The correct approach is to use inter-VDOM routing linked to a policy in the global policy set. This is necessary because in transparent mode, each VDOM operates as an isolated Layer 2 domain, and traffic between VLANs assigned to different VDOMs cannot be bridged directly; instead, it must be routed across an inter-VDOM link. By applying the security policy in the global policy set, the administrator ensures that a single, common policy governs all traffic crossing the VDOM boundary, avoiding the complexity of duplicating rules in each VDOM. On the Fortinet NSE 7 Advanced Security NSE7 exam, this scenario tests your understanding of transparent mode VDOM isolation and the distinction between intra-VDOM bridging and inter-VDOM routing. A common trap is assuming that a policy in each VDOM can handle the traffic, but the global policy set is the only place where inter-VDOM traffic is evaluated once. Memory tip: think of the global policy set as the “gatekeeper” at the VDOM border—traffic must pass through it when leaving one VDOM to reach another.
NSE7 Enterprise Firewall and VDOMs Practice Question
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator configures a FortiGate in transparent mode with two VDOMs. Each VDOM is assigned to a different VLAN. The administrator wants to apply a common security policy to traffic between the VLANs. What is the correct approach?
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use inter-VDOM routing linked to a policy in the global policy set
In transparent mode, FortiGate VDOMs are isolated by default, and traffic between VLANs assigned to different VDOMs must traverse an inter-VDOM link. The correct approach is to use inter-VDOM routing and apply a security policy in the global policy set, which allows a common policy to govern traffic crossing VDOM boundaries. This ensures that the policy is evaluated once for inter-VDOM traffic, rather than requiring separate policies in each VDOM.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
✗
Assign both VLANs to the same VDOM and apply a policy there
Why it's wrong here
If they are in different VDOMs, they must be separate.
✗
Apply the policy on the management VDOM
Why it's wrong here
Management VDOM handles only management traffic.
✗
Configure a single policy on the root VDOM that matches all VLANs
Why it's wrong here
Root VDOM is not used for data traffic in transparent mode.
✓
Use inter-VDOM routing linked to a policy in the global policy set
Why this is correct
Traffic between VDOMs must go through inter-VDOM routing; a policy in the respective VDOMs is needed.
Related concept
Read the scenario before looking for a memorised answer.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates often assume a single VDOM or the root VDOM can handle inter-VLAN policies in transparent mode, but FortiGate requires explicit inter-VDOM routing and global policy sets for cross-VDOM traffic, even in transparent mode.
Detailed technical explanation
How to think about this question
Inter-VDOM routing in transparent mode uses a virtual wire or inter-VDOM link (IVL) to connect VDOMs, and the global policy set is a shared policy database that can be referenced by inter-VDOM rules. This design allows a single policy to be applied to traffic flowing between VDOMs without duplicating rules, which is critical in multi-tenant environments where consistent security enforcement is required. The global policy set is evaluated after the inter-VDOM link, ensuring that the policy is applied at the boundary between VDOMs.
KKey Concepts to Remember
Read the scenario before looking for a memorised answer.
Find the constraint that changes the correct option.
Eliminate answers that are true in general but not in this case.
TExam Day Tips
→Watch for words such as best, first, most likely and least administrative effort.
→Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
How this comes up in practice
A help-desk technician troubleshoots why a newly connected PC cannot reach shared printers on the same floor. The cable is good, the switch port is active, but the PC is in VLAN 20 and the printers are in VLAN 10. The uplink trunk only allows VLAN 10. A trunk being up does not mean every VLAN crosses it.
What to study next
Got this wrong? Here's your next step.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
What is the correct answer to this question?
The correct answer is: Use inter-VDOM routing linked to a policy in the global policy set — In transparent mode, FortiGate VDOMs are isolated by default, and traffic between VLANs assigned to different VDOMs must traverse an inter-VDOM link. The correct approach is to use inter-VDOM routing and apply a security policy in the global policy set, which allows a common policy to govern traffic crossing VDOM boundaries. This ensures that the policy is evaluated once for inter-VDOM traffic, rather than requiring separate policies in each VDOM.
What should I do if I get this NSE7 question wrong?
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
What is the key concept behind this question?
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is configuring a FortiGate in transparent mode for an enterprise network. The existing gateway firewall must remain in place. How should the administrator configure the FortiGate's interfaces to ensure minimal disruption?
medium
A.Enable VDOMs and separate the interfaces into different VDOMs
✓ B.Place both interfaces in the same VDOM and assign a shared management IP
C.Assign each interface a unique IP address on different subnets
D.Use 802.1Q trunking on a single physical interface
Why B: In transparent mode, FortiGate acts as a Layer 2 bridge, so both interfaces must belong to the same VDOM and share a single management IP to allow administrative access without breaking the Layer 2 path. This configuration ensures the existing gateway firewall remains in place and traffic flows uninterrupted, as the FortiGate does not perform routing between its interfaces.
Variation 2. An administrator is configuring a firewall policy on a FortiGate in transparent mode. The policy should allow HTTP traffic from internal users to the internet. Which source and destination addresses should be used in the policy?
medium
✓ A.Source: all, Destination: all
B.Source: the FortiGate's management IP, Destination: the web server's IP
D.Source: internal MAC addresses, Destination: external MAC addresses
Why A: In transparent mode, the FortiGate operates as a Layer 2 bridge and does not route traffic based on IP addresses. Therefore, firewall policies must use 'all' for both source and destination addresses because the FortiGate does not see the original source or destination IPs—it only sees MAC addresses and forwards frames transparently. Using specific IP subnets would break the policy as the FortiGate cannot match Layer 3 addresses in this mode.
Variation 3. An administrator is configuring a FortiGate in transparent mode for a retail store. The store has a flat network with a single subnet. Which TWO of the following statements about transparent mode are correct? (Select TWO.)
medium
A.Virtual IPs (VIPs) can be used for destination NAT
✓ B.The FortiGate uses a management IP address for administrative access
C.The FortiGate will perform routing between VLANs
D.The FortiGate requires a default route to forward user traffic
✓ E.Firewall policies can be applied to control traffic between bridge interfaces
Why B: In transparent mode, the FortiGate acts as a Layer 2 bridge and does not participate in routing. A management IP address is required for administrative access (e.g., SSH, HTTPS) because the device does not have an IP on the bridged interfaces by default. This management IP is assigned to a dedicated management interface or a VLAN interface and allows the administrator to reach the FortiGate from the same subnet.
Last reviewed: Jun 24, 2026
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.