View Full Fortinet NSE5_FSW_AD-7.6 Exam Dumps and Practice Test Dumps.

 

Question 101

Which feature allows an administrator to apply authentication before granting a device access to a FortiSwitch port?

1. SNMP
2. 802.1X
3. NTP
4. LLDP

Correct Answer: 2

Explanation:

802.1X provides port-based network access control by requiring an endpoint to authenticate before normal network access is permitted. In a typical FortiSwitch deployment, the switch acts as the authenticator while the endpoint acts as the supplicant. A RADIUS server can perform the actual authentication and return the authorization result. This approach allows administrators to control network access based on authenticated users or devices rather than simply trusting any device connected to a physical port. SNMP is used for monitoring, NTP for time synchronization, and LLDP for neighbor discovery, so 802.1X is the correct choice for authenticated port access.

Question 102

What is the main purpose of a FortiSwitch trunk interface?

1. To connect a single untagged workstation
2. To provide switch power
3. To transport traffic belonging to multiple VLANs
4. To perform RADIUS authentication

Correct Answer: 3

Explanation:

A trunk interface is designed to carry traffic belonging to multiple VLANs over a single physical connection. VLAN tags allow the receiving device to determine which VLAN each frame belongs to. Trunks are commonly used between switches or between a switch and another network device that needs access to several VLANs. A normal workstation connected to a single VLAN would typically use an access port instead. PoE provides electrical power, while RADIUS is associated with authentication. Proper trunk configuration should include the VLANs that are actually required and should maintain compatible settings at both ends of the connection.

Question 103

Which protocol can help a FortiSwitch learn information about directly connected neighboring devices?

1. RADIUS
2. NTP
3. LLDP
4. LACP

Correct Answer: 3

Explanation:

LLDP, or Link Layer Discovery Protocol, allows network devices to exchange information with directly connected neighbors. Administrators can use LLDP information to identify neighboring devices, interfaces, device capabilities, and aspects of the physical topology. This is particularly helpful in environments with many switches, access points, IP phones, and other infrastructure devices. RADIUS is generally used for centralized authentication, NTP synchronizes system time, and LACP manages link aggregation. LLDP therefore provides the most relevant functionality when the goal is to discover and identify neighboring network devices connected to FortiSwitch interfaces.

Question 104

What is one important security benefit of separating users into different VLANs?

1. It provides logical network segmentation
2. It automatically encrypts all traffic
3. It eliminates the need for IP addresses
4. It prevents every type of network attack

Correct Answer: 1

Explanation:

VLANs provide logical segmentation by separating groups of devices into different Layer 2 broadcast domains. For example, employee, guest, voice, and management devices can be placed into different VLANs. This separation can make it easier to apply different security and routing policies to each group. VLANs do not automatically encrypt traffic or eliminate IP addressing, and they cannot prevent every type of network attack by themselves. However, VLAN segmentation is an important foundation for network security because communication between different VLANs normally requires Layer 3 routing, where additional security controls can be applied.

Question 105

Which FortiSwitch feature can help protect against a rogue device attempting to act as a DHCP server?

1. LACP
2. DHCP snooping
3. NTP
4. LLDP

Correct Answer: 2

Explanation:

DHCP snooping is designed to help protect clients from unauthorized DHCP server responses. Administrators can define trusted interfaces where legitimate DHCP server traffic is expected and treat other interfaces as untrusted. If a device connected to an untrusted port attempts to send DHCP server responses, the switch can take the configured protective action. This helps prevent rogue DHCP servers from distributing incorrect network settings such as malicious gateways or DNS servers. LACP handles link aggregation, NTP synchronizes clocks, and LLDP provides neighbor discovery. DHCP snooping is therefore the appropriate security feature for controlling unauthorized DHCP server behavior.

Question 106

What information is primarily stored in a FortiSwitch MAC address table?

1. User passwords
2. DNS server records
3. Learned MAC addresses and associated interfaces
4. NTP authentication keys

Correct Answer: 3

Explanation:

A MAC address table contains Layer 2 forwarding information learned by the switch. It associates learned MAC addresses with the interfaces and VLAN contexts where those addresses were observed. When a frame arrives at the switch, this information helps the switch determine where to forward the frame when the destination MAC address is known. If the destination is unknown, the switch can use normal unknown-unicast behavior until it learns the destination location. User passwords, DNS records, and NTP authentication information are not the primary contents of the MAC address table. Administrators can use this table for troubleshooting and endpoint-location tasks.

Question 107

Which feature can help protect against IP address spoofing on a FortiSwitch access port?

1. IP source guard
2. Port mirroring
3. LACP
4. LLDP

Correct Answer: 1

Explanation:

IP source guard helps restrict traffic based on expected IP and MAC address bindings. It can prevent a connected endpoint from sending traffic using an unauthorized source IP address. This can reduce certain spoofing attacks where a malicious device attempts to impersonate another host by using its IP address. IP source guard can work with trusted binding information learned through mechanisms such as DHCP snooping, depending on the network design and configuration. Port mirroring is intended for traffic analysis, LACP provides link aggregation, and LLDP provides neighbor information. Therefore, IP source guard is the most relevant feature for source-IP validation.

