Quick Answer
The correct answer is setting a CPU quota and a memory quota, as these two settings directly enforce VDOM resource isolation by capping the percentage of CPU time and the amount of physical RAM a VDOM can consume. Without these quotas, a single VDOM could monopolize system resources, starving other VDOMs or the root FortiGate, which defeats the purpose of multi-tenant segmentation. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of system-level resource guarantees versus simple administrative boundaries—a common trap is confusing VDOM administrative separation (like admin access or interfaces) with actual hardware resource isolation, which only CPU and memory quotas provide. To remember, think of VDOM resource isolation as a “double cap”: one for processing cycles and one for memory footprint, ensuring no single tenant can hijack the system.
This NSE7 practice question tests your understanding of enterprise firewall and vdoms. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. After answering, compare your reasoning against the explanation and wrong-answer breakdown below. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
An administrator is configuring a new VDOM on a FortiGate and needs to ensure that certain system resources are isolated for that VDOM. Which TWO settings must be configured to achieve resource isolation?
Set disk quota
Why wrong: Disk quota is for log storage, not system resource isolation.
Set memory quota
Memory quota limits the memory usage for the VDOM.
Set CPU quota
CPU quota limits the CPU usage for the VDOM.
Set bandwidth limit
Why wrong: Bandwidth limits traffic, not system resources.
Set session limit
Why wrong: Session limit controls concurrent sessions but not system resources.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Set memory quota
Option B is correct because setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.
Key principle: Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Set disk quota
Why it's wrong here
Disk quota is for log storage, not system resource isolation.
Set memory quota
Why this is correct
Memory quota limits the memory usage for the VDOM.
Related concept
Read the scenario before looking for a memorised answer.
Set CPU quota
Why this is correct
CPU quota limits the CPU usage for the VDOM.
Related concept
Read the scenario before looking for a memorised answer.
Set bandwidth limit
Why it's wrong here
Bandwidth limits traffic, not system resources.
Set session limit
Why it's wrong here
Session limit controls concurrent sessions but not system resources.
Common exam traps
The trap here is that candidates confuse 'resource isolation' with 'traffic control' or 'storage limits', leading them to select bandwidth limit or disk quota instead of the correct system-level quotas (memory and CPU).
Detailed technical explanation
Under the hood, FortiGate VDOM resource quotas are enforced by the kernel's cgroup-like mechanism, where memory quotas are set in megabytes and CPU quotas as a percentage of a single core (e.g., 50% means half of one core). A real-world scenario: if a VDOM experiences a memory leak, a memory quota prevents it from consuming all available RAM, while a CPU quota stops a runaway process from monopolizing the CPU, ensuring other VDOMs remain operational even during an attack or misconfiguration.
Key takeaway
Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option.
Real-world example
A practitioner preparing for the NSE7 exam encounters this exact type of scenario on the job. The correct answer here is not the most general option — it is the best answer for the specific constraint described. Answer the scenario, not the keyword: identify the specific constraint before choosing the most familiar-sounding option. Real exam questions reward reading the full scenario before eliminating options, because the constraint defines which answer fits.
What to study next
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Enterprise Firewall and VDOMs — study guide chapter
Learn the concepts, then practise the questions
Enterprise Firewall and VDOMs practice questions
Targeted practice on this topic area only
All NSE7 questions
1,000 questions across all exam domains
Fortinet NSE 7 Advanced Security NSE7 study guide
Full concept coverage aligned to exam objectives
NSE7 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Practise NSE7 questions linked to Advanced Networking and SD-WAN.
Practise NSE7 questions linked to Advanced VPN and Zero Trust.
Practise NSE7 questions linked to Enterprise Firewall and VDOMs.
Practise NSE7 questions linked to Advanced Threat Protection.
Practise NSE7 questions linked to Troubleshooting and Diagnostics.
Practise NSE7 questions linked to NSE7 fundamentals.
Practise NSE7 questions linked to NSE7 scenario.
Practise NSE7 questions linked to NSE7 troubleshooting.
Practice this exam
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Enterprise Firewall and VDOMs — This question tests Enterprise Firewall and VDOMs — Read the scenario before looking for a memorised answer..
The correct answer is: Set memory quota — Option B is correct because setting a memory quota on a VDOM limits the amount of physical memory (RAM) the VDOM can consume, preventing it from starving other VDOMs or the root system. Option C is correct because setting a CPU quota caps the percentage of CPU time the VDOM can use, ensuring fair scheduling across VDOMs. Together, these two settings enforce resource isolation at the system level, which is required for multi-tenant or segmented environments.
Identify which exam domain this question belongs to, review the core concept, then practise similar questions from the same domain.
Read the scenario before looking for a memorised answer.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.