NSE7 Enterprise Firewall and VDOMs Practice Question
An administrator is planning a multi-VDOM deployment with a management VDOM. Which TWO statements about management VDOMs are correct? (Choose two.)
⚠ Common exam trap
Many exam-takers assume a management VDOM cannot have firewall policies or requires a separate license, but in reality, it can have policies for administrative access and does not incur additional licensing costs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The management VDOM can be used for FortiGuard updates
Option A is correct because in a multi-VDOM FortiGate deployment the management VDOM is specifically designed to carry out-of-band management functions, including FortiGuard update traffic (FortiGuard services such as AV/IPS signature and web-filter database downloads), which is why it is often given its own dedicated management interface and route. Option D is correct because the management VDOM is intended to host administrative access services such as HTTPS GUI and SSH, allowing administrators to log in and manage the device independently of the production VDOMs. The remaining options are incorrect: the management VDOM can still contain firewall policies (so B is false), it does not require a separate license since VDOMs are a built-in feature of the FortiGate platform (so C is false), and user traffic is not required to traverse the management VDOM—it is reserved for management-plane traffic, not data-plane forwarding (so E is false).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The management VDOM can be used for FortiGuard updates
Why this is correct
A management VDOM provides a dedicated administrative and out-of-band path, so FortiGuard update traffic can egress through it independently of production VDOMs. This satisfies the multi-VDOM requirement for segregated management-plane connectivity, letting signature and database downloads bypass data-plane routing and policy on the other VDOMs.
- ✗
The management VDOM cannot have firewall policies
Why it's wrong here
A management VDOM can hold firewall policies, including policies permitting administrative access to the FortiGate. Policies are restricted only when the VDOM is in management-only mode with no data-plane interfaces. The genuine constraints concern interface and traffic handling, not policy creation itself.
- ✗
The management VDOM requires a separate license
Why it's wrong here
Management VDOMs are a built-in administrative construct available on any multi-VDOM FortiGate; no additional licence is required to create or run one. It is tempting because separate licensing does apply to other FortiGate features, such as FortiGuard services or virtual machine capacity, so administrators may assume a management VDOM follows the same model.
- ✓
The management VDOM can host the GUI and SSH services
Why this is correct
Management VDOMs run administrative daemons such as the GUI and SSH, so they can terminate administrator sessions independently of traffic VDOMs. This satisfies the stem's requirement that the management VDOM centralises administrative access in a multi-VDOM deployment, letting the administrator reach the device without relying on a separate traffic VDOM.
- ✗
All user traffic must pass through the management VDOM
Why it's wrong here
User traffic is not required to traverse the management VDOM; it carries administrative and management-plane traffic, while data-plane traffic is handled by the other VDOMs. It is tempting because the management VDOM can host management-access interfaces, which administrators may wrongly assume must also carry production user traffic.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.