View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 321

What is the primary purpose of FortiSwitch device authorization in centralized management?

1. To increase the switch’s PoE capacity
2. To allow the management system to recognize and manage the switch
3. To disable VLAN configuration
4. To change the switch’s physical MAC address

Correct Answer: 2

Explanation:

Device authorization is an important step when bringing a FortiSwitch under centralized management. It confirms that the discovered switch is permitted to be managed by the management system. Once properly authorized and connected, administrators can manage configuration, monitor status, and perform supported operational tasks centrally. Authorization does not increase PoE capacity or modify the physical MAC address of the switch. It is primarily a management and security control that helps prevent unauthorized devices from being incorporated into the managed network environment.

Question 322

Which configuration is most appropriate for a link between two switches that must carry VLANs 10, 20, and 30?

1. Access VLAN 10 only
2. Trunk with VLANs 10, 20, and 30 permitted
3. Disabled interface
4. Access VLAN 30 only

Correct Answer: 2

Explanation:

A trunk interface is appropriate when multiple VLANs need to traverse a single physical link between switches. In this scenario, VLANs 10, 20, and 30 should be permitted on the trunk according to the network design. Both sides of the connection should have compatible trunk and VLAN configurations. Using an access interface would normally associate the connection with only one VLAN and would not provide the required multi-VLAN connectivity. Restricting the trunk to only the VLANs actually required is also a useful configuration practice.

Question 323

What is the purpose of configuring a native VLAN on a trunk?

1. To identify the VLAN associated with untagged traffic
2. To provide administrator authentication
3. To establish an LACP session
4. To prevent all broadcast traffic

Correct Answer: 1

Explanation:

The native VLAN is used to associate untagged traffic received on a trunk with a particular VLAN, according to the switch’s configuration. Trunk links normally carry tagged traffic for multiple VLANs, but the native VLAN provides a defined treatment for untagged frames. Administrators should configure native VLAN settings consistently on connected devices to avoid mismatches and unexpected traffic behavior. Native VLAN configuration is unrelated to administrator authentication, LACP negotiation, or general broadcast prevention.

Question 324

Which feature can help prevent a switch from accepting a superior BPDU that could alter the intended STP root topology?

1. Port mirroring
2. Root Guard
3. DHCP snooping
4. SNMP

Correct Answer: 2

Explanation:

Root Guard helps protect the intended STP hierarchy by preventing a protected interface from accepting superior BPDUs that could cause a downstream switch to influence root bridge selection. It is useful when administrators know that a particular network boundary should not become a path toward a new STP root. If an unexpected superior BPDU is received, the interface can enter a protective state. Port mirroring, DHCP snooping, and SNMP provide traffic-analysis, DHCP-security, and management functions respectively, rather than STP root protection.

Question 325

What is the main purpose of BPDU Filtering?

1. To suppress or filter STP BPDU transmission or processing under configured conditions
2. To provide centralized user authentication
3. To assign IP addresses to clients
4. To increase switch memory

Correct Answer: 1

Explanation:

BPDU Filtering is used to suppress or filter Bridge Protocol Data Units under specific configurations. It is generally associated with situations where administrators intentionally want to control BPDU exchange on an interface. Because filtering can prevent STP information from being exchanged, it must be configured carefully. Incorrect use can contribute to Layer 2 loop risks. BPDU Filtering should not be confused with BPDU Guard, which is primarily a protection mechanism that reacts when unexpected BPDUs are received on ports where they should not appear.

Question 326

Which feature can provide IP phone-specific network information through LLDP extensions?

1. DHCP snooping
2. LLDP-MED
3. LACP
4. STP

Correct Answer: 2

Explanation:

LLDP-MED extends LLDP capabilities for network endpoints such as IP phones. It can provide information such as voice VLAN and other network policy details to compatible devices. This can simplify deployment because the phone can learn network parameters from the switch rather than requiring every endpoint to be manually configured. LLDP-MED is particularly useful in environments where voice and data devices share switch infrastructure. DHCP snooping provides DHCP security, LACP aggregates links, and STP prevents Layer 2 loops.

Question 327

What is a likely symptom of an incorrect native VLAN configuration between two trunk endpoints?

1. Unexpected handling of untagged traffic or VLAN connectivity problems
2. Increased PoE power output
3. Automatic RADIUS authentication
4. Faster MAC address learning

Correct Answer: 1

Explanation:

A native VLAN mismatch can cause untagged traffic to be associated with different VLANs on the two sides of a trunk. This may result in connectivity problems, unexpected traffic placement, or security concerns. Administrators should compare the native VLAN configuration on both trunk endpoints and ensure that the design is consistent. Tagged VLAN traffic may continue working correctly, which can make the problem more difficult to identify. PoE, RADIUS, and MAC learning are not the primary causes of native VLAN mismatch behavior.

