NSE7 Enterprise Firewall and VDOMs Practice Question
A network administrator is deploying a FortiGate in multi-VDOM mode. The administrator wants to restrict a specific VDOM so that it can only use a maximum of 2 GB of system memory and 10% of the total CPU resources. Which FortiGate feature should the administrator use?
⚠ Common exam trap
A common mix-up: candidates confuse traffic shaping or QoS with system resource limits; only VDOM resource limits can cap memory and CPU usage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VDOM resource limits under System > VDOM > Edit > Resource Limits
FortiGate multi-VDOM mode includes per-VDOM resource limits that allow administrators to set maximum and guaranteed amounts of memory, CPU, and sessions. These limits are configured in the VDOM settings. By setting a maximum memory of 2 GB and CPU of 10%, the administrator can prevent the VDOM from consuming more than its share. This feature is essential for multi-tenant environments where resource isolation is required.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Traffic shaping profiles applied to the VDOM's interfaces
Why it's wrong here
Traffic shaping profiles control bandwidth allocation and prioritization for network traffic, not system memory or CPU resources. They operate on packets passing through interfaces and can limit throughput, but they do not constrain the VDOM's memory or CPU consumption. The administrator's goal is to limit system resources, not bandwidth. Traffic shaping would not enforce a 2 GB memory cap or a 10% CPU limit. A different feature is required.
- ✗
Administrative profiles assigned to VDOM administrators
Why it's wrong here
Administrative profiles define what an administrator can access and modify within the FortiGate, such as read-write permissions for firewall policies or system settings. They do not impose resource limits on a VDOM. While they can restrict administrative actions, they cannot cap memory or CPU usage. The scenario requires resource isolation, which is handled by VDOM resource limits, not by administrative profiles. Assigning a profile would not achieve the desired resource restriction.
- ✗
QoS queues configured on the VDOM's inter-VDOM links
Why it's wrong here
QoS queues manage traffic prioritization and bandwidth on interfaces, including inter-VDOM links. They do not control system memory or CPU allocation for a VDOM. QoS is about packet scheduling and shaping, not about limiting the VDOM's internal resource consumption. The administrator wants to cap memory and CPU, which is outside the scope of QoS. Using QoS would not enforce the 2 GB memory or 10% CPU limits, so it is not the correct feature.
- ✓
VDOM resource limits under System > VDOM > Edit > Resource Limits
Why this is correct
FortiGate allows administrators to set per-VDOM resource limits, including guaranteed and maximum memory, CPU, and session counts. These limits are configured in the VDOM settings under System > VDOM. By setting the maximum memory and CPU, the administrator can constrain the VDOM's resource usage. This is the correct feature for isolating and limiting resources per VDOM. It ensures that one VDOM cannot monopolize system resources, which is critical in multi-tenant deployments.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.