NSE7 Enterprise Firewall and VDOMs Practice Question
A network engineer is configuring a FortiGate HA cluster with two FortiGate 100F units in active-passive mode. The engineer wants to use VDOMs to separate guest and corporate traffic. After initial setup, the engineer configures two VDOMs: 'guest' and 'corp'. Both VDOMs have interfaces assigned. The HA status shows 'synchronized'. However, the engineer notices that traffic from the corporate network is not being forwarded correctly. Pings from the corporate LAN to the internet fail. The guest network works fine. The engineer checks the routing table on the active unit and sees that the default route is present in the 'corp' VDOM. What is the most likely cause of the issue?
⚠ Common exam trap
Watch out — candidates often assume the issue is with HA synchronization or VDOM links, but the fact that one VDOM works and the other does not points directly to a per-VDOM configuration error, such as an incorrect default route gateway.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The default route in the corp VDOM has an incorrect gateway IP address.
The most likely cause is an incorrect gateway IP address in the default route for the 'corp' VDOM. Since the guest VDOM works correctly, the HA cluster and VDOM configuration are functional, and the issue is isolated to the corporate VDOM's routing. A misconfigured next-hop IP would prevent traffic from reaching the internet, even though the route itself is present in the routing table.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The interface assigned to the corp VDOM is administratively down.
Why it's wrong here
If the interface were down, the route might still be present but traffic would fail; however, the stem does not mention interface status, and the guest VDOM works, suggesting interfaces are up.
- ✓
The default route in the corp VDOM has an incorrect gateway IP address.
Why this is correct
If the gateway IP is wrong, traffic will not be forwarded, even though the route is present in the routing table.
- ✗
The HA cluster must be in active-active mode for VDOMs to work.
Why it's wrong here
VDOMs work in both active-passive and active-active HA modes.
- ✗
The VDOM link between the root VDOM and corp VDOM is not configured.
Why it's wrong here
VDOM links are used for inter-VDOM communication, not for internet access.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.