NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator is configuring a FortiGate in multi-VDOM mode. The administrator wants to assign a physical interface to a non-management VDOM. The interface currently belongs to the root VDOM and has an IP address. What must the administrator do first?
⚠ Common exam trap
The trap here is thinking that simply changing the VDOM assignment will automatically clear the IP address or that disabling the interface is sufficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the IP address and any references from the root VDOM, then assign the interface to the target VDOM.
To move a physical interface from one VDOM to another, the interface must not have an IP address or be referenced in any configuration, such as firewall policies or routing. The administrator must remove the IP address and any references from the current VDOM first. After that, the interface can be assigned to the target VDOM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disable the interface, change its VDOM, and then re-enable it.
Why it's wrong here
Simply disabling the interface does not remove its IP address or references. The FortiGate will still prevent the VDOM change if the interface has an IP address or is referenced in policies. The administrator must explicitly remove the IP address and any dependencies before reassigning the interface.
- ✗
Enable administrative access on the interface and then change its VDOM assignment.
Why it's wrong here
Enabling administrative access is not a prerequisite for changing VDOM assignment. In fact, administrative access settings are part of the interface configuration and would be removed when the interface is moved. The key requirement is to clear any IP address and references that would prevent the move.
- ✗
Create a VDOM link between the root VDOM and the target VDOM, then move the interface.
Why it's wrong here
A VDOM link is used for routing between VDOMs, not for moving interfaces. Creating a VDOM link does not address the interface's existing IP address or references. The interface must be clean of conflicting configuration before it can be reassigned to another VDOM.
- ✓
Remove the IP address and any references from the root VDOM, then assign the interface to the target VDOM.
Why this is correct
Before moving a physical interface to another VDOM, it must not have any configuration that conflicts, such as an IP address or references in firewall policies. The administrator must remove the IP address and any references from the root VDOM. Then the interface can be assigned to the target VDOM without errors.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.