View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 381

What is the primary purpose of using a dedicated management network for FortiSwitch devices?

1. To increase the number of access VLANs
2. To isolate administrative traffic from ordinary user traffic
3. To replace STP functionality
4. To disable Layer 2 switching

Correct Answer: 2

Explanation:

A dedicated management network separates administrative traffic from normal user and application traffic. This improves security by reducing the exposure of management interfaces to ordinary endpoints. Administrators can restrict management access to approved systems or trusted networks and apply specific security policies to management traffic. A dedicated management network does not replace STP, disable Layer 2 switching, or automatically increase the number of VLANs. It is primarily an architectural security and operational control that helps protect network infrastructure from unauthorized administrative access.

Question 382

What is the main purpose of VLAN pruning on a switch trunk?

1. To disable VLAN tagging
2. To remove MAC addresses from the forwarding table
3. To allow only required VLANs across the trunk
4. To increase the number of broadcast domains

Correct Answer: 3

Explanation:

VLAN pruning limits the VLANs that are permitted to traverse a trunk link. If a connected device does not require a particular VLAN, that VLAN can be excluded from the trunk. This reduces unnecessary Layer 2 traffic and helps maintain proper network segmentation. It can also reduce the impact of accidental VLAN propagation. VLAN pruning does not disable tagging or remove MAC addresses from the switch table. Administrators should ensure that all required VLANs remain allowed on both sides of the connection before applying restrictive trunk policies.

Question 383

What is a likely result when a required VLAN is permitted on one side of a trunk but blocked on the other side?

1. Devices using that VLAN may lose connectivity across the trunk
2. The switch automatically increases its PoE budget
3. STP is permanently disabled
4. The switch automatically changes the VLAN ID

Correct Answer: 1

Explanation:

A VLAN must be appropriately permitted across the trunk for traffic belonging to that VLAN to reach the other side. If the VLAN is allowed on one switch but omitted or blocked on the neighboring switch, devices using that VLAN may not communicate across the trunk. Other VLANs can continue working normally, which can make the problem appear selective. Administrators should compare the allowed VLAN lists and tagging configuration on both ends of the trunk. This is a common configuration issue when troubleshooting VLAN-specific connectivity problems.

Question 384

Which configuration is normally appropriate for a workstation that belongs to a single VLAN?

1. A trunk carrying all available VLANs
2. An access interface assigned to the required VLAN
3. An LACP group connected to unrelated networks
4. A dedicated RADIUS interface

Correct Answer: 2

Explanation:

A normal workstation that belongs to one VLAN is generally connected through an access interface assigned to that VLAN. The switch handles the VLAN membership, while the endpoint typically sends ordinary Ethernet frames without needing to manage multiple VLAN tags. Trunk interfaces are more appropriate when multiple VLANs need to traverse the same physical connection. LACP is used for link aggregation, while RADIUS is associated with authentication. Correctly assigning the workstation’s access VLAN is therefore an important basic switch configuration requirement.

Question 385

What is the main purpose of assigning a voice VLAN to an interface used by an IP phone?

1. To disable data connectivity
2. To make the phone an STP root bridge
3. To provide a dedicated logical network for voice traffic
4. To prevent the phone from using PoE

Correct Answer: 3

Explanation:

A voice VLAN provides a dedicated logical network for IP phone traffic. Separating voice from ordinary user data can make it easier to apply appropriate security, quality-of-service, and network management policies. In many deployments, an IP phone and workstation can share a physical switch connection while using separate logical VLANs. The exact configuration depends on the phone and switch capabilities. A voice VLAN does not disable PoE or automatically make a device an STP root bridge. Its main purpose is logical separation of voice traffic.

Question 386

What should an administrator check if an IP phone does not receive the expected voice VLAN information?

1. Only the MAC aging timer
2. The voice VLAN and LLDP-MED configuration
3. Only the administrator password
4. Only the NTP server address

Correct Answer: 2

Explanation:

When an IP phone does not receive expected voice network information, administrators should verify the voice VLAN configuration and LLDP-MED settings where applicable. LLDP-MED can provide supported phones with network policy information, including voice VLAN-related details. The administrator should also verify that the interface is operational, the VLAN exists, and the phone supports the required discovery mechanism. MAC aging, administrator passwords, and NTP settings do not normally determine whether a phone receives its expected voice VLAN information.

Question 387

What information can DHCP snooping binding data provide?

1. Administrator authentication credentials
2. STP root bridge information
3. LACP system priority
4. Associations between client IP, MAC address, VLAN, and interface

Correct Answer: 4

Explanation:

DHCP snooping can create binding information from legitimate DHCP transactions. Depending on the implementation, this information can associate a client’s IP address and MAC address with the VLAN and switch interface where the client was learned. These trusted bindings can then support other security mechanisms, including Dynamic ARP Inspection and IP Source Guard. DHCP snooping bindings are not intended to store administrator credentials or determine STP root bridge elections. Maintaining accurate binding information is therefore important when other Layer 2 security features depend on it.

