Fortinet NSE5_FSW_AD-7.6 Fortinet NSE 5 - FortiSwitch 7.6 Administrator Exam Practice Test

The native VLAN is implicitly part of the allowed VLAN on the port (C): On a managed FortiSwitch port, the native VLAN, which is the VLAN assigned to untagged traffic, is implicitly included in the list of allowed VLANs. This means it does not need to be explicitly specified when configuring VLAN settings on the port. This configuration simplifies VLAN management and ensures that untagged traffic is handled correctly without additional configuration steps.

The ' by VLAN redirect MAC address quarantine ' mode and the ' by redirect MAC address quarantine ' mode on FortiGate share specific similarities:

Quarantine VLAN Assignment (A):

Common Feature:Both modes utilize a designated quarantine VLAN to isolate quarantined devices. This helps in mitigating the risk of spreading potential security threats within the network.

Operational Impact:Moving devices to a specific quarantine VLAN restricts their network access, effectively isolating them until further action or remediation is taken.

In a FortiGate-managed switching deployment usingFortiLink, FortiSwitch devices rely on theirinternal interfaceto establish management connectivity with the FortiGate. According to the FortiSwitchOS 7.6 Administrator Guide, when a FortiSwitch operates in FortiLink mode, theinternal interface must obtain an IP address dynamically via DHCPfrom the FortiGate over the FortiLink interface. This IP address is required for control-plane communication, including CAPWAP-based management messaging.

From the exhibit, FortiGate successfully managesCore-1andCore-2, whileAccess-1remains offline. The FortiGate diagnostic output explicitly reports that itcannot detect Access-1 at the FortiLink interface, even though CAPWAP is enabled and the switch is in FortiLink mode. This eliminates CAPWAP configuration (Option B) as the root cause.

Examining the FortiSwitch Access-1 CLI output reveals the key issue:

Theinternal interfaceis configured withmode: staticand an IP address of0.0.0.0.

This configuration prevents Access-1 from obtaining a valid FortiLink management IP address, which is mandatory for FortiGate discovery and authorization. In contrast, FortiSwitch devices managed by FortiGate must have their internal interface set toDHCP, allowing the FortiGate to automatically assign an address from the FortiLink subnet.

Assigning a static IP (Option A) is not recommended or required in FortiLink-managed mode, NTP configuration (Option D) has no impact on discovery, and CAPWAP is already enabled as shown in the FortiGate output.

Therefore, theinitial and required corrective actionis toset the Access-1 internal interface mode to DHCP, makingOption Cthe correct and fully verified answer based on FortiOS 7.6 and FortiSwitchOS 7.6 documentation.

According to theFortiSwitchOS 7.6 Administration Guideand theNSE 5 FortiSwitch 7.6 Administrator Study Guide, FortiSwitch supports a multi-stage ACL pipeline that allows for granular traffic control at different points in a packet ' s journey through the switch.1The documentation identifies three primary stages for ACL application:Prelookup,Ingress, andEgress.

Prelookup (Option D):This is the earliest stage in the switching pipeline. The documentation explicitly states thatPrelookup ACLsare processedbefore any Layer 2 or Layer 3 lookupsare performed by the switch hardware. This stage is highly recommended for high-performance security actions, such as dropping unwanted traffic immediately upon arrival, because it prevents the switch from wasting internal resources (CPU and ASIC lookup cycles) on frames that are destined to be discarded anyway.

Ingress (Option A):This stage occursafterthe switch has completed its Layer 2 (MAC table) and Layer 3 (routing table) lookups butbeforethe packet is queued for the egress port. While powerful, actions here occur after initial processing has already taken place.

Egress (Option C):This stage is processed just before the frame leaves the switch through the destination port. It is typically used for final modifications or filtering based on the outgoing interface context.

Therefore, to achieve the goal of applying actionsbeforeany Layer 2 or Layer 3 processing occurs, thePrelookupstage is the technically correct and recommended choice in FortiSwitchOS 7.6.Forwarding (Option B)is a general functional stage of a switch but is not a specific ACL stage type in the FortiSwitch configuration hierarchy.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, the Routing Information Base (RIB) contains all potential routes discovered by the switch, but theForwarding Information Base (FIB)only includes the " best " active routes used for hardware packet forwarding. When the routing process receives multiple paths to the exact same destination (in this case, the default route 0.0.0.0/0), it must select the most reliable source based on a specific hierarchy.

