Quick Answer
The answer is that an inter-VDOM link between the VDOMs must be created, and inspection profiles must be explicitly applied to the firewall policies governing that link. This is correct because inter-VDOM traffic on a FortiGate is routed through a logical inter-VDOM link, which acts as a virtual interface pair; without applying UTM profiles—such as antivirus, web filtering, and IPS—to the policies on that link, the device forwards packets based solely on the accept/deny action, bypassing all deep packet inspection. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how multi-VDOM architectures enforce security boundaries, and a common trap is assuming that default inspection is applied automatically to inter-VDOM traffic—it is not. Remember the memory tip: “Link first, then inspect—no profile, no protection.”
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator wants to ensure that traffic between two VDOMs on the same FortiGate is properly inspected. Which THREE configurations must be in place?
Enable SSL inspection on the inter-VDOM link interface
Why wrong: SSL inspection is applied in the policy, not on the interface.
Static routes on both VDOMs pointing to the inter-VDOM link
Why wrong: Routes are necessary for routing, but not directly for inspection; the question asks for inspection.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Inspection profiles applied to the policies
Option A is correct because inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Enable SSL inspection on the inter-VDOM link interface
Why it's wrong here
SSL inspection is applied in the policy, not on the interface.
Static routes on both VDOMs pointing to the inter-VDOM link
Why it's wrong here
Routes are necessary for routing, but not directly for inspection; the question asks for inspection.
Common exam traps
The trap here is that candidates often assume SSL inspection must be enabled on the inter-VDOM link interface itself, but FortiGate requires SSL inspection to be configured as part of the inspection profile applied to the firewall policy, not on the interface.
Detailed technical explanation
When traffic flows between VDOMs over an inter-VDOM link, the FortiGate uses a virtual internal interface pair (e.g., vdom1-link and vdom2-link) that are logically connected. The firewall policies in each VDOM must permit the traffic and can optionally apply inspection profiles; without these profiles, the traffic bypasses all UTM engines. In real-world deployments, failing to apply inspection profiles can lead to undetected malware or data exfiltration between segmented networks, such as between a guest VDOM and a corporate VDOM.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — study guide chapter
Learn the concepts, then practise the questions
Enterprise Firewall and VDOMs practice questions
Targeted practice on this topic area only
All NSE7 questions
1,000 questions across all exam domains
Fortinet NSE 7 Advanced Security NSE7 study guide
Full concept coverage aligned to exam objectives
NSE7 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE7 questions linked to Advanced Networking and SD-WAN.
Practise NSE7 questions linked to Advanced VPN and Zero Trust.
Practise NSE7 questions linked to Enterprise Firewall and VDOMs.
Practise NSE7 questions linked to Advanced Threat Protection.
Practise NSE7 questions linked to Troubleshooting and Diagnostics.
Practise NSE7 questions linked to NSE7 fundamentals.
Practise NSE7 questions linked to NSE7 scenario.
Practise NSE7 questions linked to NSE7 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
The correct answer is: Inspection profiles applied to the policies — Option A is correct because inspection profiles (such as antivirus, web filtering, and IPS) must be explicitly applied to the firewall policies that govern traffic traversing the inter-VDOM link. Without these profiles, the FortiGate will forward traffic between VDOMs based solely on the policy action (accept/deny) without performing any deep packet inspection, leaving the traffic unexamined for threats. This is a fundamental requirement for UTM inspection in a multi-VDOM architecture.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator is troubleshooting a scenario where traffic between two VDOMs is not working. The admin has configured inter-VDOM routing. Which TWO steps should the administrator verify? (Choose two.)
mediumWhy B: Option B is correct because inter-VDOM routing requires firewall policies in both the source and destination VDOMs to permit traffic. The destination VDOM must have a policy allowing the return traffic (from the destination to the source) for the session to be established. Without this, the FortiGate will drop the return packets, breaking the bidirectional flow.
Variation 2. A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?
hardWhy B: When packets arrive on the VDOM link interface but are not forwarded, the issue is typically a missing or misconfigured firewall policy in the destination VDOM (VDOM-2). Even though inter-VDOM routing is correctly set up via the VDOM link, FortiGate requires an explicit firewall policy in the destination VDOM to permit traffic from the VDOM link interface to the destination server. Without this policy, the FortiGate drops the packets after routing, which matches the symptom of packets arriving but not being forwarded.
Last reviewed: Jun 24, 2026
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.