Question 388

Why is IP Source Guard commonly used together with DHCP snooping?

1. DHCP snooping can provide trusted IP-to-MAC/interface information for validation
2. DHCP snooping increases available PoE power
3. IP Source Guard replaces VLAN configuration
4. Both features are required to create an LACP group

Correct Answer: 1

Explanation:

IP Source Guard can use trusted binding information to restrict traffic based on expected source addressing. DHCP snooping can create trusted bindings that associate a client’s IP address and MAC address with a particular interface and VLAN. This combination can help prevent certain forms of source-address spoofing. Administrators should also consider devices using static addressing because those endpoints may require appropriate static or trusted bindings. These technologies provide Layer 2 security and do not replace VLAN configuration, increase PoE capacity, or establish link aggregation.

Question 389

What security problem is Dynamic ARP Inspection primarily designed to help mitigate?

1. Unauthorized administrator logins
2. ARP spoofing and poisoning
3. Excessive PoE consumption
4. Incorrect NTP synchronization

Correct Answer: 2

Explanation:

Dynamic ARP Inspection, commonly called DAI, helps protect against ARP spoofing and poisoning by validating ARP messages against trusted IP-to-MAC binding information. In many network designs, DHCP snooping supplies the trusted bindings used for this validation. When ARP information does not match the expected binding, the switch can take the configured protective action. DAI therefore operates as a Layer 2 security mechanism. It is not intended to provide administrator authentication, manage PoE power, or synchronize system clocks.

Question 390

What should be considered when DAI is enabled on a network containing statically addressed devices?

1. All static devices must be converted to DHCP
2. STP must be disabled on their interfaces
3. Appropriate static or trusted bindings may be required
4. Every device must join an LACP group

Correct Answer: 3

Explanation:

DHCP snooping normally learns bindings from DHCP transactions, but statically configured devices may not generate DHCP traffic. If DAI relies on binding information for ARP validation, administrators may need to configure appropriate static or trusted information for those endpoints. Without the required information, legitimate ARP traffic from a static device could potentially fail validation. The exact implementation depends on the FortiSwitch configuration. Static devices do not need to be converted to DHCP or placed into LACP merely because DAI is being used.

Question 391

Which condition can be an indication of an unstable Layer 2 topology?

1. Successful NTP synchronization
2. Normal SNMP polling
3. Regular RADIUS accounting
4. Frequent unexpected STP topology changes

Correct Answer: 4

Explanation:

Frequent and unexpected STP topology changes can indicate instability within a Layer 2 network. Possible causes include link flapping, incorrect cabling, redundant connections, or other topology changes. Administrators should investigate STP status, interface events, logs, and physical connectivity to identify the source of the instability. Normal NTP synchronization, SNMP polling, or RADIUS accounting does not by itself indicate an STP problem. Monitoring topology changes can therefore provide an important clue when diagnosing intermittent connectivity or possible Layer 2 loops.

Question 392

What is the primary function of BPDU Filtering when it is intentionally configured on an interface?

1. To provide DHCP addresses
2. To control the handling of BPDUs on selected interfaces
3. To increase Ethernet bandwidth
4. To configure administrator authentication

Correct Answer: 2

Explanation:

BPDU Filtering controls the transmission or processing of Bridge Protocol Data Units on selected interfaces. It should be used carefully because improperly filtering BPDUs can interfere with STP protection and potentially contribute to Layer 2 loops. Administrators should understand the topology and the expected behavior before applying this feature. BPDU Filtering is different from BPDU Guard, which is designed to react to unexpected BPDUs on protected edge interfaces. DHCP, authentication, and bandwidth management are unrelated to the primary function of BPDU Filtering.

Question 393

What is an important difference between BPDU Guard and Root Guard?

1. BPDU Guard is for DHCP security, while Root Guard is for SNMP
2. BPDU Guard increases bandwidth, while Root Guard provides PoE
3. BPDU Guard protects edge ports from unexpected BPDUs, while Root Guard helps prevent an unexpected switch from influencing the STP root
4. Both features perform exactly the same function

Correct Answer: 3

Explanation:

BPDU Guard and Root Guard are both STP protection mechanisms, but they address different situations. BPDU Guard is typically used on edge ports that should connect to end devices. If an unexpected BPDU arrives, the port can be placed into a protective state. Root Guard is used where administrators want to prevent a connected device from becoming an unexpected influence on the STP root hierarchy through superior BPDUs. Understanding the distinction allows administrators to select the appropriate protection for each part of the topology.

Question 394

What should be verified when a replacement FortiSwitch does not become properly managed after installation?

