The answer is a VDOM mismatch, because FortiGate VDOMs operate as completely independent virtual firewalls with their own routing tables and policy sets. When traffic enters a VDOM that does not contain the permit policy, the FortiGate evaluates it only against the policies within that specific VDOM, causing a policy deny drop even though a permit policy exists in a different VDOM. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of VDOM isolation and the critical link between ingress interface VDOM association and policy evaluation. A common trap is to focus solely on policy order or rule syntax, but the real culprit is often that the traffic entered the wrong VDOM. To verify, always check the VDOM assignment of the ingress interface. Memory tip: "VDOM is a walled garden—if you enter the wrong garden, the right gatekeeper won't see you."
NSE7 Enterprise Firewall and VDOMs Practice Question
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator notices that the traffic log shows sessions being dropped due to 'policy deny' even though a permit policy exists. The administrator checks the policy list and sees the policy is in the correct order. What could be a reason for this?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The traffic is being processed by a different VDOM than expected
Option D is correct because FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
The session is already established and the policy change is not applied to existing sessions
Why it's wrong here
Policy changes affect new sessions, not existing ones; but the log shows drops, not existing sessions.
✗
The policy is disabled
Why it's wrong here
The administrator would see it as disabled in the list.
✗
The policy has an incorrect schedule
Why it's wrong here
A schedule mismatch would cause 'policy deny' only if the schedule is outside allowed time.
✓
The traffic is being processed by a different VDOM than expected
Why this is correct
If traffic is entering the wrong VDOM, it may not match the intended policy.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume a permit policy anywhere in the system applies to all traffic, forgetting that VDOMs create strict administrative boundaries where policies are not shared or visible across VDOMs.
Trap categories for this question
Command / output trap
Policy changes affect new sessions, not existing ones; but the log shows drops, not existing sessions.
Detailed technical explanation
How to think about this question
In a multi-VDOM environment, each VDOM has its own independent policy database, routing table, and firewall objects. When a packet arrives on an interface assigned to VDOM A, the FortiGate performs a route lookup within VDOM A and then evaluates the packet against the policies in VDOM A only; it will never see policies in VDOM B. This is enforced by the VDOM link or inter-VDOM link configuration, and misrouting between VDOMs is a common cause of unexpected 'policy deny' drops. The administrator can verify the VDOM assignment using 'diagnose sys vd list' or by checking the interface configuration with 'show system interface'.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A security administrator must allow nursing staff to reach a patient records server while blocking access from the guest Wi-Fi VLAN. After applying an extended ACL, traffic is still blocked from nursing workstations. The ACL was applied outbound instead of inbound on the wrong interface. Questions like this test ACL direction and placement rules.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: The traffic is being processed by a different VDOM than expected — Option D is correct because FortiGate VDOMs operate as independent virtual firewalls with separate routing and policy tables. If traffic enters a VDOM that does not contain the permit policy, the FortiGate will evaluate it against the policies within that VDOM only, resulting in a 'policy deny' drop even though a permit policy exists in a different VDOM. The administrator must verify that the traffic is being processed by the correct VDOM, typically by checking the ingress interface's VDOM association.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.