A regional utility runs both its grid-operations network and a physically separate corporate back-office network through the same physical FortiGate appliance at the control center, and wants each network's firewall configuration and routing table to be fully independent of the other. What FortiOS feature is designed for this?
Select an answer to reveal the explanation.
Short Explanation
Think of VDOMs as splitting one physical firewall into multiple virtual ones, each with its own policies and routing table that don't see each other at all. That's a much cleaner separation than just writing careful policy rules on a single shared instance.
Full Explanation
Virtual Domains let a single physical FortiGate be partitioned into multiple logically independent virtual firewalls, each with its own set of firewall policies, routing table, and often its own administrative scope, exactly the isolation model needed when two distinct networks must never share configuration or routing logic even though they sit behind the same hardware. A single policy with two source-address objects still lives inside one shared routing table and policy set, so the two networks remain configuration-coupled rather than independent. Separate administrator accounts control who can log in and what they can change, but they don't create separate routing tables or policy sets; the underlying configuration is still one shared instance. SD-WAN rules balance traffic across multiple WAN links for a given routing domain; they have nothing to do with partitioning a device into independent configuration contexts. The caveat at this introductory level: VDOMs add administrative overhead, since some settings must be configured per VDOM and the device's default VDOM often plays a special role in system-wide settings, so a reasonable check before deploying is confirming which settings are genuinely global versus per-VDOM.