Exam NSE7_EFW-7.0 topic 1 question 12 discussion

Actual exam question from Fortinet's NSE7_EFW-7.0

Question #: 12
Topic #: 1

Refer to the exhibit, which shows a partial routing table.

Assuming all the appropriate firewall policies are configured, what two changes would an administrator need to make if they wanted to send traffic from a client directly connected to port3, to a server directly connected to port4? (Choose two.)

A. Configure route leaking between VRF 12 and VRF 21.
B. Disable auto-asic-offload as this is not supported between VRF instances.
C. Configure RIPv2 to exchange route information between the VRF instances.
D. Configure route leaking between port3 and port4.
E. Enable SNAT on the relevant firewall policies to prevent RPF check drops.

Show Suggested Answer

Suggested Answer: AE 🗳️

by Hesoyam at Jan. 4, 2023, 8:02 p.m.

Comments

Submit Cancel

accessmsc

10 months, 4 weeks ago

Selected Answer: AC

learn it in udemy

upvoted 2 times

...

mau_80

1 year, 5 months ago

Selected Answer: AE

A -> you need to configure route leaking E -> net 10.1.0.0/24 overlaps, so SNAT can bypass the RPF check

upvoted 4 times

fortiexpertguy

1 year, 3 months ago

Hi mau_80, could you please provide a more detailed explanation of why there is an overlap with subnet 10.1.0.0/24? This subnet is directly connected in VRF=12 and is reachable via a static route in the VRF=21 route table. It has not been duplicated in the locally connected networks of both VRFs. Thank you in advance.

upvoted 1 times

...

certifi46

1 year, 8 months ago

Selected Answer: AE

A and E

upvoted 1 times

...

Quetchup

1 year, 9 months ago

Selected Answer: AE

Enterprise_Firewall_7.0_Study_Guide-Online.pdf p 148, 159

upvoted 1 times

...

Seph1

1 year, 11 months ago

Selected Answer: AE

A & E seems correct: A - is correct - you need to configure VRF route leaking B - didn`t find anything to confirm this. C - Rip is not supported D - route leaking configuration is not on interfaces. E - sounds right.

upvoted 4 times

...