NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator configured a new policy package in FortiManager and assigned it to a FortiGate. After installing the policy package, the FortiGate shows the new policies, but traffic is not matching them. What could be the reason?
⚠ Common exam trap
Many exam-takers assume policy installation always applies globally, but FortiManager enforces VDOM-specific policy assignment, and failing to match the VDOM causes the policies to be present but inactive for the target traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The policy package is installed to the root VDOM instead of the target VDOM
When a policy package is installed to a FortiGate via FortiManager, the installation target must match the VDOM context of the FortiGate. If the administrator assigns the policy package to the root VDOM (or a different VDOM) instead of the specific VDOM where traffic is being processed, the policies will appear in the FortiGate's configuration but will not be applied to the correct VDOM's traffic. FortiManager installs policies per VDOM, and mismatched VDOM assignment causes the policies to be ignored by the traffic path.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The policy package is installed to the root VDOM instead of the target VDOM
Why this is correct
Policy packages are installed per VDOM; if the wrong VDOM is selected, policies won't affect the correct traffic.
- ✗
The policy package has not been committed
Why it's wrong here
FortiManager policy packages are installed after commit; if installed, they are committed.
- ✗
The FortiGate has not been added to the ADOM
Why it's wrong here
If the device was assigned a policy package, it must be in the ADOM.
- ✗
The FortiGate is in transparent mode
Why it's wrong here
Transparent mode does not prevent policy matching.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.