View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 221

Which feature helps prevent unauthorized devices from connecting to a switch port by limiting the number or identity of allowed MAC addresses?

1. NTP
2. LLDP
3. Port security
4. DHCP relay

Correct Answer: 3

Explanation:

Port security provides a mechanism for controlling which MAC addresses can use a switch interface. An administrator can configure restrictions such as a maximum number of MAC addresses or specify authorized addresses, depending on the supported implementation. This can help prevent unauthorized devices from connecting through access ports. NTP is used for time synchronization, LLDP provides neighbor discovery, and DHCP relay forwards DHCP requests between networks. Port security is therefore the most appropriate feature when the goal is to restrict endpoint access based on MAC addresses.

Question 222

What is the primary purpose of a FortiSwitch interface configured as a mirror destination?

1. To receive copied traffic for monitoring or analysis
2. To provide DHCP services
3. To become the STP root bridge
4. To provide NTP synchronization

Correct Answer: 1

Explanation:

A mirror destination interface receives copies of traffic selected from one or more source interfaces. This allows a connected packet analyzer, intrusion detection system, or troubleshooting tool to inspect network traffic without changing the original forwarding path. The destination interface is therefore normally dedicated to monitoring rather than ordinary endpoint connectivity. DHCP provides IP addressing, STP controls Layer 2 loops, and NTP synchronizes system time. Using a mirror destination is particularly useful when administrators need to investigate application behavior, unusual traffic, or connectivity problems at the packet level.

Question 223

Which setting determines whether a switch interface operates as an access port or trunk for VLAN traffic?

1. Interface VLAN mode or role
2. NTP configuration
3. RADIUS accounting
4. SNMP trap destination

Correct Answer: 1

Explanation:

The interface’s VLAN mode or role determines how the port handles VLAN traffic. An access interface is generally associated with a single VLAN for an endpoint, while a trunk interface can transport traffic for multiple VLANs using appropriate tagging. Correctly selecting the interface role is essential for communication between endpoints, switches, and other network devices. NTP, RADIUS accounting, and SNMP trap settings serve different purposes and do not determine whether an interface functions as an access port or trunk. Administrators should verify both ends of an inter-switch connection for compatible VLAN settings.

Question 224

What is the purpose of LLDP-MED in a voice network?

1. To provide network-related information and policies to supported endpoints such as IP phones
2. To aggregate Ethernet links
3. To synchronize switch clocks
4. To inspect ARP packets

Correct Answer: 1

Explanation:

LLDP-MED extends LLDP with capabilities designed for devices such as IP phones and other media endpoints. It can communicate useful information such as network policy and device-related information to supported endpoints. In a voice deployment, this can help automate or simplify aspects of voice VLAN and endpoint configuration. LACP is responsible for link aggregation, NTP provides time synchronization, and DAI inspects ARP traffic. LLDP-MED is therefore especially useful in environments where administrators need structured discovery and network-policy information for voice devices.

Question 225

Which condition is most likely to indicate a Layer 2 switching loop?

1. Excessive broadcast or multicast traffic
2. Correct NTP synchronization
3. A successful RADIUS authentication
4. A normal LLDP neighbor entry

Correct Answer: 1

Explanation:

A Layer 2 loop can cause frames, especially broadcasts and certain multicast or unknown-unicast traffic, to circulate repeatedly through the network. This can produce excessive traffic, high interface utilization, MAC-table instability, and degraded network performance. Spanning Tree Protocol is commonly used to prevent such loops by calculating a loop-free forwarding topology. NTP synchronization, successful RADIUS authentication, and LLDP neighbor information do not by themselves indicate a switching loop. When abnormal broadcast levels and repeated MAC movements are observed, administrators should investigate the Layer 2 topology and STP state.

Question 226

What is one benefit of using centralized FortiSwitch management instead of configuring every switch independently?

1. It provides a common management point for configuration and monitoring
2. It removes the need for network connectivity
3. It disables all switch security features
4. It automatically repairs physical cables

Correct Answer: 1

Explanation:

Centralized management provides a common administrative environment where multiple FortiSwitch devices can be configured, monitored, and maintained. This can reduce repetitive work and help administrators apply consistent policies across the switching infrastructure. Centralized management can also improve visibility because device status and configuration information can be viewed from a common location. It does not eliminate the need for network connectivity, disable security features, or repair physical infrastructure. For larger deployments, centralized management can significantly simplify operational tasks and reduce configuration inconsistencies between switches.

Question 227

Which configuration can reduce the risk of an unauthorized DHCP server responding to clients?

