View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 301

What is the main advantage of using a dedicated management network for FortiSwitch administration?

1. It increases the switching speed of all access ports.
2. It separates administrative traffic from normal user traffic.
3. It automatically creates VLANs.
4. It disables unauthorized DHCP servers.

Correct Answer: 2

Explanation:

A dedicated management network separates administrative access from ordinary user and application traffic. This can reduce the exposure of management services and make it easier to apply specific security controls to administrative connections. Management traffic can be restricted to approved administrators, systems, or network segments. A dedicated management network does not increase physical switching speed or automatically create VLANs. DHCP security is handled by features such as DHCP snooping. Separating management traffic is therefore an important network design and security practice.

Question 302

Which FortiSwitch feature can help identify the physical topology by showing information about directly connected neighboring devices?

1. LLDP
2. DHCP relay
3. Storm control
4. Port security

Correct Answer: 1

Explanation:

LLDP, or Link Layer Discovery Protocol, allows compatible network devices to exchange identification and capability information with directly connected neighbors. This information can help administrators understand physical network topology and troubleshoot incorrect cabling or unexpected connections. Depending on the device, LLDP information may include system name, interface details, capabilities, and other attributes. DHCP relay forwards DHCP requests across Layer 3 boundaries, storm control limits excessive traffic, and port security controls endpoint access. LLDP is therefore the most appropriate feature for neighbor discovery and topology visibility.

Question 303

What is a common purpose of an access VLAN on a FortiSwitch interface?

1. To determine the VLAN associated with untagged endpoint traffic
2. To negotiate LACP
3. To synchronize device clocks
4. To provide SNMP notifications

Correct Answer: 1

Explanation:

An access VLAN identifies the VLAN to which untagged traffic received on an access interface belongs. This is commonly used for endpoint devices such as workstations, printers, and other clients that do not normally send VLAN tags. The switch associates the incoming traffic with the configured VLAN and forwards it according to the Layer 2 switching table. LACP, NTP, and SNMP perform different functions. Correct access VLAN configuration is essential because assigning the wrong VLAN can place a device into an unintended network segment.

Question 304

What should an administrator verify when a trunk is carrying some VLANs successfully but another VLAN is not working?

1. Only the switch hostname
2. Only the NTP configuration
3. The affected VLAN’s existence and the allowed VLAN configuration on the trunk
4. Only the PoE budget

Correct Answer: 3

Explanation:

If some VLANs work across a trunk while another does not, the administrator should verify that the affected VLAN exists and is permitted on the trunk. The allowed VLAN list can restrict which VLAN IDs are forwarded across an interface. Administrators should also verify that the VLAN configuration is consistent on both sides of the connection and that tagging or native VLAN behavior is correct. Since the trunk already carries other VLANs, the physical connection is likely operational. Focusing on the affected VLAN’s configuration is therefore an appropriate troubleshooting step.

Question 305

Which feature is primarily responsible for preventing Layer 2 switching loops?

1. RADIUS
2. STP
3. SNMP
4. LLDP

Correct Answer: 2

Explanation:

Spanning Tree Protocol, or STP, is designed to prevent Layer 2 loops in Ethernet networks. Redundant physical links are useful for resilience, but without a loop-prevention mechanism they can create broadcast storms, duplicate frames, and unstable MAC learning. STP logically blocks certain redundant paths while maintaining them as potential backup paths. If the active topology changes, STP can allow another path to become available. RADIUS provides authentication, SNMP provides management information, and LLDP provides neighbor discovery, so none of those protocols performs the primary loop-prevention function.

Question 306

What is the purpose of configuring an edge port for an end-user device?

1. To allow the port to transition quickly toward forwarding for an endpoint connection
2. To force the port to become the STP root
3. To create a trunk automatically
4. To enable DHCP relay

Correct Answer: 1

Explanation:

An edge port is intended for interfaces connected to end devices rather than other switches. Such ports can transition toward forwarding more quickly because they are not expected to participate in the normal STP topology between switches. This reduces unnecessary waiting when an endpoint connects or the interface comes up. Edge-port configurations should be used carefully because connecting another switch to such a port can introduce topology risks. Protective features such as BPDU Guard can help detect unexpected STP participation on edge interfaces.

Question 307

Which feature can help protect an edge port when an unexpected switch sends BPDUs to it?

