View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 341

Which feature allows an administrator to identify the capabilities and identity of a directly connected network device?

1. LLDP
2. RADIUS
3. DHCP snooping
4. NTP

Correct Answer: 1

Explanation:

LLDP is designed to allow network devices to exchange information with directly connected neighbors. Depending on the implementation, this information can include the device name, interface identification, capabilities, and other attributes. Administrators can use LLDP information to understand physical topology and troubleshoot incorrect connections. RADIUS is primarily used for authentication, DHCP snooping provides DHCP security, and NTP synchronizes system clocks. LLDP is therefore the appropriate feature when the goal is to discover and identify neighboring network devices.

Question 342

What is the primary benefit of using FortiSwitch templates in centralized management?

1. They eliminate the need for VLANs.
2. They provide consistent configuration across applicable switches.
3. They disable all switch security functions.
4. They automatically repair hardware failures.

Correct Answer: 2

Explanation:

Configuration templates help administrators apply standardized settings to multiple FortiSwitch devices. This improves consistency and reduces the amount of repetitive manual configuration required. Templates are particularly useful when multiple switches perform similar roles and require common VLAN, interface, security, or management settings. They do not eliminate VLANs, disable security functions, or repair hardware failures. Administrators should still review device-specific requirements before applying a template because not every setting will necessarily be appropriate for every switch.

Question 343

What should be verified when a FortiSwitch is successfully connected physically but cannot be managed centrally?

1. Only the PoE budget
2. Only the MAC aging timer
3. Management connectivity and authorization status
4. Only the interface description

Correct Answer: 3

Explanation:

A physical link being operational does not necessarily mean that centralized management communication is functioning. Administrators should verify management connectivity, FortiLink-related configuration where applicable, and whether the switch has been properly discovered and authorized. Device status in the centralized management interface can also provide useful information. PoE budget and MAC aging affect different aspects of switching and would not normally explain a management relationship failure. Checking connectivity and authorization is therefore an appropriate first step when a physically connected switch cannot be centrally managed.

Question 344

Which feature is useful for protecting an STP topology from unexpected superior BPDUs on a designated network boundary?

1. Root Guard
2. Port mirroring
3. SNMP
4. DHCP relay

Correct Answer: 1

Explanation:

Root Guard protects the intended STP hierarchy by preventing a connected downstream device from influencing root bridge selection through superior BPDUs. It is useful on interfaces where the administrator expects the local network to remain authoritative for the STP topology. When an unexpected superior BPDU is detected, the protected interface can enter an appropriate state rather than allowing the downstream switch to become a path toward a new root. Port mirroring, SNMP, and DHCP relay provide monitoring or network services and do not perform this STP protection function.

Question 345

What is the main purpose of configuring BPDU Guard on an edge interface?

1. To increase interface bandwidth
2. To provide DHCP addresses
3. To protect the STP topology from unexpected BPDUs
4. To establish a trunk automatically

Correct Answer: 3

Explanation:

BPDU Guard is commonly enabled on edge interfaces that are expected to connect to end devices rather than switches. If a BPDU arrives on such an interface, BPDU Guard can place the port into a protective state according to the configured behavior. This helps prevent an incorrectly connected switch from influencing the STP topology and potentially creating a Layer 2 loop. BPDU Guard is not intended to increase bandwidth, provide DHCP services, or automatically create trunks. It is specifically an STP protection mechanism.

Question 346

What does an LACP aggregated interface represent?

1. Multiple physical links operating together as one logical connection
2. A collection of unrelated VLANs
3. A DHCP server group
4. A collection of SNMP traps

Correct Answer: 1

Explanation:

LACP allows multiple compatible physical Ethernet links to operate as a logical aggregated connection. This provides redundancy and can increase the aggregate bandwidth available across the participating links. Traffic is distributed according to the device’s supported load-balancing mechanism. If one member link fails, the remaining links can continue carrying traffic when the configuration supports this behavior. LACP does not represent VLANs, DHCP servers, or SNMP events. Its primary purpose is dynamic link aggregation and improved connection resilience.

Question 347

What should an administrator check if one LACP member interface remains inactive?

1. Only the NTP server
2. Interface compatibility and LACP configuration on both ends
3. Only the DHCP lease duration
4. Only the switch hostname

Correct Answer: 2

Explanation:

If an LACP member does not become active, the administrator should compare the configuration of the participating interfaces on both devices. Important factors can include LACP mode, link status, speed, duplex, VLAN configuration, and other aggregation-related parameters. The physical connection should also be checked to ensure the interface is operational. A mismatch between member interfaces can prevent successful aggregation. NTP, DHCP lease duration, and the switch hostname do not normally determine whether a physical interface can participate in an LACP group.