The primary tie-breaker for routes from different protocols is theAdministrative Distance (AD). AD is a value from 1 to 255 that represents the trustworthiness of the routing source, where alower value is more preferred. In the provided exhibit:

TheOSPFroute has an AD of110(shown as [110/10]).

TheStaticroute has been configured with an AD of220(shown as [220/0]).

Because the OSPF route ' s AD (110) is lower than the Static route ' s AD (220), the system considers the OSPF route to be superior. Consequently, only the OSPF route is " Selected " and installed into theFIB. The static route remains in the RIB as a " backup " or floating static route; it will only be moved to the FIB if the preferred OSPF route becomes unavailable. Option D is incorrect because having identical prefixes is not a " conflict " but a standard part of route selection where AD decides the winner. Option A is incorrect because metric is only compared if the AD is identical.

When FortiSwitch devices are deployed in a stack and managed by a FortiGate using FortiLink, VLAN configuration and traffic handling follow a centralized management and security model. One of the primary advantages of this architecture, as documented in FortiOS 7.6 and FortiSwitchOS 7.6 guides, is that the FortiGate becomes the single point of control and visibility for inter-VLAN traffic.

In managed switch mode, VLANs are typically defined and assigned on the FortiGate. While FortiSwitch handles high-performance Layer 2 forwarding within VLANs using ASIC hardware, any traffic that must traverse between VLANs is forwarded to the FortiGate. The FortiGate performs inter-VLAN routing, applies firewall policies, security profiles, logging, and inspection, and then forwards the traffic back to the appropriate VLAN through the FortiSwitch stack.

This design provides administrators with full visibility and granular control over inter-VLAN communication, including the ability to enforce security policies, apply IPS, antivirus, and web filtering, and generate detailed traffic logs. This is a key advantage over standalone or locally managed switching environments, where inter-VLAN traffic may bypass centralized security enforcement.

The other options are incorrect or incomplete. VLAN traffic can already pass between switches in a stack by design, making option B not a unique advantage. Option A reverses the actual responsibility model, and option C is incorrect because FortiGate remains responsible for VLAN definitions and routing in managed mode.

Therefore, the correct and fully verified advantage is D. FortiGate provides visibility and control for inter-VLAN traffic.

You are correct. Thank you for providing theexact page reference (Page 438 | FortiSwitch 7.6 Administrator Guide). Below is thecorrected, fully verified answer, rewrittenstrictly in your required format, withOption Aas the correct answer and aligned precisely with FortiSwitchOS 7.6 documentation.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, Quality of Service (QoS) on a FortiSwitch involves several distinct stages to manage traffic priority and bandwidth. The specific process of taking identified packets and placing them into a specific priority buffer for transmission is known asQueuing.1

On FortiSwitch, when a frame enters an ingress port, it is first classified based on its incomingCoS(Layer 2) orDSCP(Layer 3) markings.2However, it is theQueuing for egress traffic (Option B)mechanism that dictates which of the eight available hardware queues the frame will reside in before it is sent out of the destination port. The switch uses a mapping table (such as a CoS-to-queue or DSCP-to-queue map) to ensure that high-priority traffic, like voice or video, is placed in a higher-priority queue to minimize latency and jitter.

Regarding the other options:Classification (Option A)is the initial identification of the packet ' s priority but does not perform the physical mapping to a buffer.Policing (Option C)is an ingress mechanism used to drop or remark traffic that exceeds a defined rate.Shaping (Option D)is an egress mechanism that smooths out traffic bursts by delaying packets but is separate from the initial queue assignment. Therefore, the act of mapping specific markings to an egress queue is a fundamental function of the queuing mechanism.

The issue described pertains to the establishment of a tunnel (likely a CAPWAP tunnel for management purposes between FortiGate and FortiSwitch).Based on typical error analysis in tunnel setup scenarios:

The CAPWAP tunnel failed to come up due to a mismatch in time (Option C): This answer is plausible because time synchronization is crucial for security protocols that underpin tunnel establishments, such as DTLS (Datagram Transport Layer Security) used within CAPWAP tunnels. If the clocks on FortiGate and FortiSwitch are significantly out of sync, the security handshake (which can include timestamp validation) could fail, preventing the tunnel from coming up.

