View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 81

Which FortiSwitch feature can help protect a network from unauthorized devices by controlling the MAC addresses allowed on a port?

1. NTP
2. Port security
3. LLDP
4. SNMP

Correct Answer: 2

Explanation:

Port security can be used to restrict the MAC addresses that are permitted on a FortiSwitch interface. This can help prevent unauthorized devices from connecting to sensitive network ports. Depending on the configuration, an administrator may specify permitted MAC addresses or limit the number of MAC addresses that can be learned on an interface. If an unexpected device appears, the configured security action can be applied. NTP provides time synchronization, LLDP provides neighbor discovery, and SNMP provides monitoring and management. Port security is therefore the most relevant feature when the objective is to control which endpoint MAC addresses can use a switch interface.

Question 82

What is the primary function of a FortiSwitch VLAN?

1. To provide electrical power
2. To synchronize device clocks
3. To create a logical Layer 2 network segment
4. To authenticate RADIUS users

Correct Answer: 3

Explanation:

A VLAN, or Virtual Local Area Network, creates a logical Layer 2 network segment within switching infrastructure. VLANs allow administrators to separate different groups of devices without requiring a completely separate physical switch for every network segment. For example, employee, guest, voice, and management traffic can be placed into separate VLANs. This improves organization and can provide a foundation for applying different security and routing policies. VLANs do not provide electrical power, synchronize clocks, or directly authenticate users. PoE handles power delivery, NTP handles time synchronization, and RADIUS can provide centralized authentication.

Question 83

Which FortiSwitch feature can provide additional visibility into traffic statistics without directly interrupting normal packet forwarding?

1. SNMP
2. STP
3. LACP
4. RADIUS

Correct Answer: 1

Explanation:

SNMP can provide monitoring systems with operational information and statistics from FortiSwitch devices. Depending on the configured monitoring system and supported MIBs, administrators can view interface status, packet counters, errors, traffic levels, and other device information. This visibility helps identify congestion, failed interfaces, and unusual traffic patterns. SNMP does not itself prevent switching loops, aggregate physical links, or authenticate endpoints. STP is designed for loop prevention, LACP manages link aggregation, and RADIUS commonly provides centralized authentication. Therefore, SNMP is the best choice when the objective is to obtain network-management information and traffic statistics.

Question 84

Which component typically acts as the authenticator when implementing 802.1X on a FortiSwitch access port?

1. The endpoint’s web browser
2. The FortiSwitch
3. The DNS server
4. The NTP server

Correct Answer: 2

Explanation:

In an 802.1X deployment, the network switch typically acts as the authenticator. It controls access to the network port and communicates with the endpoint, which acts as the supplicant. The switch can also communicate with a RADIUS authentication server to validate the credentials or identity information provided by the endpoint. This architecture allows the switch to keep the port restricted until authentication succeeds. DNS servers and NTP servers perform completely different functions and are not responsible for controlling 802.1X port authorization. Therefore, the FortiSwitch is the component that normally performs the authenticator role.

Question 85

What is the main purpose of configuring an NTP server on FortiSwitch devices?

1. To synchronize system time
2. To provide VLAN tagging
3. To aggregate Ethernet links
4. To authenticate network users

Correct Answer: 1

Explanation:

NTP, or Network Time Protocol, allows FortiSwitch devices to synchronize their system clocks with a configured time source. Accurate time is important for logging, monitoring, troubleshooting, and security investigations. If different network devices have significantly different clocks, administrators may find it difficult to correlate events accurately across the infrastructure. NTP does not provide VLAN tagging, link aggregation, or user authentication. VLAN configuration controls Layer 2 segmentation, LACP handles link aggregation, and RADIUS is commonly used for centralized authentication. Consistent NTP configuration therefore helps ensure reliable timestamps across the switching environment.

Question 86

Which feature can help prevent a malicious host from using a forged source IP address on a FortiSwitch network?