Question 348

What is the main function of an access control list applied to a FortiSwitch interface or relevant traffic path?

1. To control traffic according to defined matching and action rules
2. To synchronize switch clocks
3. To provide PoE power
4. To discover neighboring switches

Correct Answer: 1

Explanation:

An access control list, or ACL, can be used to control network traffic according to defined criteria and actions. Depending on the supported FortiSwitch functionality and configuration, rules can identify traffic based on characteristics such as addresses, protocols, or other parameters and then permit or deny it. ACLs provide an additional layer of traffic control within the network. NTP handles time synchronization, PoE provides electrical power, and LLDP performs neighbor discovery. ACL configuration should be carefully planned because incorrect rules can unintentionally block legitimate traffic.

Question 349

Why is it useful to restrict a trunk to only the VLANs that are actually required?

1. To increase the number of broadcast domains automatically
2. To reduce unnecessary VLAN propagation and improve segmentation
3. To disable STP
4. To prevent MAC learning

Correct Answer: 2

Explanation:

Restricting a trunk to only the VLANs that are required reduces unnecessary VLAN propagation across the network. This can improve segmentation, simplify troubleshooting, and reduce the potential impact of configuration errors. If every VLAN is permitted across every trunk, devices may have broader Layer 2 reachability than necessary. Administrators should therefore define allowed VLANs based on the actual requirements of the connected devices. Restricting VLANs does not disable STP or prevent MAC learning; those functions continue independently.

Question 350

What is a likely symptom of a VLAN being incorrectly assigned to a workstation access port?

1. The workstation may receive an IP address from an unintended subnet
2. The switch automatically increases PoE power
3. The workstation becomes an STP root bridge
4. The switch stops learning all MAC addresses

Correct Answer: 1

Explanation:

If a workstation access port is assigned to the wrong VLAN, the workstation may be placed into an unintended network segment. As a result, it could receive an IP address from a different DHCP scope or fail to reach the resources expected for its correct VLAN. Troubleshooting should include checking the interface’s access VLAN, VLAN existence, DHCP scope, and upstream connectivity. Incorrect VLAN assignment does not normally affect PoE power or make the workstation an STP root bridge.

Question 351

Which protocol is commonly used with 802.1X to provide centralized authentication?

1. SNMP
2. RADIUS
3. LLDP
4. NTP

Correct Answer: 2

Explanation:

RADIUS is commonly used as the centralized authentication server protocol in 802.1X deployments. The switch acts as an authenticator and communicates with the RADIUS server to validate the endpoint’s authentication information. Based on the authentication and authorization result, the network can permit access and potentially apply additional access policies. SNMP is primarily used for monitoring, LLDP for neighbor discovery, and NTP for time synchronization. RADIUS therefore provides the appropriate centralized authentication function for an 802.1X environment.

Question 352

What is one important advantage of using 802.1X instead of relying only on MAC address filtering?

1. 802.1X can provide stronger identity-based authentication
2. 802.1X removes the need for switches
3. 802.1X automatically prevents every Layer 2 loop
4. 802.1X increases physical cable bandwidth

Correct Answer: 1

Explanation:

802.1X can provide stronger access control because it authenticates an endpoint or user through an authentication framework rather than relying only on a device’s MAC address. MAC addresses can potentially be spoofed, so MAC-based controls alone may not provide strong identity assurance. With 802.1X, the switch can communicate with a RADIUS server and enforce authorization policies after successful authentication. 802.1X does not prevent Layer 2 loops or increase physical link capacity. Its primary benefit is stronger identity-based network access control.

Question 353

What is the purpose of a management VLAN?

1. To carry administrative traffic for managing network devices
2. To replace every access VLAN
3. To disable switch logging
4. To provide LACP negotiation

Correct Answer: 1

Explanation:

A management VLAN is commonly used to separate administrative traffic from ordinary user or application traffic. Network devices can use this VLAN for management connectivity, depending on the network design. Separating management traffic can make it easier to apply access restrictions and security controls to administrative services. A management VLAN does not replace all other VLANs or provide LACP negotiation. Administrators should also protect management access through appropriate authentication, secure protocols, and network restrictions.

Question 354

What should be checked if an administrator cannot reach the FortiSwitch management interface from an authorized management workstation?