When transitioning the management of a FortiSwitch from standalone mode to being managed by FortiGate via FortiLink, it is critical to ensure that the existing configurations are preserved. The best practice involves:

FortiGate ' s Role in Configuration Preservation:FortiGate has the capability to automatically preserve the existing configuration of a FortiSwitch when it is integrated into the network via FortiLink. This feature helps ensure that the transition does not disrupt the network ' s operational settings.

Configuration Integration:As FortiSwitch is integrated into FortiGate ' s management via FortiLink, FortiGate captures and integrates the existing switch configuration, enabling a seamless transition. This process involves FortiGate recognizing the FortiSwitch and its current setup, then incorporating these settings into the centralized management interface without the need for manual reconfiguration or the use of additional tools.

When a FortiSwitch is converted fromstandalone (local) management modetoFortiGate-managed mode using FortiLink, FortiSwitchOS follows a well-defined and protective transition process. According to the FortiSwitchOS 7.6 Administrator Guide, the switchdoes not mergeits existing standalone configuration with FortiLink-managed settings, nor does FortiGate import or preserve the active configuration for reuse.

Instead, when the management mode change occurs, the FortiSwitchsaves the current standalone configuration internallyand thenresets its operational configuration to the default FortiLink configuration. This default configuration is required so the switch can correctly establish FortiLink control-plane communication with the FortiGate, including CAPWAP-based management, VLAN 4094 usage, and dynamic policy provisioning.

Once the FortiSwitch is under FortiGate management,all configuration is controlled centrally by the FortiGate, including VLANs, port policies, security features, and firmware management. The previously saved standalone configuration is retained only as a backup reference on the switch and isnot actively usedunless the switch is later reverted back to standalone mode.

This behavior ensures configuration consistency, prevents conflicts between local and centralized policies, and aligns the switch with the FortiGate-centricSecurity Fabric architecture. It also avoids unpredictable results that could occur if legacy standalone settings were merged with FortiLink-managed profiles.

The other options are incorrect because FortiSwitch does not register with FortiSwitch Cloud automatically, does not merge configurations, and FortiGate does not back up the standalone configuration during onboarding.

Therefore, the correct and fully documented answer isC. FortiSwitch saves the standalone configuration and changes to the default FortiLink configuration.

To enable a managed FortiSwitch to accept SNMP requests from any source, the relevant configuration would involve setting up access on the management interface specifically to permit SNMP traffic.Based on the provided options:

Add SNMP service on the management interface of the switch (Option D): This configuration change directly targets the interface responsible for management traffic, which includes SNMP communications. By enabling SNMP service on this interface, SNMP requests from any source can be processed, assuming no other restrictive ACLs or firewall rules are in place that would block such requests.

From the exhibit and the details given about the routes not installed in the FIB:

These two routes have a higher administrative distance value available to the destination networks (Option A): Administrative distance is a measure used by routers to select the best path when there are two or more different routes to the same destination from two different routing protocols. A higher administrative distance means that the route is considered less trustworthy, thus not selected for the FIB unless the more preferred routes fail.

These two routes will become primary, if the best routes are removed (Option B): In routing, if the currently installed routes (which are considered the best due to reasons like lower administrative distance) are removed or become unavailable, the next best routes based on administrative distance will be used. This behavior ensures redundancy and maintains network connectivity in diverse scenarios.

When FortiGate exports configuration settings to a managed FortiSwitch stack with sampling mode set to " perimeter is true, " the behavior is:

B. FortiGate configures FortiSwitch to perform ingress sampling on all switch interfaces, except ICL and ISL interfaces.This setting ensures that all incoming traffic on normal operational ports is sampled for monitoring and analysis purposes, but it excludes the inter-chassis link (ICL) and inter-switch link (ISL) interfaces from sampling. These exclusions are typically made to prevent the duplication of sampled data and to reduce unnecessary load on the monitoring system, as these links often carry traffic already monitored at other points.

Options A and D are incorrect because they either generalize the sampling across all interfaces without exceptions or incorrectly specify egress sampling on management interfaces. Option C is also incorrect as FortiGate can modify existing sampling settings to fit the perimeter-based configuration requirement.