1. IP source guard
2. LLDP
3. PoE
4. LACP

Correct Answer: 1

Explanation:

IP source guard is designed to help prevent unauthorized source IP addresses from being used on a switch interface. It can use trusted IP-to-MAC binding information to determine whether traffic arriving from an endpoint matches an expected source identity. This helps reduce certain IP-spoofing attacks, especially in access-layer environments. DHCP snooping can provide useful binding information for related security mechanisms. LLDP is used for neighbor discovery, PoE supplies electrical power, and LACP provides link aggregation. Therefore, IP source guard is the most appropriate feature when the objective is to restrict traffic using unauthorized source IP addresses.

Question 87

Which FortiSwitch feature can help protect against excessive unknown-unicast traffic?

1. RADIUS
2. Storm control
3. NTP
4. 802.1X

Correct Answer: 2

Explanation:

Storm control can be configured to limit excessive amounts of certain types of Layer 2 traffic, including unknown-unicast traffic. Excessive unknown-unicast, broadcast, or multicast traffic can consume network bandwidth and switch resources. In extreme situations, this behavior may affect legitimate communications across the network. Storm-control thresholds help administrators limit the impact of such traffic and improve network stability. RADIUS provides authentication, NTP synchronizes clocks, and 802.1X controls authenticated network access. Therefore, storm control is the most suitable feature when administrators want to control excessive Layer 2 traffic on switch interfaces.

Question 88

What is the primary benefit of using a centralized FortiSwitch management solution?

1. It makes every switch independent of configuration policies
2. It provides unified administration and monitoring
3. It removes the requirement for network segmentation
4. It disables switch logs

Correct Answer: 2

Explanation:

Centralized management provides a unified method for administering and monitoring multiple FortiSwitch devices. Instead of repeatedly configuring individual switches, administrators can use centralized tools to maintain consistent settings, monitor operational status, review topology information, and simplify routine management tasks. This can become particularly valuable as the number of switches increases. Centralized management does not eliminate network segmentation, disable logging, or make each switch independent of policies. Its primary benefit is improving operational efficiency and consistency. By reducing repetitive administration, centralized management can also make troubleshooting and configuration auditing easier across a larger FortiSwitch deployment.

Question 89

Which configuration is normally used when a FortiSwitch interface connects to an IP phone and the attached workstation uses a separate data VLAN?

1. A configuration supporting separate voice and data VLANs
2. An NTP-only configuration
3. A port-mirroring-only configuration
4. An LACP configuration with no VLANs

Correct Answer: 1

Explanation:

When an IP phone and workstation share the same physical switch connection, separate voice and data VLANs can be used to logically isolate their traffic. The phone can use the voice VLAN while the attached workstation uses the appropriate data VLAN. This design allows administrators to apply different policies and quality-of-service considerations to voice and user traffic. The exact FortiSwitch configuration depends on the phone and network design, but the important concept is maintaining logical separation between voice and data. NTP, port mirroring, and LACP do not provide this voice/data VLAN segmentation by themselves.

Question 90

What happens when a switch receives an Ethernet frame whose destination MAC address is not currently in its MAC address table?

1. It always sends the frame only to the management interface
2. It normally floods the frame within the applicable VLAN
3. It immediately deletes the VLAN
4. It sends the frame to the NTP server

Correct Answer: 2

Explanation:

When a switch does not know the destination MAC address for a frame, it generally treats the frame as an unknown unicast and floods it out appropriate ports within the same VLAN, excluding the port on which the frame was received. When the destination device responds, the switch can learn its source MAC address and associate it with the receiving interface. This allows future frames to be forwarded more efficiently. The frame is not sent specifically to the management interface or NTP server. Understanding MAC learning and unknown-unicast behavior is important when troubleshooting Layer 2 connectivity.

Question 91

Which protocol is commonly used to provide centralized authentication services for FortiSwitch 802.1X clients?

