VDOM's traffic. Which configuration step is required?
⚠ Common exam trap
It's easy for candidates to confuse VLAN subinterfaces, which allow sharing a physical interface, with assigning the entire physical interface to a single VDOM.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
In the global configuration, edit the physical interface and set the VDOM to the desired VDOM.
Assigning a physical interface to a VDOM requires editing the interface in the global configuration and setting its VDOM attribute. This moves the interface to the target VDOM, where it can be used for that VDOM's traffic. Other methods like VLANs or VDOM-specific interface lists do not achieve the same result.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
In the global configuration, edit the physical interface and set the VDOM to the desired VDOM.
Why this is correct
To assign a physical interface to a VDOM, you must edit the interface in the global configuration (or within the VDOM, depending on the model) and set its VDOM attribute. This moves the interface from the root VDOM to the specified VDOM, making it available for that VDOM's policies and routing. This is the standard procedure.
- ✗
Create a VLAN subinterface on the physical interface and assign the VLAN to the VDOM.
Why it's wrong here
Creating a VLAN subinterface is a method to share a physical interface among multiple VDOMs, but it does not assign the entire physical interface to a single VDOM. The scenario asks for assigning the physical interface itself, not a subinterface. VLANs are used for segmentation, not direct assignment.
- ✗
Use the 'set vdom' command under the interface configuration in the root VDOM.
Why it's wrong here
The 'set vdom' command is used when editing an interface, but it must be done from the global configuration context, not specifically under the root VDOM. The root VDOM is just another VDOM; the assignment is a global operation. This option is partially correct but misstates the context, making it less accurate than the global configuration approach.
- ✗
In the VDOM configuration, add the physical interface to the VDOM's interface list.
Why it's wrong here
There is no option to add a physical interface to a VDOM's interface list from within the VDOM configuration. Interfaces are assigned to VDOMs from the global configuration or by editing the interface and setting its VDOM. The VDOM configuration does not manage physical interface membership in that manner.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.