NSE7 Enterprise Firewall and VDOMs Practice Question
An organization uses FortiManager to manage multiple FortiGate devices in a Security Fabric. The administrator wants to push a new firewall policy that includes an FQDN address object. Which statement is true regarding FQDN objects in FortiManager policies?
⚠ Common exam trap
A common mix-up: candidates confuse FortiManager's installation-time resolution with FortiGate's built-in FQDN caching and periodic re-resolution (default 60 seconds), leading them to incorrectly select Option B.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly
When an administrator pushes a policy containing an FQDN address object from FortiManager, FortiManager resolves the FQDN to its current IP addresses at installation time. The resolved IPs are then written into the policy on the managed FortiGate, ensuring the policy is immediately effective without requiring the FortiGate to perform DNS resolution. This behavior is specific to FortiManager-managed policies and differs from locally configured FQDN objects on FortiGate.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
FQDN objects must be defined on each managed FortiGate individually
Why it's wrong here
They can be defined centrally.
- ✗
The FQDN resolution is done automatically every 60 seconds by FortiManager
Why it's wrong here
Resolution is done during policy installation.
- ✓
FortiManager resolves the FQDN to IP addresses at installation time and updates the policy accordingly
Why this is correct
This ensures the FortiGate has the resolved IPs.
- ✗
FQDN objects cannot be used in policies pushed from FortiManager
Why it's wrong here
FQDN objects are supported in FortiManager policies.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.