The correct answer is that policies must be configured in both VDOMs to allow traffic to and from the inter-VDOM link. This is required because inter-VDOM routing operates as a logical point-to-point connection between VDOMs, and FortiGate enforces stateful inspection at each VDOM boundary—meaning traffic leaving VDOM A must be permitted by a policy there, and the returning or forwarded traffic entering VDOM B must be explicitly allowed by a separate policy in VDOM B. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding that inter-VDOM routing is not a trust relationship; a common trap is assuming a single policy in one VDOM suffices for bidirectional traffic. Remember the memory tip: “Two VDOMs, two policies—one for the outbound, one for the inbound.”
NSE7 Enterprise Firewall and VDOMs Practice Question
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. The scenario asks you to isolate a root cause — eliminate options that address a different problem before choosing. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A FortiGate administrator needs to configure a policy that allows traffic from VDOM A to VDOM B using inter-VDOM routing. Which configuration is required?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Policies in both VDOMs allowing traffic to and from the inter-VDOM link
Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
A single policy in VDOM A with destination VDOM B
Why it's wrong here
A policy in VDOM B is also needed for return traffic.
✗
A static route in VDOM A pointing to VDOM B
Why it's wrong here
Static routes may be needed, but the primary requirement is firewall policies.
✓
Policies in both VDOMs allowing traffic to and from the inter-VDOM link
Why this is correct
Correct: policies in both VDOMs are required to allow bidirectional traffic.
Related concept
Read the scenario before looking for a memorised answer.
✗
Disable VDOM security features
Why it's wrong here
Disabling security is not required.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates assume a single policy in the source VDOM is sufficient, forgetting that FortiGate treats each VDOM as a separate virtual firewall requiring its own policy for return traffic.
Detailed technical explanation
How to think about this question
Inter-VDOM routing uses a dedicated inter-VDOM link (a virtual wire or physical interface shared between VDOMs) that acts as a Layer 3 point-to-point connection. Each VDOM must have a policy allowing traffic to and from this link, and the FortiGate performs stateful inspection on both sides, meaning session establishment requires a forward policy in the source VDOM and a reverse policy in the destination VDOM. In real-world deployments, this ensures that traffic between VDOMs (e.g., guest and corporate networks) is subject to separate security profiles and logging.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A small business has 20 workstations on the 192.168.1.0/24 network and one public IP from its ISP. The router uses PAT (NAT overload) so all 20 devices share one public address using different source ports. NAT questions test whether you understand the four address terms and which direction each translation applies.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Policies in both VDOMs allowing traffic to and from the inter-VDOM link — Inter-VDOM routing requires explicit policy enforcement on both sides of the inter-VDOM link. A single policy in VDOM A cannot control return traffic from VDOM B, and FortiGate does not implicitly allow traffic between VDOMs. Therefore, policies must be configured in both VDOMs to permit traffic in both directions, ensuring stateful inspection and security controls are applied consistently.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate is configured with multiple VDOMs. The administrator needs to allow traffic from a VDOM named 'CustomerA' to reach a server in VDOM 'SharedServices'. Both VDOMs are on the same FortiGate. Which configuration is necessary?
medium
A.Place both VDOMs in the same ADOM in FortiManager
✓ B.Enable inter-VDOM routing and create policies allowing traffic between the VDOMs
C.Create a VDOM link between the two VDOMs
D.Configure the FortiGate in transparent mode
Why B: Inter-VDOM routing is required to route traffic between VDOMs on the same FortiGate. This is enabled globally via the CLI command 'config system global' and 'set inter-vdom-routing enable'. Once enabled, you must create firewall policies between the VDOMs (using the VDOM link or directly referencing the VDOMs in policies) to permit the traffic. Without inter-VDOM routing, VDOMs are isolated Layer 3 domains and cannot communicate.
Variation 2. An enterprise FortiGate has multiple VDOMs. The administrator wants to allow traffic from VDOM A to reach servers in VDOM B without traversing an external router. Which configuration is required?
medium
A.Place both VDOMs in the same VDOM group
B.Configure a static route in each VDOM pointing to the other VDOM's management IP
✓ C.Create an inter-VDOM link using the 'config system interface' command with type 'vdom-link'
D.Enable VDOM forwarding in global settings
Why C: Option C is correct because inter-VDOM links are the native FortiGate mechanism for routing traffic between VDOMs without external hardware. Created via 'config system interface' with type 'vdom-link', they act as a direct Layer 3 connection between VDOMs, allowing traffic to flow internally through the FortiGate's backplane. This avoids the need for an external router or physical cabling.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.