NSE7 Advanced Networking and SD-WAN Practice Question
A FortiGate is configured with VRF. Which statement about VRF is true?
⚠ Common exam trap
Candidates often assume interfaces can belong to multiple VRFs (like VLAN sub-interfaces can belong to multiple VLANs), but in VRF, each interface is exclusively bound to a single VRF instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VRF allows multiple routing tables to coexist on the same FortiGate.
VRF (Virtual Routing and Forwarding) allows a single FortiGate to maintain multiple independent routing tables, each with its own set of interfaces, routes, and forwarding decisions. This enables network segmentation and traffic isolation without requiring separate physical devices, making option B correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Interfaces can belong to multiple VRFs simultaneously.
Why it's wrong here
A FortiGate interface maps to exactly one VRF; VRF membership is a per-interface attribute, so an interface cannot be partitioned across several routing tables at once. Multiple VRFs are tempting because they segment overlapping address space, which is their actual purpose, but each interface still belongs to a single VRF.
- ✓
VRF allows multiple routing tables to coexist on the same FortiGate.
Why this is correct
VRF (virtual routing and forwarding) instantiates separate routing tables on one FortiGate, so overlapping IP subnets can be isolated per tenant or interface without leaking routes between them. This directly satisfies the stem's requirement that multiple routing tables coexist on the same device, which is the defining property of VRF.
- ✗
Routes from different VRFs can be automatically redistributed without configuration.
Why it's wrong here
VRF instances maintain separate routing tables, and leaking routes between them requires explicit configuration such as route leaking or import/export policies; nothing redistributes automatically. Automatic redistribution appeals because it sounds like standard dynamic-routing behaviour, but VRF isolation is precisely what prevents it.
- ✗
VRF can only be used when OSPF is enabled.
Why it's wrong here
VRF is a layer-3 isolation mechanism independent of any routing protocol; static routes and BGP, RIP or connected routes all work within a VRF. Requiring OSPF is tempting because OSPF process-to-VRF binding is a common configuration example, but that is one supported combination, not a dependency.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.