1. DHCP snooping with appropriate trusted and untrusted interfaces
2. LACP
3. LLDP-MED
4. NTP

Correct Answer: 1

Explanation:

DHCP snooping can distinguish between trusted interfaces, where legitimate DHCP server traffic is expected, and untrusted interfaces, where clients are normally connected. Unauthorized DHCP server responses arriving through an untrusted interface can be blocked according to the configured behavior. This helps protect clients from receiving incorrect IP addresses, gateways, DNS servers, or other network settings from a rogue DHCP server. LACP, LLDP-MED, and NTP provide link aggregation, endpoint discovery, and time synchronization respectively. Properly configuring DHCP snooping trust boundaries is therefore an important Layer 2 security practice.

Question 228

What should be verified if an IP phone receives an IP address but cannot reach voice services?

1. Voice VLAN and network policy configuration
2. The switch’s wallpaper setting
3. The NTP server’s hostname only
4. The number of SNMP users only

Correct Answer: 1

Explanation:

If an IP phone receives an IP address but cannot reach voice services, administrators should verify that it is placed into the correct voice VLAN and receives the appropriate network policy. The phone may have DHCP connectivity but still be assigned to the wrong VLAN or subject to an incorrect access policy. Administrators should also check routing, gateway reachability, and any applicable security policies. NTP and SNMP can support network operations but do not normally determine the phone’s voice VLAN membership. Correct voice VLAN configuration is therefore an important troubleshooting step.

Question 229

Which STP protection mechanism is intended to protect a port from receiving superior BPDUs from an unexpected downstream switch?

1. Storm control
2. Root Guard
3. DHCP snooping
4. Port mirroring

Correct Answer: 2

Explanation:

Root Guard helps prevent an unexpected downstream switch from influencing the STP root topology by sending superior BPDUs. It is appropriate on interfaces where the administrator does not expect a connected device to become a preferred path toward the root bridge. If a superior BPDU is received, the port can enter a protective state according to the configured behavior. Storm control limits excessive traffic, DHCP snooping protects DHCP operations, and port mirroring copies traffic for analysis. Root Guard is therefore the appropriate STP protection mechanism for this situation.

Question 230

What is the main purpose of restricting management services to trusted interfaces or networks?

1. To reduce unauthorized access to the switch management plane
2. To increase PoE output
3. To eliminate MAC learning
4. To increase the number of VLANs automatically

Correct Answer: 1

Explanation:

Restricting management services to trusted interfaces or networks reduces the number of locations from which administrators can attempt to access the switch. This limits exposure of management protocols and helps reduce the attack surface. For example, management access may be permitted only from a dedicated administrative network while being blocked from ordinary user VLANs. This should be combined with secure authentication and appropriate administrator permissions. Management restrictions do not increase PoE capacity, disable MAC learning, or automatically create VLANs. They primarily protect the management plane.

Question 231

Which information can be obtained from an interface’s operational status?

1. Link state, negotiated speed, and duplex information
2. The user’s password
3. The DHCP server’s database
4. The physical location of every network device

Correct Answer: 1

Explanation:

Interface operational status can provide useful information such as whether the link is up or down and, depending on the interface and platform, the negotiated speed and duplex mode. This information is valuable for troubleshooting physical connectivity and performance issues. Administrators can compare the operational state with the expected configuration to identify negotiation problems. Interface status does not reveal user passwords or provide access to a DHCP server’s entire database. It also cannot automatically determine the physical location of every device on the network.

Question 232

What is the purpose of configuring an appropriate STP root bridge?

1. To influence the preferred Layer 2 traffic topology
2. To provide IP addresses to clients
3. To authenticate administrators
4. To provide PoE power

Correct Answer: 1

Explanation:

The STP root bridge serves as the reference point for calculating the loop-free Layer 2 topology. By deliberately selecting an appropriate switch as the root bridge, administrators can influence which paths are preferred for Layer 2 traffic. This can improve predictability and help prevent an undesirable switch from becoming the root. DHCP provides IP addresses, RADIUS can authenticate users, and PoE provides electrical power. Proper root bridge planning is therefore an important part of designing a stable and predictable Layer 2 network.

Question 233

Which feature can be used to detect and restrict excessive traffic on a switch interface?

1. Storm control
2. NTP
3. RADIUS
4. LLDP

Correct Answer: 1

Explanation:

Storm control can monitor traffic types such as broadcast and multicast traffic and apply configured thresholds or protective actions when traffic becomes excessive. This helps prevent abnormal traffic levels from consuming excessive bandwidth or switch resources. Excessive Layer 2 traffic can be caused by loops, faulty devices, or other network conditions. NTP provides time synchronization, RADIUS handles authentication and accounting, and LLDP discovers neighboring devices. Storm control is therefore the feature most directly associated with limiting the impact of excessive traffic on a switch interface.

Question 234

What is a key advantage of using LACP instead of treating multiple Ethernet links as unrelated connections?