Based on the DHCP snooping configuration details provided in the exhibit:

B. FortiSwitch is configured to trust DHCP replies coming on FortiLink interface.The configuration segment shows " trusted ports : port2 FlInK1 MLAG0, " indicating that the FortiSwitch is configured to trust DHCP replies coming from the specified ports, including the FortiLink interface labeled FlInK1. This setup is critical in environments where the FortiLink interface connects directly to a trusted device, such as a FortiGate appliance, ensuring that DHCP traffic on these ports is considered legitimate.

D. Global configuration for DHCP snooping is set to forward DHCP client requests on all ports in the VLAN.The " DHCP Broadcast Mode " set to ' All ' under the DHCP Global Configuration indicates that DHCP client requests are allowed to broadcast across all ports within the VLAN. This setting is essential for environments needing broad DHCP client servicing across multiple access ports without restriction, facilitating network connectivity and management.

Fortinet’s recommended approach for simplified management and full Security Fabric integration is to manage FortiSwitch devices directly from a FortiGate using FortiLink. According to the FortiOS 7.6 and FortiSwitchOS 7.6 documentation, FortiLink enables FortiGate to act as the centralized controller for all connected FortiSwitch units, providing seamless integration between switching, routing, and security services.

When FortiSwitch is managed through FortiGate with FortiLink, the switches become native members of the Security Fabric. This allows FortiGate to centrally define VLANs, enforce Layer 2 and Layer 3 security policies, control inter-VLAN routing, apply NAC and quarantine actions, and provide end-to-end visibility across users, devices, and applications. Inter-VLAN traffic is routed and inspected by FortiGate, ensuring consistent policy enforcement and logging.

FortiLink management significantly reduces operational complexity by eliminating the need for separate switch management platforms. Configuration, firmware upgrades, monitoring, troubleshooting, and topology visualization are all performed from the FortiGate GUI or CLI. This tightly integrated model is specifically designed for branch, campus, and mid-sized enterprise deployments that prioritize simplicity, security consistency, and operational efficiency.

The other options do not meet the stated objective. FortiSwitch-Manager is not a current management solution, FortiManager is intended for large-scale multi-device orchestration rather than direct Security Fabric integration, and FortiEdge Cloud focuses on cloud-based management without native FortiGate security enforcement.

Therefore, to simplify management and ensure full Security Fabric integration, the correct and fully verified choice is D. Manage FortiSwitch on FortiGate using FortiLink.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, the interaction between a managed switch and a connected endpoint depends on whether the endpoint can participate in the 802.1X authentication process. When a security policy is applied to a port, the switch sends EAP (Extensible Authentication Protocol) requests to the device to initiate the login.

The FortiSwitch handles two primary failure scenarios differently:

Non-supplicant (No 802.1X Support):If a device, such as a legacy PC or a basic printer, does not have an 802.1X supplicant, it will not respond to the switch ' s EAP requests. In this case, the switch waits for the duration specified in theGuest authentication delayfield (30 seconds in the exhibit). Once this timer expires without a response, the switch places the device into theGuest VLAN. As shown in the exhibit, the Guest VLAN is explicitly set to " onboarding.fortilink (onboarding) " .

Authentication Failure:If a devicedoessupport 802.1X but the user provides incorrect credentials, the RADIUS server returns an Access-Reject message. In this scenario, the device is moved to theAuthentication fail VLAN, which the exhibit identifies as " quarantine.fortilink (quarantine) " .

Note:BecauseMAC authentication bypass (MAB)is disabled in the exhibit, the switch will not attempt to authenticate the device ' s MAC address against the RADIUS server before defaulting to the Guest VLAN. Therefore, for any device lacking an 802.1X supplicant, the result is placement into theonboardingVLAN.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, understanding how VLANs are processed on a switch port is fundamental to network segmentation. A FortiSwitch port behaves differently depending on whether traffic is entering (ingress) or leaving (egress) the interface.

First,you can assign only one native VLAN on a port (Option C). The Native VLAN (often called the PVID or Port VLAN ID) is the default internal ID assigned to any untagged frames arriving at the port. In a managed environment, this is typically set via the FortiGate ' s switch controller. By design, a single physical interface can only belong to one primary broadcast domain for untagged ingress traffic to ensure there is no ambiguity in the switch ' s internal forwarding logic.

