NSE7 Advanced Networking and SD-WAN Practice Question
You have configured VRF on a FortiGate with two VRFs: VRF 1 for guest traffic and VRF 2 for corporate traffic. You want to allow limited communication from guests to a corporate DNS server. What is the correct configuration step?
⚠ Common exam trap
Test-takers frequently assume a firewall policy between VRFs is sufficient, but without route leaking, the source VRF has no route to the destination, so the firewall policy never sees the traffic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP
VRF isolation by default prevents traffic from crossing between VRFs. To allow a guest in VRF 1 to reach a corporate DNS server in VRF 2, you must leak the DNS server's route from VRF 2 into VRF 1. This is achieved by configuring route leaking (e.g., using route maps or VRF route leaking on FortiGate), which installs the DNS server's IP prefix into the guest VRF's routing table, enabling reachability without breaking VRF separation for other traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a firewall policy from VRF 1 to VRF 2 allowing DNS traffic
Why it's wrong here
Firewall policies operate within the same VRF; they cannot cross VRFs without route leaking.
- ✗
Enable 'set allow-vrf' on the DNS server's interface
Why it's wrong here
There is no such setting.
- ✓
Configure route leaking between VRF 1 and VRF 2 for the DNS server's IP
Why this is correct
Route leaking allows one VRF to know routes of another, enabling inter-VRF communication.
- ✗
Place the DNS server in a management VDOM and use inter-VDOM links
Why it's wrong here
VRF is not VDOM; inter-VDOM links are for VDOMs, not VRFs.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.