1. It can combine links into a logical aggregated connection
2. It disables all Layer 2 forwarding
3. It removes the need for switch configuration
4. It converts Ethernet into wireless traffic

Correct Answer: 1

Explanation:

LACP allows compatible physical Ethernet interfaces to participate in a logical link aggregation group. This can provide redundancy and increased aggregate bandwidth while presenting the connection as a logical interface to the network. If one member link fails, remaining links may continue carrying traffic, depending on the available capacity and configuration. LACP does not disable Layer 2 forwarding, eliminate configuration requirements, or convert Ethernet to wireless. Both connected devices should have compatible aggregation settings, and member links generally need consistent characteristics for successful operation.

Question 235

Which feature can provide centralized records of network access sessions when properly configured?

1. RADIUS accounting
2. LLDP
3. STP
4. PoE

Correct Answer: 1

Explanation:

RADIUS accounting can provide centralized records related to authenticated network-access sessions. Depending on the implementation, accounting information can include events such as session start and stop times and other supported session attributes. This can help administrators monitor access activity and investigate user or endpoint connections. LLDP provides neighbor discovery, STP controls Layer 2 topology, and PoE supplies electrical power. RADIUS accounting is therefore the appropriate choice when centralized records of network-access sessions are required.

Question 236

What should an administrator verify if a trunk carries some VLANs but unexpectedly drops others?

1. The trunk’s allowed VLAN list and VLAN configuration
2. The NTP time zone
3. The administrator’s browser history
4. The PoE power budget

Correct Answer: 1

Explanation:

When only some VLANs work across a trunk, the administrator should verify the allowed VLAN list and confirm that the missing VLANs are configured correctly on both sides. The VLAN may have been excluded from the trunk, incorrectly tagged, or missing from one of the connected switches. Native VLAN settings should also be reviewed when applicable. NTP settings and browser history have no relationship to VLAN transport, while PoE affects electrical power rather than VLAN forwarding. Comparing trunk and VLAN configuration on both ends is a practical troubleshooting approach.

Question 237

Which technology can automatically provide a switch with information about directly connected IP phones and other supported endpoints?

1. LLDP-MED
2. NTP
3. LACP
4. DHCP relay

Correct Answer: 1

Explanation:

LLDP-MED provides enhanced neighbor discovery capabilities for media endpoints such as IP phones. It can allow supported devices and switches to exchange information related to device identity and network policy. This can help simplify voice deployments and assist with appropriate network configuration. NTP handles time synchronization, LACP manages link aggregation, and DHCP relay forwards DHCP requests between networks. LLDP-MED is therefore the most appropriate technology for exchanging enhanced discovery information with supported IP phones and similar endpoints.

Question 238

What is one reason to use a configuration template for a group of similar FortiSwitch interfaces?

1. To reduce repetitive manual configuration and improve consistency
2. To physically increase the number of switch ports
3. To replace the need for VLANs
4. To disable interface monitoring

Correct Answer: 1

Explanation:

Configuration templates can reduce repetitive administrative work by allowing common settings to be defined once and applied to multiple similar devices or interfaces where supported. This improves consistency and reduces the chance of human errors caused by repeatedly entering the same settings manually. Templates do not increase the physical number of switch ports or eliminate the need for VLANs. Administrators should still review device-specific requirements before applying a common template. Standardized configuration is particularly valuable in environments where many switches have similar roles and interface requirements.

Question 239

What is the purpose of reviewing switch logs after an unexpected interface shutdown?

1. To identify events that may explain the interface state change
2. To increase the interface’s physical speed
3. To create a new VLAN automatically
4. To change the Ethernet cable type

Correct Answer: 1

Explanation:

Switch logs can provide useful evidence about events surrounding an unexpected interface shutdown. Depending on the available logging information, administrators may identify link-state changes, configuration events, authentication problems, errors, or other system conditions. Reviewing the timing of these events can help determine whether the problem originated from the physical connection, configuration, endpoint, or another network condition. Logs do not physically increase interface speed, automatically create VLANs, or change cable types. They are primarily a diagnostic resource for understanding what occurred on the device.

Question 240

Which combination provides a strong foundation for protecting an access port from unauthorized network devices?

1. NTP and LLDP only
2. Port security and, where required, 802.1X authentication
3. LACP and PoE only
4. SNMP and NTP only

Correct Answer: 2

Explanation:

Port security and 802.1X can provide complementary controls for access-port protection. Port security can restrict devices based on MAC-address policies, while 802.1X can require identity-based authentication before network access is granted. In environments using 802.1X, RADIUS is commonly used as the backend authentication service. The exact combination should match the organization’s security requirements and supported FortiSwitch capabilities. NTP, LLDP, SNMP, LACP, and PoE provide important network functions but do not by themselves provide the same level of endpoint access control.