1. Device authorization, management connectivity, and provisioning status
2. Only the DHCP lease duration
3. Only the MAC aging timer
4. Only the workstation’s IP address

Correct Answer: 1

Explanation:

After replacing a managed FortiSwitch, administrators should verify that the replacement device has proper physical and management connectivity and that it has been discovered and authorized by the centralized management system as required. Provisioning or configuration assignment should also be reviewed. If the device is not properly authorized or cannot establish its management relationship, centralized configuration may not be applied as expected. DHCP lease duration and MAC aging are generally not the primary areas to investigate when the main problem is failure of centralized device management.

Question 395

What is an important consideration when designing redundant FortiLink connectivity?

1. Every link must use a completely different VLAN
2. STP must always be disabled
3. The topology must provide redundancy without creating an unintended Layer 2 loop
4. All redundant links should connect to unrelated networks

Correct Answer: 3

Explanation:

Redundant FortiLink connectivity can improve availability, but the topology must be designed carefully. Administrators need to understand the supported FortiLink architecture and ensure that redundant paths do not introduce unintended Layer 2 loops or conflicting configurations. Appropriate FortiGate and FortiSwitch settings should be used according to the intended topology. Simply disabling STP or assigning arbitrary VLANs is not a reliable redundancy strategy. The objective is to provide resilient management and network connectivity while maintaining a predictable and stable switching topology.

Question 396

Why are FortiSwitch event logs useful during troubleshooting?

1. They increase switch memory
2. They can reveal interface events, configuration activity, and other operational conditions
3. They automatically repair failed interfaces
4. They provide electrical power to endpoints

Correct Answer: 2

Explanation:

Event logs provide valuable information about activities and conditions occurring on a FortiSwitch. Depending on the configured logging capabilities, administrators can identify interface changes, authentication events, configuration modifications, topology-related events, and other operational conditions. Logs can be especially useful for investigating intermittent issues because timestamps help correlate network events with user-reported problems. They do not increase hardware resources, automatically repair interfaces, or provide PoE. Maintaining appropriate logs and reviewing them during troubleshooting improves visibility into switch behavior.

Question 397

What is the main security benefit of using administrator profiles or role-based permissions?

1. They increase trunk bandwidth
2. They assign IP addresses to users
3. They provide PoE power
4. They allow administrators to receive only the privileges required for their roles

Correct Answer: 4

Explanation:

Role-based administrator permissions support the principle of least privilege. Instead of giving every administrator unrestricted access, organizations can provide permissions based on job responsibilities. For example, an administrator may be allowed to monitor devices without being permitted to modify critical configurations. This reduces the potential impact of compromised credentials and accidental changes. Administrator profiles do not increase network bandwidth, assign client IP addresses, or provide PoE. Proper privilege separation is an important component of securing centralized network management.

Question 398

Which practice can reduce the risk of unauthorized access to FortiSwitch management services?

1. Restrict management access to trusted hosts or networks
2. Allow management access from every network
3. Disable administrator authentication
4. Share one unrestricted account among all administrators

Correct Answer: 1

Explanation:

Restricting management services to trusted hosts or networks reduces the number of locations from which administrative access can be attempted. This can be combined with strong authentication, appropriate administrator profiles, secure management protocols, and monitoring. Broadly exposing management interfaces increases the attack surface and makes unauthorized access attempts easier. Shared unrestricted accounts also make accountability and access control more difficult. Management-plane security should therefore use multiple layers of protection rather than relying on a single control.

Question 399

What should an administrator do after making a significant FortiSwitch configuration change?

1. Immediately delete the previous configuration backup
2. Disable event logging
3. Verify network operation and monitor the affected services
4. Disconnect the management system

Correct Answer: 3

Explanation:

After making an important configuration change, administrators should verify that the affected interfaces, VLANs, management connectivity, authentication, and services are operating correctly. Monitoring the environment after the change can reveal unexpected behavior that was not immediately obvious. Previous backups and configuration revisions should normally be retained until the change has been confirmed as stable. Disabling logging would reduce visibility during a critical period. Post-change validation and monitoring are therefore important parts of controlled network administration and help minimize the impact of configuration errors.

Question 400

Which approach best supports reliable FortiSwitch operations in a centrally managed environment?

1. Configure every switch differently without documentation
2. Disable STP and security features to simplify management
3. Perform every configuration manually without backups
4. Combine standardized configurations, security controls, monitoring, backups, and controlled changes

Correct Answer: 4

Explanation:

Reliable FortiSwitch management requires multiple complementary practices rather than relying on a single feature. Standardized configurations and templates help maintain consistency, while security controls such as 802.1X, DHCP snooping, DAI, and STP protections improve network security and resilience. Monitoring and event logging provide visibility into operational conditions. Configuration backups and revision history support recovery when changes cause unexpected problems. Finally, controlled testing and documented change procedures reduce operational risk. Combining these practices provides a more stable, secure, and manageable switching environment than relying on manual configuration or disabling protective features.