Refer to the exhibit.The LLDP profile shown in the exhibit was configured to detect IP phones and automatically assign them to the appropriate VLAN. You apply this LLDP profile on a FortiSwitch port. Which configuration should you enable on the FortiSwitch profile to collect detailed information about all the connected IP phones? (Choose one answer)
Answer(s): C
According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, Link Layer Discovery Protocol-Media Endpoint Discovery (LLDP-MED) is an enhancement to standard LLDP that provides advanced discovery and configuration for endpoints li1ke IP phones. While the current configuration in the exhibit correctly handlesNetwork Policy TLVsto advertise QoS2and VLAN settings to the phones, it is missing the specific component required for data collection.34To coll5ect detail6ed information such as themanufacturer, software version, hardware version, and serial or asset numbers, you mustEnable LLDP-MED inventory management TLVs (Option C). The documentation specifies that when the inventory-management TLV is active, the switch can retrieve these extensive device characteristics from the connected Media Endpoints. This information is then visible to the administrator through the FortiGate or FortiSwitch monitoring tools, providing a complete hardware inventory of the voice network.Regarding the other options:Option Ais unnecessary because a single LLDP profile can support multiple TLV types simultaneously by adding them to the med-tlvs string.Option Bis already partially implemented in the exhibit's network policy but does not contribute to device detection or data collection.Option Dis used for automatic trunking between FortiSwitches and is unrelated to endpoint device information. Therefore, the addition of the inventory-management TLV is the specific requirement to fulfill the goal of collecting detailed IP phone data.
In which two ways can you assign a FortiSwitch port to a VDOM using a multi-tenancy setup? (Choose two answers)
Answer(s): A,B
According to theFortiOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, multi-tenancy in a FortiLink-managed environment allows a central FortiGate to partition a managed FortiSwitch fabric so that different ports can belong to different Virtual Domains (VDOMs). This is essential for Managed Service Providers (MSPs) who need to isolate client traffic at the hardware layer.The documentation identifies two primary methods for achieving this assignment:Assign to a VLAN and Perform VDOM Mapping (Option A):This is the most common method. The administrator creates a VLAN on the FortiLink interface and assigns it to a specific VDOM on the FortiGate. By assigning a physical FortiSwitch port to that specific VLAN, the port's traffic is logically terminated within the target VDOM. TheVDOM mappingensures that the switch-controller identifies which VDOM "owns" the traffic originating from that specific port/VLAN combination.Create a Virtual Port Pool (Option B):For more advanced multi-tenancy, administrators can use the FortiGate CLI to create aVirtual Port Pool. This feature allows the FortiGate to "pool" physical switch ports and present them as logical resources that can be distributed across various VDOMs. This method provides greater flexibility in resource allocation without requiring the entire FortiLink interface to be moved.Regarding the incorrect options:Option Cis incorrect because in a managed environment, the FortiSwitch CLI is not used for VDOM assignments; all orchestration must happen from the FortiGate.Option Dis incorrect because while you can move a FortiLink interface to a VDOM, this would move theentireswitch management and all its ports to that VDOM, which does not support a multi-tenant setup where different ports need to reside in different VDOMs.
Refer to the exhibits.All three FortiSwitch-connected ports are configured in VLAN 10. FortiGate acts as the Dynamic Host Configuration Protocol (DHCP) server and is connected to a DHCP snooping trusted trunk port. PC1 and PC2 are connected to ports configured as untrusted for Dynamic ARP Inspection (DAI), and no static bindings are configured in the IP source guard (IPSG) database. PC2 is compromised and attempts to spoof the FortiGate IP address by sending forged Address Resolution Protocol (ARP)replies with its own MAC address. What will FortiSwitch do with the ARP packets from PC2? (Choose one answer)
Answer(s): D
According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, Dynamic ARP Inspection (DAI) is a security feature used to intercept, log, and discard ARP packets with invalid IP-to-MAC address bindings. DAI is primarily used to prevent "Man-in-the-Middle" attacks, such as ARP spoofing or ARP cache poisoning.In this scenario, DAI is active on VLAN 10. When DAI is enabled, the FortiSwitch intercepts all ARP packets on untrusted ports and validates them against a trusted source--most commonly theDHCP snooping database. As shown in the "DHCP Snooping database" exhibit, PC2 is correctly mapped to IP 10.0.10.30 and MAC 00:09:0F:AB:00:0B.When PC2 attempts to send a forged ARP reply claiming that IP 10.0.10.254 (the FortiGate's IP) is located at its own MAC address (00:09:0F:AB:00:0B), the FortiSwitch's DAI engine inspects the packet. It checks the DHCP snooping database for a binding that matches IP 10.0.10.254 to MAC00:09:0F:AB:00:0B. Finding no such valid entry (because the database correctly identifies the MAC00:09:0F:AB:00:0B as belonging to IP 10.0.10.30), the switch identifies the ARP packet as illegitimate.Consequently, the FortiSwitch willdrop the ARP repliesbecause they fail the DAI validation check against the established DHCP snooping bindings. Option A is incorrect as DAI functions independently of IPSG once the database is populated. Option B is incorrect because "accepting" the spoofed packet is the opposite of DAI's purpose. Option C is incorrect because DAI is specifically designed to run on untrusted ports to protect the network from client-side attacks.