1. RADIUS
2. STP
3. LLDP
4. LACP

Correct Answer: 1

Explanation:

RADIUS is commonly used as the centralized authentication server protocol in 802.1X deployments. When a client attempts to access the network, the FortiSwitch can act as the authenticator and communicate with the RADIUS server to validate the endpoint’s authentication information. The authentication result can determine whether the port is authorized and, depending on the deployment, may provide additional authorization information. STP handles Layer 2 loop prevention, LLDP provides neighbor discovery, and LACP manages link aggregation. RADIUS therefore plays a central role when centralized authentication is required for 802.1X-controlled FortiSwitch ports.

Question 92

What is the primary purpose of a trunk’s native VLAN in a typical VLAN configuration?

1. To identify traffic that is transmitted untagged on the trunk
2. To provide PoE power
3. To authenticate RADIUS users
4. To prevent all multicast traffic

Correct Answer: 1

Explanation:

The native VLAN is commonly associated with untagged traffic transmitted over a trunk. While tagged traffic includes VLAN identification, untagged traffic requires the receiving device to have an agreed-upon VLAN context. Therefore, both ends of a trunk should be configured consistently when a native VLAN is used. Incorrect native-VLAN configurations can cause traffic to be placed into an unintended VLAN and may create connectivity or security problems. PoE handles power delivery, RADIUS supports authentication, and multicast control is a separate networking function. The native VLAN’s primary purpose is therefore to define the VLAN context for applicable untagged trunk traffic.

Question 93

Which FortiSwitch feature can help identify the physical port where a particular MAC address was learned?

1. NTP
2. MAC address table
3. RADIUS accounting
4. DHCP relay

Correct Answer: 2

Explanation:

The MAC address table records learned Layer 2 addresses and the switch interfaces associated with them. By examining the table, an administrator can often determine which physical port currently has a particular MAC address associated with it. This is useful when locating an endpoint, troubleshooting unexpected connectivity, or identifying where a device is connected within the switching topology. NTP provides time synchronization, RADIUS accounting records authentication-related information, and DHCP relay forwards DHCP requests between network segments. Therefore, the MAC address table is the appropriate source for determining where a learned MAC address is associated within the switch.

Question 94

Why is DHCP snooping information useful for other Layer 2 security features?

1. It can provide trusted IP-to-MAC binding information
2. It automatically creates encrypted tunnels
3. It disables all VLANs
4. It increases PoE power capacity

Correct Answer: 1

Explanation:

DHCP snooping can build or maintain trusted bindings between client IP addresses, MAC addresses, VLANs, and switch interfaces based on legitimate DHCP activity. This information can be useful to other security mechanisms that need to validate whether traffic is using an expected IP-to-MAC relationship. For example, features such as Dynamic ARP Inspection and IP source guard can use trusted binding information as part of their security decisions. DHCP snooping does not create encrypted tunnels, disable VLANs, or increase PoE capacity. Its security value extends beyond blocking rogue DHCP servers because its learned information can support additional access-layer protections.

Question 95

Which FortiSwitch feature is most directly associated with preventing unauthorized ARP responses from reaching clients?

1. LACP
2. DAI
3. NTP
4. SNMP

Correct Answer: 2

Explanation:

Dynamic ARP Inspection, or DAI, helps protect clients from forged or unauthorized ARP messages. It inspects ARP traffic and validates the information according to trusted IP-to-MAC bindings and configured policies. This can reduce the risk of ARP spoofing, where an attacker sends fraudulent ARP information to redirect traffic through the attacker’s device. LACP is used for link aggregation, NTP handles time synchronization, and SNMP is used for monitoring and management. Therefore, DAI is the most directly relevant security feature when the goal is to inspect and control ARP responses within a Layer 2 network.

Question 96

What is one purpose of using LLDP information in a FortiSwitch environment?