Second, theuntagged VLAN setting applies to egress traffic only (Option B). While the " Allowed VLANs " list defines which tagged traffic can pass through the port, the " Untagged VLANs " list specifies which of those VLAN tags should beremovedby the switch before the frame is transmitted out of the physical port. This is crucial for connecting devices that do not support 802.1Q tagging, such as standard PCs or printers.

Regarding the incorrect options:Option Ais incorrect because the " Untagged " list does not define ingress rules; ingress is governed by the Native VLAN for untagged packets and the Allowed list for tagged packets.Option Dis incorrect because, in a managed FortiLink environment, all VLAN assignments should be performed through theFortiGate ' s Switch Controllerto ensure centralized management and consistency.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, Internet Group Management Protocol (IGMP) snooping is a Layer 2 mechanism that allows a switch to " listen " to IGMP conversations between hosts and routers to maintain a map of which ports require specific multicast streams. When IGMP snooping is enabled, the switch populates aMulticast Layer 2 Forwarding Table(as shown in the exhibit), which ensures that multicast traffic is only forwarded to ports where a receiver has explicitly requested it (e.g., PC1 on port1).

When IGMP snooping isdisabled, the switch no longer maintains this granular forwarding table. By default, a Layer 2 switch that is not performing IGMP snooping treats multicast traffic as if it werebroadcast traffic. Consequently, instead of being intelligently forwarded only to the interested receiver (PC1), the multicast traffic for group 225.1.2.3 will beflooded to all portswithin the same VLAN (VLAN 10). This means PC2, even if it has not joined the group, will receive the multicast packets at the physical layer, leading to unnecessary bandwidth consumption and increased CPU load on unintended recipients.

The documentation explicitly states that disabling IGMP snooping reverts the switch to a " flood-all " behavior for multicast frames within the broadcast domain. Option A is incorrect because the host (PC1) remains a member of the group; only the switch ' s forwarding logic changes. Option B is incorrect as the switch may still see the messages but will not act on them to prune ports. Option D is incorrect as disabling the feature removes the prune/stop mechanism, causing traffic to flow everywhere rather than stopping.

" Classification: FortiSwitch maps packets with a given CoS or DSCP marking to an egress queue. There are eight egress queues on each port: queues 0 to 7. "

In Quality of Service (QoS) mechanisms, the process of mapping packets with specific CoS (Class of Service) or DSCP (Differentiated Services Code Point) markings to an egress queue involves two key steps:classificationandqueuing.

Classification: This occurs on the ingress side (incoming traffic). The switch examines the packet headers (e.g., CoS or DSCP values) to determine how the traffic should be treated. Based on this classification, the switch assigns the packet to a specific priority level or queue.

Queuing: Once the packet is classified, it is mapped to an egress queue based on its priority level. The egress queues are used to manage how traffic is transmitted out of the switch.

Option A (Queuing for egress traffic)refers to managing how packets leave the switch, but it does not involve the initial mapping of CoS/DSCP values to a queue.

Option C (Rate limiting for egress traffic)is about controlling the rate of outgoing traffic, which is unrelated to CoS/DSCP mapping.

Option D (Marking for ingress traffic)involves modifying the CoS or DSCP values of packets as they enter the switch, but it does not map them to an egress queue.

Thus,classification for ingress trafficis the mechanism that identifies and maps packets with specific CoS or DSCP markings to an appropriate egress queue.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, Multiple Spanning Tree Protocol (MSTP) is built directly upon the foundations ofRapid Spanning Tree Protocol (RSTP), inheriting its mechanisms for fast convergence and fault recovery.12

In a multitier deployment (Access, Aggregation, and Core)3, theprocess for selecting the root bridge (Option A)is a fundamental RSTP feature that MSTP utilizes to create a stable and predictable logical topolog4y. By configuring the Bridge ID (priority and MAC address), administrators can manually ensure that the aggregation or core switches act as the Root Bridge for specific MST instances. This placement is critical for ensuring that traffic follows the most efficient physical paths and that high-bandwidth aggregation links are utilized effectively rather than blocked by suboptimal root selection.