Refer to the exhibit.You just connected three FortiSwitch devices:Core-1,Core-2, andAccess-1. Core-1 and Core-2 both connect to Access-1 for redundancy. All switches are managed by FortiGate, which uses port4 as the FortiLink interface. After you enable the uplink ports on Core-2, you notice that port3 on Access-1 enters the Discarding STP state. What is the most likely cause of this behavior? (Choose one answer)
According to theFortiSwitchOS 7.6 Administration Guideand theFortiLink 7.6 Study Guide, the Spanning Tree Protocol (STP) is automatically enabled on managed FortiSwitches to ensure a loop- free Layer 2 topology within the FortiLink fabric. When multiple physical paths exist between switches (as shown in the redundant connections between the Core and Access tiers), STP must block one of the paths to prevent a broadcast storm.The behavior described in the exhibit--whereport3 on Access-1enters aDiscarding state--is a result of the STP election process. In a standard STP environment, switches elect aRoot Bridgebased on the lowestBridge Priority(or lowest MAC address as a tie-breaker). Once a root is established, other switches identify the "best" path to that root (the Root Port) and block all other redundant paths.The provided exhibit shows that Access-1 has two paths to the core: one to Core-1 and one to Core-2. The fact that the path to Core-2 is discarded suggests that the STP topology was recalculated when Core-2 was enabled. In the context of Fortinet technical exams for this specific scenario,Option C (Core-2 has the lowest bridge priority)is the standard answer identifying that Core-2's priority settings influenced the STP tree such that Access-1's link to it was determined to be the redundant (alternate) path.If the switches were configured withMCLAG (Multi-Chassis Link Aggregation), both physical links would be treated as a single logical trunk, and neither would be in a discarding state. However, without MCLAG, the system relies on bridge priorities to prune the loop.BPDU Guard (Option A)is incorrect because it would administratively shut down the port rather than placing it in an STP "Discarding" state.Option Bis incorrect as the switch would not appear in the managed topology if unauthorized.
Which three are valid actions that a FortiSwitch access control list (ACL) can apply to matching traffic? (Choose three answers)
Answer(s): C,D,E
According to theFortiSwitchOS 7.6 Administration Guideand theNSE 5 FortiSwitch 7.6 Administrator Study Guide, Access Control Lists (ACLs) are used to perform multiple actions on matching traffic as it passes through the switch pipeline. The documentation explicitly categorizes these valid actions into three distinct functional groups:Traffic processing,QoS (Quality of Service), andVLANmodifications.Traffic Processing (Option C):This is a primary category of ACL actions. It includes operations that dictate how a frame is physically handled or monitored. Valid specific actions under this category includedrop(discarding the packet),count(incrementing a packet counter for statistics),redirect(sending the packet to a specific interface or CPU queue), andmirror(copying the traffic to a monitor port).QoS (Option E):The QoS category allows the switch to manage traffic prioritization and bandwidth. ACLs can be configured toset the egress queue(assigning a frame to one of the eight priority queues),remark CoS (Class of Service)orDSCP (Differentiated Services Code Point)values in the frame header, and applypolicersfor rate limiting.VLAN / Set outer VLAN tags (Option D):Under the VLAN category, the most notable action is the ability toset outer VLAN tagson frames. This is particularly useful in scenarios involving Q-in-Q tunneling or service provider environments where a secondary tag is required for transport across a managed fabric.It is important to note thatAssign the VLAN ID (Option A)is typically a function ofNAC (Network Access Control)orDynamic VLAN Assignmentrather than a standard ACL action; within an ACL context, vlan-id is primarily used as aclassifier(to match traffic) rather than an action.Quarantine devices (Option B)is a high-level security response triggered by the FortiGate NAC engine and is not a direct action available within the FortiSwitch ACL configuration menu.
Post your Comments and Discuss Fortinet NSE5_FSW_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE5_FSW_AD-7.6 content, but please register or login to continue.