1. NTP
2. BPDU Guard
3. DHCP relay
4. SNMP polling

Correct Answer: 2

Explanation:

BPDU Guard is designed to protect ports that are expected to be connected only to end devices. If an unexpected BPDU is received on such a protected interface, the switch can place the interface into a protective state according to its configuration. This helps prevent an unauthorized or incorrectly connected switch from influencing the STP topology. BPDU Guard is especially useful when used with edge ports. NTP, DHCP relay, and SNMP polling do not provide protection against unexpected STP BPDUs.

Question 308

What does LACP primarily use to determine whether physical links can participate in an aggregation?

1. Compatible link aggregation and interface parameters
2. The DHCP server’s IP address
3. The SNMP polling interval
4. The native VLAN name only

Correct Answer: 1

Explanation:

LACP requires compatible physical interfaces and aggregation settings before links can successfully operate as members of a logical aggregate. Administrators should verify that the member interfaces have compatible speed, duplex, VLAN, and aggregation-related settings. LACP then uses protocol exchanges to negotiate and maintain the aggregated relationship. A DHCP server address or SNMP polling interval does not determine whether two interfaces can form an LACP group. The native VLAN may be part of the broader interface configuration, but it is not the sole factor determining LACP compatibility.

Question 309

What is a key benefit of configuration backups before making major network changes?

1. They provide a recovery point if the new configuration causes unexpected problems.
2. They guarantee that no outage can occur.
3. They automatically upgrade all connected switches.
4. They increase available PoE power.

Correct Answer: 1

Explanation:

Configuration backups provide a known recovery point before administrators make significant changes. If a configuration modification introduces unexpected connectivity or operational problems, the saved configuration can help restore the device to a previous working state. Backups do not guarantee that an outage will never happen and do not upgrade devices or increase PoE capacity. They are one part of proper change management, along with testing, maintenance windows, compatibility checks, and documentation. Regular backups are particularly important in larger environments where configuration changes can affect multiple devices.

Question 310

What is the primary function of a FortiSwitch MAC address table?

1. To store mappings between learned MAC addresses and switch interfaces
2. To store administrator passwords
3. To store NTP server certificates
4. To define RADIUS policies

Correct Answer: 1

Explanation:

The MAC address table allows the switch to determine where Layer 2 frames should be forwarded. When a switch receives a frame, it can learn the source MAC address and associate it with the incoming interface and VLAN context. When traffic is later destined for that MAC address, the switch can use the table to forward the frame toward the appropriate interface instead of flooding it unnecessarily. MAC entries can be dynamically learned and can age out when they are no longer observed. This process is fundamental to Ethernet switching.

Question 311

What is the main purpose of MAC address aging?

1. To periodically remove stale dynamically learned MAC entries
2. To increase PoE voltage
3. To create new VLANs automatically
4. To authenticate administrators

Correct Answer: 1

Explanation:

MAC address aging allows a switch to remove dynamically learned MAC entries that have not been observed for a configured period. This keeps the forwarding table current when devices move between interfaces or leave the network. Without aging, stale information could remain in the table and potentially cause inefficient forwarding behavior. When a device sends traffic again, its MAC address can normally be learned on the current interface. MAC aging is therefore an important part of maintaining an accurate and efficient Layer 2 forwarding table.

Question 312

Which mechanism can be used to provide centralized authentication for administrators or network-access users?

1. RADIUS
2. LLDP
3. STP
4. LACP

Correct Answer: 1

Explanation:

RADIUS provides centralized authentication and authorization services for network environments. Instead of maintaining separate authentication databases on every device, administrators can configure network equipment to communicate with a centralized RADIUS server. RADIUS can be used in various access-control scenarios, including 802.1X authentication and certain administrative authentication deployments. LLDP is used for neighbor discovery, STP prevents Layer 2 loops, and LACP provides link aggregation. Centralized authentication can improve consistency and simplify account management across a network.

Question 313

What should be checked if an 802.1X-authenticated endpoint is still placed into an unexpected network segment?

1. Only the physical cable
2. Authorization policy and VLAN assignment returned by the authentication system
3. Only the MAC aging timer
4. Only the switch’s NTP configuration

Correct Answer: 2

Explanation:

Successful 802.1X authentication does not necessarily mean the endpoint will receive the expected network access. Authorization policies can determine which VLAN or other access parameters are assigned after authentication. If an endpoint authenticates successfully but appears in the wrong network segment, administrators should inspect the RADIUS authorization response, VLAN assignment, switch policy, and interface configuration. The physical cable and NTP settings are unlikely to explain a logically incorrect VLAN assignment. Reviewing authentication and authorization together is important when troubleshooting identity-based network access.

Question 314

What is the purpose of RADIUS accounting in an authenticated network environment?

