NSE7 VRF Instance Practice Question
An administrator needs to configure VRF to separate traffic for two departments. Which TWO components must be configured for each VRF?
⚠ Common exam trap
A common mix-up: candidates confuse VRF with VDOM, thinking each VRF requires a separate virtual domain, when in fact VRF is a routing-level isolation mechanism that can exist within a single VDOM or router instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A VRF instance
A VRF instance (option A) is the foundational component that must be created for each VRF, as it establishes the separate routing table that isolates the department's traffic. Interface binding to the VRF (option B) is also required because interfaces must be assigned to the VRF so that traffic entering and leaving those interfaces uses the correct VRF routing table. A dedicated VDOM (option C) is incorrect because VDOMs are a Fortinet-specific virtualization concept separate from VRF, and VRF can be configured without VDOMs. Route leaking configuration (option D) is not mandatory for each VRF; it is only needed when you want to selectively share routes between VRFs, which is optional. A separate firewall policy for each VRF (option E) is not a required VRF component, as firewall policies are managed independently of VRF configuration and depend on the platform's security policy model.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
A VRF instance
Why this is correct
A VRF instance is mandatory because it creates the separate routing table that isolates each department's traffic. Without a distinct VRF instance per department, FortiGate cannot maintain independent forwarding decisions, so routes from one department would leak into the other. This satisfies the stem's core requirement for traffic separation.
- ✓
Interface binding to the VRF
Why this is correct
Binding each interface to its VRF instance is mandatory, because FortiGate segregates traffic at the interface level: a VRF only forwards traffic from interfaces explicitly assigned to it. Without this binding, the department's traffic remains in the default VRF, defeating the required separation.
- ✗
A dedicated VDOM
Why it's wrong here
A VDOM is a separate virtual firewall instance, not a per-VRF requirement; VRFs are Layer 3 routing table separation within one VDOM. Each VRF needs a unique route distinguisher and route target for BGP import/export, plus interface assignment, so a dedicated VDOM is unnecessary.
- ✗
Route leaking configuration
Why it's wrong here
Route leaking is optional, used only when VRFs must exchange selected routes; it is not a mandatory per-VRF component. It is tempting because leaking is commonly configured alongside VRFs in multi-tenant designs, but the required components are the interface and the virtual router, so this fails the scenario.
- ✗
A separate firewall policy for each VRF
Why it's wrong here
Firewall policies are not a per-VRF configuration component; VRFs require an interface assignment and a route table (plus route leaking where needed). It is tempting because traffic separation between departments sounds like a policy task, but policy enforcement is separate from VRF instantiation, so this fails the requirement.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.