Enterprise Firewall and VDOMs →mediumMultiple ChoiceObjective-mapped

NSE7 Enterprise Firewall and VDOMs Practice Question

Exhibit

Refer to the exhibit.

config vdom
    edit "VDOM1"
    config system interface
        edit "port1"
            set vdom "VDOM1"
            set ip 192.168.1.1 255.255.255.0
            set allowaccess ping https
        next
    end
    config router static
        edit 1
            set device "port1"
            set gateway 192.168.1.254
        next
    end
end

config vdom
    edit "VDOM2"
    config system interface
        edit "port2"
            set vdom "VDOM2"
            set ip 10.10.10.1 255.255.255.0
            set allowaccess ping
        next
    end
    config router static
        edit 1
            set device "port2"
            set gateway 10.10.10.254
        next
    end
end

An administrator configures two VDOMs as shown in the exhibit. They create an inter-VDOM link between VDOM1 and VDOM2. They then add a firewall policy in VDOM1 allowing traffic from port1 to the inter-VDOM link, and a policy in VDOM2 allowing traffic from the inter-VDOM link to port2. However, traffic from 192.168.1.10 to 10.10.10.50 fails. What is the most likely cause?

⚠ Common exam trap

Many candidates assume firewall policies alone control inter-VDOM traffic, overlooking that routing is a prerequisite for forwarding packets across the inter-VDOM link.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Missing route in VDOM1 for the 10.10.10.0/24 network

Inter-VDOM link traffic requires routing in both VDOMs. Even with correct firewall policies, VDOM1 must have a route to the destination network (10.10.10.0/24) pointing to the inter-VDOM link interface. Without this route, VDOM1 drops the packet before it can be forwarded across the link, causing the failure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Firewall policies are not correctly configured
Why it's wrong here
Policies are configured as described.
✗
The inter-VDOM link is not configured
Why it's wrong here
The problem states an inter-VDOM link was created.
✓
Missing route in VDOM1 for the 10.10.10.0/24 network
Why this is correct
VDOM1 needs a route to the destination network via the inter-VDOM link.
✗
The allowaccess setting on port2 does not include ping
Why it's wrong here
The issue is routing, not access.

Go deeper

NSE7 Enterprise Firewall and VDOMs Practice Question

Exhibit

Why each option matters

Option-by-option breakdown

Related to this question