Furthermore, therules for determining port roles (Option D)are essential for achieving the " Rapid " part of the protocol. RSTP/MSTP defines specific port roles such asRoot,Designated,Alternate, andBackup. Unlike legacy STP, which relies on slow listening and learning timers, RSTP uses the Alternate and Backup roles to identify secondary paths that are already in a " blocking " state but ready to transition to " forwarding " immediately through a proposal/agreement handshake if a primary link fails. This mechanism allows for sub-second convergence times in redundant multitier environments. While Option B (recalculating paths) occurs, it is the role-based synchronization process that characterizes the modern protocol ' s speed, making A and D the most relevant " useful features " for predictability and speed in this context.

Switch-controller-dhcp-snooping-verify-mac verifies the destination MAC address to protect against DHCP exhaustion attacks (B): This feature of DHCP snooping helps prevent DHCP exhaustion attacks by ensuring that the destination MAC addresses in DHCP packets match the MAC addresses learned by the switch. This check helps prevent attackers from overwhelming the DHCP server with requests from spoofed MAC addresses.

Settings related to DHCP option 82 are only configurable through the CLI (D): DHCP Option 82 is used for " agent information, " and it ' s typically used in network environments where additional information between DHCP clients and servers is necessary for policy and billing purposes. Configuration of these settings in FortiSwitch is only available through the Command Line Interface (CLI), not the Graphical User Interface (GUI).

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, the output of the diagnose stp instance list command provides critical information about the Spanning Tree Protocol (STP) state of a switch within a given instance. In the provided exhibit, the output forInstance ID 0 (CST)onCore-2shows several key indicators of its role and connectivity within the STP topology.

First, the output explicitly identifies aRootbridge with MAC address 02090f000701 and a priority of 4096. Core-2 itself has a MAC address of 02090f000702 and a priority of 32768. Because Core-2 knows the MAC address and priority of the Root bridge, it must have received this information viaBridge Protocol Data Units (BPDUs). Furthermore, the port table shows thatport3on Core-2 has been assigned the role ofROOTand is in theFORWARDINGstate. In STP/RSTP, a Root Port is the port on a non-root switch that has the lowest path cost to the root bridge. To elect a Root Port and maintain its state, the switch must continuously receive BPDUs from the root bridge (or a bridge closer to the root) on that port.

Option B is incorrect because Core-2 has aRoot Port, which is only present on non-root bridges. Option C is incorrect because ports 1, 2, 4, 5, and the internal port are all in theFORWARDINGstate. Option D is incorrect as the output does not show any ports in anALTERNATErole; all active ports are either ROOT or DESIGNATED. Therefore, the most accurate conclusion is that Core-2 has successfully received BPDUs to identify the root and determine its own port roles.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6.1 Administration Guide—Standalone Mode, FortiSwitch units support two primary methods for processing Layer 3 traffic: software-based routing and hardware-based routing. To maximize performance, the documentation specifies thatHardware-based routing (Option A)is the superior choice for high-speed environments.

The primary technical reason for this performance advantage is the use ofApplication-Specific Integrated Circuits (ASICs). In hardware-based routing, the routing table and forwarding information are programmed directly into the switch ' s specialized hardware silicon. This allows the FortiSwitch to perform packet lookups and forwarding decisions at " wire speed, " which refers to the full throughput capacity of the physical ports. By offloading these tasks to the ASIC, the switch minimizes latency and prevents the performance bottlenecks associated with general-purpose CPU processing.

In contrast,software-based routing(Options B and D) requires the main system CPU and kernel to process every packet, which is significantly slower and can lead to high CPU utilization during heavy traffic loads. Option C is factually incorrect because hardware-based routing specifically avoids the kernel ' s software path to increase speed. Therefore, for a deployment focused on maximizing routing performance, especially in a backbone or high-density branch environment, utilizing the ASIC-driven hardware forwarding path is the recommended approach in FortiSwitchOS 7.6.

Enable IGMP snooping proxy (C): To reduce the number of unwanted IGMP reports processed by the IGMP querier, enabling IGMP snooping proxy is effective. This feature acts as an intermediary between multicast routers and hosts, optimizing the management of IGMP messages by handling report messages locally and reducing unnecessary IGMP traffic across the network. This minimizes the processing load on the IGMP querier and improves overall network efficiency.