1. To identify connected network devices and their capabilities
2. To provide centralized password authentication
3. To assign DHCP addresses
4. To prevent ARP spoofing

Correct Answer: 1

Explanation:

LLDP allows directly connected network devices to exchange information about themselves. Depending on the implementation, this can include device identity, interface information, system capabilities, and other topology-related details. Administrators can use this information to understand how network devices are connected and to troubleshoot unexpected physical connections. LLDP does not provide centralized password authentication, assign DHCP addresses, or directly prevent ARP spoofing. RADIUS, DHCP, and DAI address those respective functions. LLDP is therefore especially useful for topology discovery and identifying the characteristics of neighboring devices connected to FortiSwitch interfaces.

Question 97

Which action can help reduce unnecessary traffic across a FortiSwitch trunk?

1. Allow only the VLANs required on the trunk
2. Enable every VLAN on every trunk
3. Disable all MAC learning
4. Remove all access ports

Correct Answer: 1

Explanation:

Restricting a trunk to only the VLANs required by the network design can reduce unnecessary Layer 2 traffic. For example, a trunk between two switches may only need to carry employee, voice, and management VLANs. There is generally little reason to permit unrelated VLANs if their traffic does not need to cross that link. Allowing every VLAN can increase unnecessary traffic and make troubleshooting more difficult. Disabling MAC learning would negatively affect normal switching behavior, while removing access ports would not be a practical solution. Therefore, maintaining a controlled allowed-VLAN list is an effective way to limit unnecessary trunk traffic.

Question 98

What is the purpose of configuring a trusted interface for DHCP snooping?

1. To identify an interface from which legitimate DHCP server traffic is expected
2. To disable all DHCP communication
3. To convert DHCP traffic into SNMP
4. To provide NTP synchronization

Correct Answer: 1

Explanation:

A trusted DHCP snooping interface is normally associated with a legitimate DHCP server or a path toward one. DHCP server responses are expected to arrive through trusted interfaces, while client-facing interfaces are generally treated as untrusted. This distinction allows the switch to help block unauthorized DHCP server responses arriving from inappropriate locations. DHCP snooping therefore helps protect clients from rogue DHCP servers. It does not disable DHCP entirely, convert DHCP into SNMP, or provide time synchronization. Correctly identifying trusted interfaces is important because incorrectly trusting a client-facing interface could weaken the intended protection against unauthorized DHCP responses.

Question 99

Which feature can provide redundancy when multiple physical links are combined between compatible switches?

1. LLDP
2. LACP link aggregation
3. NTP
4. RADIUS

Correct Answer: 2

Explanation:

LACP-based link aggregation can combine multiple physical Ethernet links into a logical aggregated connection. This provides redundancy because traffic can continue using remaining links if one participating physical link fails, assuming the aggregation remains operational. It can also provide increased aggregate bandwidth when multiple links are active. LLDP provides neighbor discovery, NTP provides time synchronization, and RADIUS provides centralized authentication. Link aggregation should be configured consistently on the participating devices, and administrators should verify that the physical interfaces have compatible characteristics. LACP is therefore the most appropriate feature when multiple links are being combined for resilience and capacity.

Question 100

Which combination provides a strong foundation for controlling authenticated wired network access on FortiSwitch?

1. LLDP and NTP
2. STP and PoE
3. 802.1X and RADIUS
4. LACP and SNMP

Correct Answer: 3

Explanation:

802.1X combined with RADIUS provides a common architecture for authenticated wired network access. The FortiSwitch can act as the 802.1X authenticator, controlling access to the switch port, while the RADIUS server performs centralized authentication and authorization. This allows organizations to make access decisions based on authenticated users or devices instead of relying solely on physical port configuration. LLDP and NTP provide discovery and time synchronization, STP and PoE address loop prevention and power delivery, while LACP and SNMP provide link aggregation and monitoring. Therefore, 802.1X with RADIUS is the most appropriate combination for authenticated wired access control.