1. Management IP addressing, routing, interface status, and access restrictions
2. Only the MAC aging timer
3. Only the PoE budget
4. Only the STP root priority

Correct Answer: 1

Explanation:

When management access fails, administrators should verify the switch’s management IP address, subnet configuration, interface status, and routing path between the workstation and the switch. Management access restrictions such as trusted hosts or allowed management networks should also be reviewed. If the device is centrally managed, its management relationship should be checked as well. MAC aging, PoE budget, and STP root priority do not normally determine whether an authorized workstation can reach a management interface. A structured Layer 2 and Layer 3 connectivity check is appropriate.

Question 355

Which feature can help detect a rogue DHCP server connected to an access port?

1. LACP
2. DHCP snooping
3. LLDP-MED
4. Root Guard

Correct Answer: 2

Explanation:

DHCP snooping can distinguish trusted interfaces from untrusted interfaces and help prevent unauthorized DHCP server responses from reaching clients. Legitimate DHCP server traffic is expected to arrive through trusted interfaces, while client-facing access ports are generally untrusted. If a rogue device attempts to respond as a DHCP server from an untrusted interface, the switch can restrict the response according to the configured policy. This protects clients from receiving incorrect network configuration. LACP, LLDP-MED, and Root Guard address different network functions.

Question 356

What is the primary benefit of using PoE on a FortiSwitch?

1. It allows compatible devices to receive electrical power through Ethernet cabling
2. It eliminates the need for VLANs
3. It prevents all broadcast storms
4. It replaces RADIUS authentication

Correct Answer: 1

Explanation:

Power over Ethernet, or PoE, allows compatible devices to receive electrical power through Ethernet cabling rather than requiring a separate power connection. This is particularly useful for devices such as IP phones, wireless access points, and certain cameras. The switch must have sufficient PoE capacity and the port must support the required power characteristics. PoE does not replace VLAN segmentation, broadcast protection, or authentication. Administrators should monitor the overall power budget when deploying multiple PoE devices.

Question 357

What can happen if a FortiSwitch exceeds its available PoE power budget?

1. Additional PoE devices may fail to receive the required power
2. The switch automatically creates a new VLAN
3. STP is permanently disabled
4. RADIUS authentication is automatically removed

Correct Answer: 1

Explanation:

A FortiSwitch has a defined total PoE power budget. If the power requirements of connected devices exceed that available budget, the switch may be unable to provide power to additional devices or may take other configured actions. Administrators should therefore monitor PoE consumption and available capacity when adding powered endpoints. The exact behavior depends on the hardware and configuration. Exceeding the PoE budget does not create VLANs, disable STP, or remove RADIUS configuration.

Question 358

What is the purpose of MAC address learning in Ethernet switching?

1. To associate source MAC addresses with the interfaces where they were observed
2. To assign IP addresses to clients
3. To authenticate administrators
4. To synchronize system clocks

Correct Answer: 1

Explanation:

MAC address learning allows a switch to build its forwarding table by examining the source MAC address of incoming Ethernet frames. The switch associates the source MAC address with the receiving interface and VLAN context. Later, when a frame is destined for that MAC address, the switch can forward it toward the learned interface rather than flooding it throughout the VLAN. This improves switching efficiency. MAC learning is a Layer 2 function and does not assign IP addresses, authenticate administrators, or synchronize clocks.

Question 359

Which feature is most useful for investigating the actual packets exchanged on a switch interface?

1. Port mirroring
2. NTP
3. RADIUS accounting
4. MAC aging

Correct Answer: 1

Explanation:

Port mirroring can copy selected traffic from one or more source interfaces to a designated monitoring interface. A packet analyzer or security monitoring device connected to the destination can then inspect the copied packets. This is useful when troubleshooting application behavior, protocol problems, unexpected traffic, or security events. Port mirroring should be configured carefully because a large amount of mirrored traffic can exceed the capacity of the destination interface. NTP, RADIUS accounting, and MAC aging provide different types of network functionality.

Question 360

What is a recommended practice before deploying a major FortiSwitch configuration change to production?

1. Apply it everywhere immediately without testing
2. Remove all existing backups
3. Validate the configuration, test where practical, and maintain a recovery option
4. Disable logging before the change

Correct Answer: 3

Explanation:

Major configuration changes should be planned and validated before being applied broadly to production switches. Where practical, administrators should test the configuration in a controlled environment or on a limited number of devices first. Existing configuration backups or known-good revisions should be retained so the environment can be recovered if unexpected behavior occurs. Administrators should also document the change and monitor the network afterward. Disabling logging or removing backups would reduce visibility and increase operational risk rather than improving the change process.