NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator has a FortiGate with multiple VDOMs in NAT/route mode. VDOM-1 and VDOM-2 are connected via an inter-VDOM link. The administrator wants to apply security profiles to traffic passing between the VDOMs. However, when checking the policy list in VDOM-1, no policy is shown for traffic destined to VDOM-2. What is the most likely reason?
⚠ Common exam trap
The trap here is assuming that inter-VDOM traffic is automatically allowed or that policies are only needed in one VDOM, when in fact policies are required in both VDOMs for traffic to pass and be inspected.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The administrator must create a policy in each VDOM that allows traffic from the inter-VDOM link interface to the destination interface.
Inter-VDOM traffic requires explicit firewall policies in both the source and destination VDOMs. The administrator must create a policy in VDOM-1 allowing traffic from the internal interface to the inter-VDOM link, and a corresponding policy in VDOM-2 from the inter-VDOM link to the internal interface. Without these, traffic is not allowed and no policy exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The inter-VDOM link interfaces have not been assigned to a zone, so policies cannot reference them.
Why it's wrong here
While zones can simplify policy configuration, they are not required. Policies can reference individual interfaces directly. The absence of a zone assignment does not prevent policy creation or visibility. The issue is not related to zone configuration.
- ✗
Inter-VDOM link traffic is not subject to firewall policies by default.
Why it's wrong here
Inter-VDOM link traffic is subject to firewall policies. The absence of a policy indicates a configuration issue, not that policies are bypassed. Firewall policies must be explicitly created to allow and inspect traffic between VDOMs, so this statement is incorrect.
- ✓
The administrator must create a policy in each VDOM that allows traffic from the inter-VDOM link interface to the destination interface.
Why this is correct
To allow and inspect traffic between VDOMs, you must create firewall policies in both VDOMs. For traffic from VDOM-1 to VDOM-2, a policy is needed in VDOM-1 (from internal to inter-VDOM link) and another in VDOM-2 (from inter-VDOM link to internal). Without these policies, traffic is dropped and no policy is shown because none exists yet.
- ✗
The administrator is looking at the wrong VDOM; policies for inter-VDOM traffic are only visible in the root VDOM.
Why it's wrong here
Policies for inter-VDOM traffic are configured within each VDOM, not solely in the root VDOM. Each VDOM has its own policy table. The root VDOM does not automatically contain policies for other VDOMs. Therefore, looking in the root VDOM would not reveal the missing policy.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.