Question 108

Why is accurate time synchronization important on FortiSwitch devices?

1. It increases Ethernet cable speed
2. It helps ensure reliable timestamps in logs and events
3. It replaces VLAN configuration
4. It automatically authenticates users

Correct Answer: 2

Explanation:

Accurate system time is important because network logs and security events rely on timestamps. When multiple FortiSwitch devices use synchronized clocks, administrators can more easily correlate events occurring across the network. This is especially useful during troubleshooting, incident investigation, and authentication analysis. NTP is commonly used to provide this synchronization. Accurate time does not increase physical Ethernet speed, replace VLAN configuration, or automatically authenticate users. Consistent timestamps make operational data more useful because administrators can determine the correct sequence of events and compare records from multiple devices with greater confidence.

Question 109

Which feature is designed to combine multiple physical Ethernet links into one logical connection?

1. DHCP snooping
2. LACP
3. DAI
4. SNMP

Correct Answer: 2

Explanation:

LACP, or Link Aggregation Control Protocol, allows multiple physical Ethernet interfaces to operate together as a logical aggregated connection. This can provide greater aggregate bandwidth and redundancy. If one physical member link fails, remaining links can continue carrying traffic, depending on the configuration. DHCP snooping is designed to protect DHCP operations, Dynamic ARP Inspection validates ARP traffic, and SNMP is used for monitoring and management. LACP is therefore the correct technology when an administrator wants to combine multiple physical interfaces into a logical link between compatible network devices.

Question 110

What is the primary purpose of Dynamic ARP Inspection (DAI)?

1. To provide PoE
2. To validate ARP traffic
3. To synchronize time
4. To aggregate links

Correct Answer: 2

Explanation:

Dynamic ARP Inspection helps protect Layer 2 networks from forged ARP information. It examines ARP messages and can compare their claimed IP-to-MAC relationships against trusted binding information. This helps reduce the risk of ARP spoofing, where an attacker attempts to associate its MAC address with another host’s IP address. DAI is often used together with DHCP snooping or other trusted binding mechanisms. PoE provides electrical power, NTP handles time synchronization, and LACP provides link aggregation. Therefore, DAI is specifically associated with inspecting and validating ARP traffic for improved Layer 2 security.

Question 111

Which feature can be used to send a copy of traffic from one FortiSwitch port to another interface for analysis?

1. RADIUS
2. Port mirroring
3. NTP
4. STP

Correct Answer: 2

Explanation:

Port mirroring allows selected traffic from a source interface or VLAN to be copied to a designated monitoring interface. An administrator can connect a packet analyzer or monitoring appliance to the destination interface and inspect the copied traffic. This can help with troubleshooting, security investigations, protocol analysis, and application diagnostics. Port mirroring does not normally replace the original forwarding behavior; it creates a copy for monitoring purposes. RADIUS provides authentication, NTP synchronizes clocks, and STP prevents Layer 2 loops. Therefore, port mirroring is the appropriate feature for copying switch traffic to a monitoring interface.

Question 112

Which configuration is most appropriate for an ordinary employee workstation that should access only VLAN 50?

1. Trunk port allowing all VLANs
2. Access port assigned to VLAN 50
3. LACP port with no VLAN
4. Mirror destination port

Correct Answer: 2

Explanation:

An ordinary workstation that belongs to a single VLAN would normally be connected through an access port assigned to that VLAN. In this example, the interface would be configured as an access port for VLAN 50, and the workstation would normally send untagged Ethernet traffic. A trunk is intended to carry multiple VLANs, while LACP is used to combine physical links and a mirror destination is intended for traffic monitoring. Assigning the port to the correct access VLAN provides clear Layer 2 segmentation and ensures the workstation is placed into the intended network.

Question 113

What is a potential consequence of allowing unnecessary VLANs across a trunk?

1. Unnecessary Layer 2 traffic may traverse the link
2. The switch automatically disables PoE
3. RADIUS authentication stops working
4. NTP changes the VLAN IDs

Correct Answer: 1

Explanation:

Allowing unnecessary VLANs on a trunk can cause traffic from those VLANs to traverse a link even when the receiving network segment does not require it. This can increase unnecessary Layer 2 traffic and make network segmentation more difficult to manage. A good practice is to allow only the VLANs that are actually required by the network design. Unnecessary VLAN propagation can also increase the potential impact of configuration mistakes. PoE, RADIUS, and NTP are unrelated to controlling which VLANs are permitted across a trunk. Maintaining a carefully defined allowed-VLAN list provides better control over trunk traffic.

Question 114

Which protocol is commonly used by an 802.1X-enabled FortiSwitch to communicate with a centralized authentication server?