1. To provide records about authentication or session activity
2. To prevent Ethernet loops
3. To create PoE classes
4. To discover neighboring switches

Correct Answer: 1

Explanation:

RADIUS accounting can provide records related to user or device sessions and authentication activity. Depending on the implementation, accounting information may include session start and stop events, duration, identity information, and other attributes. This information can be useful for auditing, troubleshooting, and operational reporting. Authentication determines whether access is permitted, while accounting focuses on recording activity associated with sessions. RADIUS accounting does not perform STP loop prevention, PoE management, or neighbor discovery.

Question 315

Which traffic type is commonly controlled by storm control?

1. Excessive broadcast or multicast traffic
2. NTP synchronization packets only
3. RADIUS authentication packets only
4. Configuration backup files only

Correct Answer: 1

Explanation:

Storm control is designed to limit excessive Layer 2 traffic that can consume network resources. Broadcast traffic is a common target because a broadcast storm can affect many devices within a VLAN. Depending on platform capabilities and configuration, multicast or other traffic types may also be controlled. The goal is to prevent abnormal traffic volumes from overwhelming switch interfaces or connected devices. Storm control does not specifically target NTP, RADIUS, or configuration backup traffic. Proper thresholds should be selected carefully so legitimate traffic is not unnecessarily restricted.

Question 316

What is the main purpose of FortiSwitch interface statistics during troubleshooting?

1. To identify traffic levels, errors, drops, and other interface conditions
2. To automatically configure all VLANs
3. To replace configuration backups
4. To determine an administrator’s password

Correct Answer: 1

Explanation:

Interface statistics provide useful information about the operational condition of a switch port. Administrators can inspect values such as transmitted and received packets, errors, drops, and other counters to identify abnormal behavior. These statistics can help determine whether a problem is related to a physical link, congestion, configuration, or another network condition. Interface statistics do not automatically configure VLANs or replace configuration backups. They are an important diagnostic tool when investigating poor performance, packet loss, or unstable connectivity.

Question 317

What is a major reason to restrict management services to trusted networks?

1. To reduce the number of sources that can attempt administrative access
2. To increase VLAN broadcast traffic
3. To disable MAC learning
4. To improve LACP negotiation speed

Correct Answer: 1

Explanation:

Restricting management services to trusted networks reduces the number of locations from which attackers or unauthorized users can attempt to access network administration interfaces. This decreases the management-plane attack surface and makes access-control policies easier to enforce. Additional protections can include secure management protocols, strong authentication, individual administrator accounts, and trusted-host restrictions. Management restrictions do not affect MAC learning or directly improve LACP negotiation. They are primarily a security measure intended to protect administrative functions and sensitive configuration information.

Question 318

What is the purpose of a VLAN trunk between two FortiSwitch devices?

1. To carry traffic for multiple VLANs across a single physical connection
2. To provide only one untagged client VLAN
3. To disable STP
4. To provide centralized authentication

Correct Answer: 1

Explanation:

A VLAN trunk allows multiple VLANs to traverse the same physical connection between network devices. VLAN tags are used to distinguish traffic belonging to different VLANs, while the native VLAN may handle untagged traffic according to the configured design. Trunks are commonly used between switches, switches and routers, or other VLAN-aware devices. An access interface normally carries traffic for a single VLAN. Proper trunk configuration requires consistent VLAN definitions and appropriate allowed VLAN settings on both sides.

Question 319

Which feature can help a switch enforce that a specific MAC address is allowed on an interface?

1. Port security
2. NTP
3. LLDP
4. DHCP relay

Correct Answer: 1

Explanation:

Port security can be used to restrict which MAC addresses are permitted on a switch interface. Depending on the configuration, administrators may specify authorized MAC addresses or establish limits on the number of MAC addresses that can appear on a port. This can help reduce unauthorized device connections and strengthen access control at the Layer 2 edge. Port security is different from 802.1X, which provides identity-based authentication, although both mechanisms can be used as part of a broader access-control strategy.

Question 320

What should an administrator do before applying a major configuration change across many managed FortiSwitch devices?

1. Disable all monitoring
2. Remove existing configuration backups
3. Review the intended configuration, verify compatibility, and maintain a recovery option
4. Allow the change without documentation

Correct Answer: 3

Explanation:

Before applying a major configuration change across multiple switches, administrators should review the intended settings and verify that they are compatible with the affected devices and network design. A backup or known-good configuration should be available so the environment can be recovered if the change produces unexpected results. Testing the change on a smaller scope before broad deployment can also reduce risk. Proper documentation and change control help track what was modified and why. This approach improves reliability and minimizes the impact of configuration errors.