NSE7 Enterprise Firewall and VDOMs Practice Question
You deploy a FortiGate in transparent mode for a retail branch. The upstream router's ARP table shows the FortiGate's management IP, but end users cannot reach the internet. The FortiGate's management IP is on the same subnet as the users. What should you verify first?
⚠ Common exam trap
Many exam-takers assume transparent mode operates like a simple switch or bridge without policy enforcement, overlooking that FortiGate still requires explicit firewall policies to forward traffic even in Layer 2 mode.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The firewall policy allows traffic from internal to external
In transparent mode, the FortiGate acts as a Layer 2 bridge and does not require a routing table for user traffic; forwarding decisions are based on firewall policies. Since the management IP is on the same subnet as users, the upstream router can ARP for it, but user traffic must be explicitly allowed by a firewall policy from the internal to external zone. Without such a policy, packets are dropped even if Layer 2 connectivity exists.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The upstream router is forwarding traffic to the FortiGate's management MAC
Why it's wrong here
The FortiGate's management MAC is distinct from bridge MACs; upstream router should forward to the bridge MAC, not management MAC. This is a common misconfiguration but less likely than missing policy.
- ✓
The firewall policy allows traffic from internal to external
Why this is correct
Transparent mode firewalling still requires policies. If no policy permits the traffic, it will be denied by default.
- ✗
The FortiGate's routing table has a default route
Why it's wrong here
In transparent mode, the FortiGate does not route; it bridges. A default route is not needed for user traffic.
- ✗
The FortiGate's management interface is in the same VDOM as user traffic
Why it's wrong here
Management IP can be in the same or separate VDOM, but this wouldn't block user traffic if policies are correct.
Visual reference
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.