The answer is that VDOM_A’s routing table lacks a route to VDOM_B’s subnet via the inter-VDOM link. This is the most likely cause of an inter-VDOM routing issue missing route because inter-VDOM links function as point-to-point connections between VDOMs, but they do not automatically populate routing tables—each VDOM must have an explicit static or dynamic route pointing to the destination subnet with the next-hop set to the inter-VDOM link interface on its side. Even with correctly configured inter-VDOM links and firewall policies allowing traffic, the FortiGate will drop or misforward packets if the source VDOM cannot determine how to reach the destination subnet. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding that inter-VDOM routing is a Layer 3 forwarding problem, not just a policy or link creation issue; a common trap is assuming that creating the link and policy is sufficient. Remember the memory tip: “Link and policy open the door, but a route tells the packet where the floor is.”
NSE7 Enterprise Firewall and VDOMs Practice Question
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate with multiple VDOMs is experiencing inter-VDOM routing issues. The admin has created inter-VDOM links between VDOMs and configured firewall policies allowing traffic. However, traffic from VDOM_A to VDOM_B is not reaching the destination. What is the most likely cause?
Clue words in this question
Noticing these words before you look at the options changes how you read each choice.
Clue: "most likely"
Why it matters: Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The routing table in VDOM_A does not have a route to VDOM_B's subnet via the inter-VDOM link
Inter-VDOM routing requires explicit routes in each VDOM's routing table pointing to the destination subnet via the inter-VDOM link interface. Even with inter-VDOM links and firewall policies configured, if VDOM_A lacks a route to VDOM_B's subnet through that link, traffic will be dropped or forwarded incorrectly. The routing table must contain a static or dynamic route for the destination network with the next-hop set to the inter-VDOM link's IP address on the VDOM_A side.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The inter-VDOM link's administrative status is down
Why it's wrong here
Admin would likely have checked that.
✓
The routing table in VDOM_A does not have a route to VDOM_B's subnet via the inter-VDOM link
Why this is correct
Without a route, traffic cannot be forwarded to the inter-VDOM link.
Clue confirmation
The clue word "most likely" in the question point toward this answer.
Related concept
Read the scenario before looking for a memorised answer.
✗
VDOM_B does not have an interface in the same subnet as the inter-VDOM link
Why it's wrong here
Inter-VDOM links are point-to-point with matching subnets.
✗
The traffic is blocked by an implicit deny policy in VDOM_B
Why it's wrong here
Implicit deny would block, but the scenario says policies were configured.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume inter-VDOM links and firewall policies alone are sufficient for traffic flow, overlooking the fundamental requirement of explicit routing entries in each VDOM's routing table, which is a common misstep in NSE7 scenarios.
Trap categories for this question
Scenario analysis trap
Implicit deny would block, but the scenario says policies were configured.
Detailed technical explanation
How to think about this question
Inter-VDOM links function as virtual point-to-point interfaces, each assigned a unique IP address per VDOM. For traffic to flow, the source VDOM must have a route to the destination subnet with the next-hop set to the IP address of the inter-VDOM link on the remote VDOM side. This is analogous to routing between physical interfaces; without a route, the FortiGate performs a routing lookup and fails, dropping the packet. In multi-VDOM environments, each VDOM maintains its own independent routing table, and inter-VDOM routing relies on proper static or dynamic route configuration, not just firewall policies.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The routing table in VDOM_A does not have a route to VDOM_B's subnet via the inter-VDOM link — Inter-VDOM routing requires explicit routes in each VDOM's routing table pointing to the destination subnet via the inter-VDOM link interface. Even with inter-VDOM links and firewall policies configured, if VDOM_A lacks a route to VDOM_B's subnet through that link, traffic will be dropped or forwarded incorrectly. The routing table must contain a static or dynamic route for the destination network with the next-hop set to the inter-VDOM link's IP address on the VDOM_A side.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Are there clue words in this question I should notice?
Yes — watch for: "most likely". Probability qualifier — the question wants the most probable cause or outcome, not a guaranteed one. Eliminate low-probability options.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.