nerdexam
Fortinet

NSE4 · Question #336

View the exhibit. Which statements about the exhibit are true? (Choose two.)

The correct answer is A. port1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs. D. Broadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10. FortiGate VLAN sub-interfaces can belong to different VDOMs, and broadcast traffic is contained within its respective VLAN, preventing forwarding to other VLANs by default.

Submitted by lars.no· Apr 18, 2026FortiGate Deployment and System Configuration

Question

View the exhibit. Which statements about the exhibit are true? (Choose two.)

Exhibit

NSE4 question #336 exhibit

Options

  • Aport1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.
  • Bport1-VLAN1 is the native VLAN for the port1 physical interface.
  • CTraffic between port1-VLAN1 and port2-VLAN1 is allowed by default.
  • DBroadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.

How the community answered

(66 responses)
  • A
    89% (59)
  • B
    8% (5)
  • C
    3% (2)

Why each option

FortiGate VLAN sub-interfaces can belong to different VDOMs, and broadcast traffic is contained within its respective VLAN, preventing forwarding to other VLANs by default.

Aport1-VLAN10 and port2-VLAN10 can be assigned to different VDOMs.Correct

FortiGate allows assigning individual VLAN interfaces to different VDOMs, providing logical segmentation and independent network management for each virtual domain.

Bport1-VLAN1 is the native VLAN for the port1 physical interface.

VLAN 1 is not automatically designated as the native VLAN on a FortiGate; the native VLAN is determined by the switch port configuration that the FortiGate connects to, and untagged traffic is typically associated with it.

CTraffic between port1-VLAN1 and port2-VLAN1 is allowed by default.

Traffic between different VLAN interfaces on a FortiGate, even with the same VLAN ID on different physical ports, is blocked by default and requires explicit firewall policies for routing to occur.

DBroadcast traffic received in port1-VLAN10 will not be forwarded to port2-VLAN10.Correct

VLANs act as separate broadcast domains, meaning broadcast traffic originating within port1-VLAN10 will be contained within that specific VLAN and will not be forwarded to other distinct VLANs like port2-VLAN10 by default.

Concept tested: FortiGate VLANs, VDOMs, and traffic segmentation

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/331398/understanding-vdoms

Topics

#VDOMs#VLANs#FortiGate Interfaces#Broadcast Domains

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice