NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator is configuring a new FortiGate with multiple VDOMs. The administrator wants to ensure that each VDOM has its own independent routing table and that traffic between VDOMs is inspected by firewall policies. Which TWO statements about inter-VDOM routing are correct? (Choose two.)
⚠ Common exam trap
The trap here is assuming that inter-VDOM links are like VLANs or can connect multiple VDOMs at once; they are strictly point-to-point and do not use tagging.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Inter-VDOM links are virtual interfaces that must be created in pairs, with each end assigned to a different VDOM.
Inter-VDOM links are virtual point-to-point interfaces that connect two VDOMs, allowing each VDOM to have its own routing table. Traffic across these links is inspected by firewall policies and can have UTM profiles applied. They do not use VLAN tagging and are not used in transparent mode VDOMs. These characteristics make them suitable for secure inter-VDOM communication.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Inter-VDOM links require the use of 802.1Q VLAN tagging to differentiate traffic.
Why it's wrong here
Inter-VDOM links are internal virtual interfaces and do not use VLAN tagging. They are not physical interfaces, so 802.1Q tags are not applicable. The VDOM assignment itself provides the separation, and the link is a dedicated point-to-point connection without the need for VLANs.
- ✓
Inter-VDOM links are virtual interfaces that must be created in pairs, with each end assigned to a different VDOM.
Why this is correct
Inter-VDOM links are indeed virtual interfaces created in pairs. One end is assigned to one VDOM and the other end to another VDOM, providing a point-to-point connection. This design allows each VDOM to maintain its own routing table while enabling traffic to pass between them under policy control.
- ✓
Traffic traversing an inter-VDOM link is subject to firewall policies and UTM inspection.
Why this is correct
Inter-VDOM link traffic is treated like any other interface traffic; it must be permitted by a firewall policy and can be subjected to UTM profiles such as antivirus, IPS, and application control. This ensures that inter-VDOM communication adheres to the same security policies as external traffic.
- ✗
Inter-VDOM links can be configured in transparent mode VDOMs without IP addresses.
Why it's wrong here
In transparent mode, VDOMs operate as bridges and do not use IP addresses on interfaces for routing. Inter-VDOM links are designed for NAT/route mode to enable IP routing between VDOMs. They require IP addresses to route traffic. Transparent mode VDOMs would use different mechanisms, such as VDOM links in transparent mode, but that is not the standard inter-VDOM link.
- ✗
A single inter-VDOM link can connect more than two VDOMs simultaneously.
Why it's wrong here
An inter-VDOM link is a point-to-point connection between exactly two VDOMs. To connect multiple VDOMs, you need multiple inter-VDOM links or a shared VDOM acting as a hub. A single link cannot directly connect more than two VDOMs; that would require a different topology.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.