NSE7 Enterprise Firewall and VDOMs Practice Question
A FortiGate is deployed in multi-VDOM mode with two VDOMs: VDOM-1 and VDOM-2. The administrator needs to enable communication between these VDOMs using a VDOM link. Which TWO statements about VDOM link configuration are correct? (Choose two.)
⚠ Common exam trap
The trap here is assuming VDOM link interfaces must be in the same subnet or that only one link is allowed, when in fact they can be in different subnets and multiple links are possible.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Firewall policies must be configured in each VDOM to allow traffic to traverse the VDOM link.
Creating a VDOM link automatically generates a pair of interfaces, one in each VDOM, and firewall policies must be configured in both VDOMs to allow traffic. These two statements are correct. The other options contain misconceptions about subnet requirements, operational modes, or link limitations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Firewall policies must be configured in each VDOM to allow traffic to traverse the VDOM link.
Why this is correct
Even though the VDOM link provides a path between VDOMs, firewall policies in each VDOM are required to permit traffic. By default, inter-VDOM traffic is denied. You must create policies that allow traffic from the VDOM link interface to the destination network in each VDOM. This ensures security and control over inter-VDOM communication.
- ✓
A VDOM link consists of a pair of interfaces, one in each VDOM, and they are automatically created when the link is configured.
Why this is correct
When you create a VDOM link, FortiOS automatically creates a pair of interfaces, one in each VDOM. These interfaces are named like 'vlink1' and 'vlink2' and are used to route traffic between the VDOMs. They do not require physical interfaces and are internal to the FortiGate. This is a fundamental aspect of VDOM link configuration.
- ✗
The VDOM link interfaces must be assigned IP addresses in the same subnet for routing to work.
Why it's wrong here
VDOM link interfaces can have IP addresses in different subnets; they do not need to be in the same subnet. In fact, they often are in different subnets to clearly separate the VDOMs. Routing between them is achieved through static routes or dynamic routing protocols. Requiring the same subnet is a misconception.
- ✗
Only one VDOM link can exist between two VDOMs at a time.
Why it's wrong here
Multiple VDOM links can be created between the same two VDOMs if needed, for example, to provide redundancy or separate traffic types. There is no hard limit of one link per VDOM pair. However, each link creates additional interfaces and requires routing and policy configuration. This option incorrectly restricts the number of links.
- ✗
The VDOM link interfaces are always in transparent mode and cannot be assigned IP addresses.
Why it's wrong here
VDOM link interfaces operate in NAT/route mode and can be assigned IP addresses. They are not limited to transparent mode. In fact, they typically require IP addresses to enable routing between VDOMs. Transparent mode is a different operational mode for the entire VDOM, not specific to VDOM links.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.