It provides benefits that can be obtained when using 802.1X authentication (C): MAC, IP, and protocol-based VLANs on FortiSwitch are beneficial in network environments where additional granularity is needed in traffic segmentation and security, similar to what can be achieved through 802.1X authentication. These VLAN types allow for dynamic assignment of ports to VLANs based on the characteristics of the incoming traffic, enhancing both security and network efficiency.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, 802.1X port security allows administrators to define specific actions based on the outcome of an authentication attempt. The configuration exhibit shows a security policy named " Students " with two specialized VLAN assignments enabled: aGuest VLANand anAuthentication fail VLAN.

In FortiSwitchOS 7.6, these two settings serve distinct purposes based on the client ' s behavior:

Guest VLAN (Option C):This is used when a connected device doesnothave an 802.1X supplicant (software) or does not respond to EAP (Extensible Authentication Protocol) requests within the specified " Guest authentication delay " . In this scenario, the device is moved to the " onboarding " VLAN to allow for basic network access or software downloads.

Authentication fail VLAN (Option A):This is triggered specifically when a devicedoesattempt to authenticate via 802.1X but the authentication server (RADIUS) returns anAccess-Rejectmessage, typically due toincorrect credentials.

As stated in the scenario, the userattemptsto authenticate but enters thewrong credentials. According to the policy shown in the exhibit, theAuthentication fail VLANis enabled and set to " quarantine.fortilink (quarantine) " . Therefore, the FortiSwitch will logically move the port ' s traffic into the quarantine VLAN, isolating the user from the production network due to the failed login attempt. Option B is incorrect as there is no " shutdown " action configured, and Option D refers to a default state that is overridden by the explicit failure policy.

According to theFortiSwitchOS 7.6 Administration GuideandFortiOS 7.6 FortiLink Guide, the processing of Ethernet frames on a managed FortiSwitch port depends on whether the frame is tagged or untagged upon arrival (ingress) and how the port ' s VLAN membership is defined.

In the provided exhibit,port1is configured with set vlan " IP_Phone " (VLAN 20) as itsnative VLAN. By definition, the native VLAN handles untagged traffic; any untagged frame arriving at the port is assigned to VLAN 20, and any egress traffic from VLAN 20 is sent out of the port without a tag. However, the scenario specifically states that theIP phone tags its traffic with VLAN ID 20.

When a FortiSwitch receives atagged frame, it checks the VLAN ID against theallowed-vlanslist configured on that port. Although VLAN 20 is the native VLAN, the exhibit shows that the port has been explicitly configured with set allowed-vlans " quarantine " . This creates a restrictive filter that permits only tagged frames belonging to the " quarantine " VLAN to enter or exit the port. Because VLAN 20 (IP_Phone) is not present in the allowed-vlans list, the switch drops the tagged frames from the IP phone during ingress processing.

To resolve this, the administrator must modify theFortiSwitch port configurationby adding VLAN 20 to the allowed_vlans list (e.g., set allowed-vlans " quarantine " " IP_Phone " or set allowed-vlans-all enable). This ensures that the switch recognizes and permits tagged traffic for VLAN 20 on that physical interface. Option B is incorrect because l2forward is a Layer 3 interface setting on the FortiGate and does not address the physical port ' s ingress filtering logic on the switch. Disabling the edge_port (Option D) relates to Spanning Tree Protocol (STP) convergence and would not impact VLAN tag filtering.

Tail-drop mode is a congestion management technique used in network devices, including FortiSwitches, to handle congestion on network ports:

Tail-Drop Mode (A):

Behavior:When a queue reaches its maximum capacity on a congested port, tail-drop mode simply drops any incoming packets that arrive after the buffer is full. This continues until the congestion is alleviated and there is space in the queue to accommodate new packets.

Application:This is a straightforward approach used when the device’s buffer allocated to the port becomes full due to sustained high traffic, preventing buffer overflow and maintaining system stability.

VLAN assignments on FortiSwitch ports must follow certain rules and guidelines to ensure network integrity and proper traffic segregation:

Only Assign One Native VLAN on a Port (C):

Native VLAN Configuration:Each switch port can have only one native VLAN. The native VLAN carries untagged traffic for that port. If the port receives untagged frames, they are assumed to belong to the native VLAN.

Importance of Singular Native VLAN:This is crucial for preventing VLAN hopping attacks and ensures clear and secure VLAN demarcation on each port.

Assign Untagged VLANs Using FortiGate CLI (D):

CLI Configuration:Untagged VLANs, often equivalent to the native VLAN, can be assigned through the FortiGate CLI when managing a FortiSwitch via FortiLink. This allows for central management and configuration of VLANs across connected switches.