1. SNMP
2. NTP
3. RADIUS
4. LLDP

Correct Answer: 3

Explanation:

RADIUS is commonly used as the centralized authentication protocol in 802.1X deployments. The FortiSwitch acts as the authenticator and communicates with the RADIUS server to validate authentication information from the endpoint. Based on the response from the authentication server, the switch can authorize or restrict access to the port. RADIUS may also provide authorization-related attributes depending on the deployment. SNMP is primarily used for monitoring, NTP synchronizes time, and LLDP provides neighbor discovery. Therefore, RADIUS is the appropriate protocol for centralized authentication in an 802.1X environment.

Question 115

Which feature can help prevent a Layer 2 switching loop when redundant links exist between FortiSwitch devices?

1. STP
2. SNMP
3. RADIUS
4. NTP

Correct Answer: 1

Explanation:

Spanning Tree Protocol is designed to prevent Layer 2 loops in networks with redundant switching paths. STP calculates a loop-free logical topology and can place redundant paths into a non-forwarding state while retaining them as potential alternatives. Without loop prevention, Ethernet frames can circulate through redundant paths, causing broadcast storms, excessive traffic, and potentially widespread network disruption. SNMP provides monitoring, RADIUS provides authentication, and NTP synchronizes clocks. STP is therefore the appropriate technology when redundant Layer 2 connections need to be deployed without creating a switching loop.

Question 116

What is one advantage of using PoE with FortiSwitch-compatible devices?

1. Devices can receive power through their Ethernet connection
2. It automatically encrypts all network traffic
3. It replaces VLAN tagging
4. It performs RADIUS authentication

Correct Answer: 1

Explanation:

Power over Ethernet allows supported devices to receive electrical power through their Ethernet connection. This can simplify deployment of IP phones, wireless access points, cameras, and other compatible devices because a separate power adapter may not be required at the endpoint. PoE availability depends on the capabilities and power budget of the specific FortiSwitch model. PoE does not encrypt traffic, replace VLAN tagging, or perform authentication. Those functions belong to other technologies and security mechanisms. Using PoE can reduce cabling complexity and make it easier to deploy network devices in locations where dedicated electrical outlets may be inconvenient.

Question 117

Which feature can help limit the number of devices that can connect to a particular FortiSwitch access port?

1. NTP
2. Port security
3. LLDP
4. SNMP

Correct Answer: 2

Explanation:

Port security can be used to restrict the number or identity of MAC addresses permitted on a switch interface. For example, an administrator may configure an access port to allow only a limited number of learned MAC addresses. This can help reduce the risk of unauthorized devices being connected to the port. The exact behavior depends on the configured security policy and supported FortiSwitch functionality. NTP is used for time synchronization, LLDP provides neighbor discovery, and SNMP provides monitoring information. Therefore, port security is the appropriate feature for controlling endpoint MAC-address usage on an access port.

Question 118

What is the primary purpose of centralized FortiSwitch monitoring?

1. To provide visibility into switch health, interfaces, and network events
2. To eliminate the need for physical cabling
3. To disable all Layer 2 protocols
4. To prevent every possible network failure

Correct Answer: 1

Explanation:

Centralized monitoring provides administrators with visibility into the operational state of FortiSwitch devices. Depending on the management solution and configuration, administrators can review interface status, device health, topology information, traffic statistics, logs, and other events. This visibility can help identify connectivity problems and abnormal network behavior more quickly. Centralized monitoring does not eliminate physical cabling, disable Layer 2 protocols, or guarantee that every network failure will be prevented. Its main purpose is to make operational information easier to access and analyze, particularly when an organization manages multiple switches across a larger network.

Question 119

Which technology is most appropriate for discovering a directly connected FortiSwitch neighbor and learning topology information?

1. RADIUS
2. DHCP snooping
3. LLDP
4. PoE

Correct Answer: 3

Explanation:

LLDP provides a standardized method for network devices to advertise information to directly connected neighbors. The information exchanged can help administrators identify connected devices, interfaces, device capabilities, and physical topology relationships. This makes LLDP particularly useful for documenting and troubleshooting switching infrastructure. RADIUS is commonly used for authentication, DHCP snooping protects DHCP operations, and PoE provides electrical power. LLDP therefore provides the most direct mechanism for discovering neighboring devices and gathering topology information from directly connected network equipment.

Question 120

Which combination is most appropriate for protecting a FortiSwitch access network against rogue DHCP servers and ARP spoofing?

1. LACP and LLDP
2. DHCP snooping and Dynamic ARP Inspection
3. NTP and SNMP
4. PoE and STP

Correct Answer: 2

Explanation:

DHCP snooping and Dynamic ARP Inspection can work together to improve Layer 2 security. DHCP snooping helps identify legitimate DHCP traffic and can maintain trusted IP-to-MAC bindings. Dynamic ARP Inspection can use trusted binding information to validate ARP messages and help block forged ARP traffic. Together, these mechanisms can reduce risks associated with rogue DHCP servers and ARP spoofing. LACP and LLDP address link aggregation and neighbor discovery, NTP and SNMP provide time synchronization and monitoring, while PoE and STP address power delivery and loop prevention. Therefore, DHCP snooping with DAI is the strongest combination for the stated security objectives.