Question 328

What is the primary function of DHCP relay when clients and the DHCP server are on different IP subnets?

1. To forward DHCP requests between the client network and DHCP server
2. To block all DHCP messages
3. To provide STP loop prevention
4. To aggregate Ethernet links

Correct Answer: 1

Explanation:

DHCP relay enables DHCP communication across Layer 3 boundaries. DHCP clients typically send discovery messages as broadcasts, and routers do not normally forward such broadcasts between subnets. A DHCP relay receives the client’s request and forwards it toward the configured DHCP server. The server’s response can then be returned through the relay to the client. This allows organizations to use centralized DHCP servers for multiple VLANs or routed networks. DHCP relay should not be confused with DHCP snooping, which is primarily intended to protect against unauthorized DHCP behavior.

Question 329

Which security feature can use DHCP snooping information to help prevent IP address spoofing?

1. LLDP
2. IP Source Guard
3. LACP
4. NTP

Correct Answer: 2

Explanation:

IP Source Guard can use trusted IP-to-MAC binding information to restrict traffic from a device that attempts to use an unauthorized source IP address. DHCP snooping can create binding information containing details such as the assigned IP address, MAC address, VLAN, and interface. IP Source Guard can then use this information to determine whether traffic matches an expected binding. This combination provides protection against certain IP spoofing attacks at the Layer 2 access edge. LLDP, LACP, and NTP have unrelated purposes.

Question 330

Why is DHCP snooping often used together with Dynamic ARP Inspection?

1. DHCP snooping can provide binding information that DAI can use to validate ARP traffic
2. DAI automatically replaces all DHCP servers
3. DHCP snooping disables VLANs
4. Both features are required for LACP

Correct Answer: 1

Explanation:

DHCP snooping and Dynamic ARP Inspection can work together to improve Layer 2 security. DHCP snooping can build trusted IP-to-MAC binding information from legitimate DHCP transactions. DAI can then use those bindings to determine whether ARP packets contain valid IP and MAC information. This helps reduce the risk of ARP spoofing and certain man-in-the-middle attacks. Static bindings may be needed for devices that use manually configured addresses. These features serve complementary security roles rather than replacing DHCP, VLANs, or LACP.

Question 331

What should an administrator check when a FortiSwitch port repeatedly goes up and down?

1. Interface statistics, physical cabling, transceiver, and speed/duplex conditions
2. Only the device hostname
3. Only the NTP server
4. Only the RADIUS accounting interval

Correct Answer: 1

Explanation:

Repeated interface state changes, commonly called link flapping, can be caused by physical or interface-level problems. Administrators should inspect interface counters and logs and check the physical cable, connectors, transceiver, and connected device. Speed and duplex negotiation should also be verified. Replacing the cable or transceiver can help isolate a physical problem. If the issue persists, configuration and hardware compatibility should be investigated. NTP and RADIUS accounting do not normally cause a physical Ethernet interface to repeatedly transition between up and down states.

Question 332

Which feature can help prevent unauthorized devices from using a switch port based on their MAC addresses?

1. NTP
2. Port security
3. LLDP
4. DHCP relay

Correct Answer: 2

Explanation:

Port security can restrict which MAC addresses are permitted to use a particular switch interface. An administrator can configure authorized MAC addresses or limits on the number of addresses allowed, depending on the supported configuration. If an unauthorized device appears, the switch can take a configured protective action. Port security is useful at the access layer, although stronger identity-based authentication such as 802.1X may provide more robust control. NTP, LLDP, and DHCP relay do not perform MAC-based endpoint authorization.

Question 333

What is the purpose of SNMP traps in a FortiSwitch monitoring environment?

1. To send event notifications from the switch to an SNMP manager
2. To assign VLANs to clients
3. To negotiate link aggregation
4. To prevent ARP spoofing

Correct Answer: 1

Explanation:

SNMP traps allow a managed device to send notifications to an SNMP management system when specific events occur. This can provide faster awareness of conditions such as interface state changes or other configured events without waiting for the next polling interval. SNMP polling and traps can complement each other: polling retrieves information periodically, while traps provide event-driven notifications. SNMP traps do not perform VLAN assignment, LACP negotiation, or ARP inspection. They are primarily used to improve monitoring and event awareness.

Question 334

What is the main purpose of interface utilization monitoring?