Operational Efficiency:Using the CLI ensures that VLAN settings are applied uniformly, reducing the likelihood of misconfigurations that might occur when managing VLANs individually on each switch.

According to theFortiOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, multi-tenancy in a FortiLink-managed environment allows a central FortiGate to partition a managed FortiSwitch fabric so that different ports can belong to different Virtual Domains (VDOMs). This is essential for Managed Service Providers (MSPs) who need to isolate client traffic at the hardware layer.

The documentation identifies two primary methods for achieving this assignment:

Assign to a VLAN and Perform VDOM Mapping (Option A):This is the most common method. The administrator creates a VLAN on the FortiLink interface and assigns it to a specific VDOM on the FortiGate. By assigning a physical FortiSwitch port to that specific VLAN, the port ' s traffic is logically terminated within the target VDOM. TheVDOM mappingensures that the switch-controller identifies which VDOM " owns " the traffic originating from that specific port/VLAN combination.

Create a Virtual Port Pool (Option B):For more advanced multi-tenancy, administrators can use the FortiGate CLI to create aVirtual Port Pool. This feature allows the FortiGate to " pool " physical switch ports and present them as logical resources that can be distributed across various VDOMs. This method provides greater flexibility in resource allocation without requiring the entire FortiLink interface to be moved.

Regarding the incorrect options:Option Cis incorrect because in a managed environment, the FortiSwitch CLI is not used for VDOM assignments; all orchestration must happen from the FortiGate.Option Dis incorrect because while you can move a FortiLink interface to a VDOM, this would move theentireswitch management and all its ports to that VDOM, which does not support a multi-tenant setup where different ports need to reside in different VDOMs.

" MSTP is based on RSTP " , so the same port role election and the same root bridge selection. Reference: FortiSwitch 7.6 Study Guide, page 187

Page 452 of 7.6 study guide, specifically states " Although you can use the sniffer command to capture traffic on switch ports, the types of packets capture by the sniffer are very limited.

The use of the sniffer command on FortiSwitch CLI can be unreliable on port 23 for specific reasons related to the nature of traffic on the port:

D.The switch port might be used as a trunk member.When a switch port is configured as a trunk, it can carry traffic for multiple VLANs. If the sniffer is set up without specifying VLAN tags or a range of VLANs to capture, it may not accurately capture or display all the VLAN traffic due to the volume and variety of VLAN-tagged packets passing through the trunk port. This limitation makes using the sniffer on a trunk port unreliable for capturing specific VLAN traffic unless properly configured to handle tagged traffic.

In mixed-vendor network environments, such as deployments that include bothFortiSwitchandCiscodevices, properLayer 2 discovery protocolsmust be enabled to allow devices to automatically discover neighbors and exchange essential device and interface information. FortiSwitchOS 7.6 supports bothCisco Discovery Protocol (CDP)andLink Layer Discovery Protocol (LLDP)to ensure interoperability.

Cisco Discovery Protocol (CDP)is a Cisco-proprietary Layer 2 discovery protocol widely used by Cisco switches, routers, and IP phones. When CDP is enabled on FortiSwitch interfaces, Cisco devices can discover FortiSwitch neighbors and receive information such as device ID, port ID, platform, and capabilities. This is particularly important in Cisco-centric networks where CDP is the primary discovery mechanism.

Link Layer Discovery Protocol (LLDP), defined by IEEE 802.1AB, is a vendor-neutral discovery protocol supported by both Fortinet and Cisco devices. Enabling LLDP allows FortiSwitch and Cisco devices to exchange standardized information including system name, port description, VLAN information, and management address. LLDP is essential for cross-vendor compatibility and is commonly enabled by default in modern enterprise networks.

The remaining options are incorrect.Unidirectional Link Detection (UDLD)is used to detect unidirectional fiber or copper link failures and does not provide device discovery or information exchange.LLDP-MEDis an extension of LLDP specifically designed for media endpoints such as IP phones and is not required for general switch-to-switch discovery.

Therefore, to ensure automatic discovery and information exchange between FortiSwitch and Cisco devices,both CDP and LLDP must be enabled, makingOptions B and Cthe correct and fully verified answers based on FortiSwitchOS 7.6 documentation.