1. To determine whether an interface is experiencing unusually high traffic levels
2. To configure RADIUS users
3. To change the STP root automatically
4. To provide DHCP addresses

Correct Answer: 1

Explanation:

Interface utilization monitoring helps administrators understand how much traffic is passing through a switch interface. High utilization may indicate congestion, unexpectedly heavy traffic, or a potential capacity problem. Monitoring historical utilization can also help with capacity planning and identifying unusual traffic patterns. Interface utilization should be considered alongside errors, drops, packet counts, and other statistics when troubleshooting. RADIUS, STP, and DHCP perform separate functions and do not directly provide the primary purpose of interface utilization monitoring.

Question 335

What can happen if a VLAN is allowed on one side of a trunk but not on the other side?

1. Devices in that VLAN may fail to communicate across the trunk
2. The switch automatically creates the VLAN on both sides
3. LACP is automatically enabled
4. The VLAN becomes the STP root

Correct Answer: 1

Explanation:

For a VLAN to successfully traverse a trunk, the VLAN must be properly configured and permitted across the relevant links. If the VLAN is allowed on one side but filtered or absent on the other, traffic for that VLAN may not cross the connection. This can cause partial connectivity where other VLANs continue to work normally. Troubleshooting should include checking VLAN existence, allowed VLAN lists, trunk mode, tagging, and native VLAN settings. VLAN configuration inconsistencies are common causes of inter-switch connectivity problems.

Question 336

Which feature can provide centralized visibility into FortiSwitch status and configuration?

1. Centralized FortiSwitch management
2. MAC aging
3. Native VLAN
4. Port security only

Correct Answer: 1

Explanation:

Centralized FortiSwitch management provides administrators with a common environment for viewing and managing multiple switches. Depending on the deployment, administrators can monitor device status, interfaces, connected devices, configuration, events, and other operational information. This approach reduces the need to access every switch separately and can improve configuration consistency. MAC aging, native VLAN settings, and port security are individual switching features and do not provide comprehensive centralized management visibility.

Question 337

What is a key reason to use configuration templates in a multi-switch deployment?

1. To ensure common settings are applied consistently
2. To prevent administrators from monitoring switches
3. To remove all device-specific configurations
4. To disable switch firmware updates

Correct Answer: 1

Explanation:

Configuration templates help administrators establish consistent settings across multiple FortiSwitch devices. They can reduce repetitive configuration work and lower the risk of manual errors or configuration drift. Templates are especially useful when multiple switches share similar roles, such as access switches in different locations. Device-specific requirements can still be handled where necessary. Templates do not prevent monitoring or remove the need for firmware updates. Instead, they support scalable and standardized network administration.

Question 338

What is the purpose of maintaining a configuration revision history?

1. To track previous configuration changes and assist with recovery or troubleshooting
2. To increase network bandwidth
3. To disable STP
4. To provide PoE to endpoints

Correct Answer: 1

Explanation:

Configuration revision history allows administrators to identify changes made over time and can help determine whether a recent modification caused a network problem. When a configuration change produces unexpected behavior, comparing revisions can make troubleshooting easier. A known-good revision may also provide a recovery option depending on the management system and supported rollback capabilities. Revision history is therefore an important operational control in environments where many administrators or devices are involved. It does not increase bandwidth, control PoE, or disable STP.

Question 339

Which action is most appropriate when replacing a failed FortiSwitch in a centrally managed deployment?

1. Ignore the management system and configure random settings
2. Verify the replacement device, management relationship, configuration requirements, and provisioning process
3. Disable all VLANs permanently
4. Remove all network security controls

Correct Answer: 2

Explanation:

When replacing a failed FortiSwitch, administrators should verify the replacement device and follow the organization’s centralized provisioning or onboarding process. The replacement should receive the appropriate configuration for its intended role, including VLANs, interfaces, security settings, and management connectivity. The administrator should also verify device authorization and compatibility with the existing management environment. Proper replacement procedures reduce downtime and prevent configuration inconsistencies. Simply connecting a replacement switch without validating its management relationship and configuration can introduce connectivity or security problems.

Question 340

Why should firmware compatibility be checked before upgrading a centrally managed FortiSwitch?

1. Because incompatible firmware can cause management or operational problems
2. Because firmware determines the physical length of Ethernet cables
3. Because firmware automatically assigns user passwords
4. Because firmware replaces VLAN segmentation

Correct Answer: 1

Explanation:

Firmware compatibility is important because a switch firmware version must work correctly with the switch hardware, management environment, and supported feature set. An incompatible or unsupported upgrade can cause operational problems, unexpected behavior, or loss of management functionality. Administrators should review supported upgrade paths, release information, compatibility requirements, and configuration backups before performing upgrades. Firmware does not determine cable length, automatically assign user passwords, or replace VLAN segmentation. Proper upgrade planning helps reduce the risk of service interruption and configuration problems.