Free NSE5_FSW_AD-7.6 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

Tail-drop is a queue management algorithm used for congestion avoidance. When an egress port's queue buffer becomes full (congested), the FortiSwitch will discard any new incoming packets destined for that queue. This process of dropping all subsequent packets continues until packets are transmitted from the queue, freeing up buffer space. This behavior directly matches the scenario described in the question, where incoming packets are dropped until congestion on the egress port is relieved.

B. Weighted round robin mode: This is a packet scheduling algorithm that allocates egress port bandwidth among different traffic queues based on configured weights, not a policy for dropping packets during congestion.

C. Random early detection mode: This is a proactive congestion avoidance mechanism that starts dropping packets probabilistically before a queue becomes completely full, aiming to prevent total congestion. It does not wait for the queue to be full.

D. Strict mode: This is a priority-based packet scheduling algorithm that services the highest-priority queue exclusively until it is empty before servicing any lower-priority queues. It is not a drop policy.

1. Fortinet FortiSwitchOS 7.4.0 Administration Guide, Page 138, "Configuring QoS".

The guide describes the two available drop policy modes. For Tail-drop mode, it states: "When the queue is full, the incoming packet is dropped. This is the default mode." This confirms the behavior described in the question.

2. Fortinet FortiSwitchOS 7.4.0 CLI Reference, Page 378, config switch qos drop-policy.

This section details the CLI commands for QoS drop policies. It lists the two available modes for set mode: taildrop and red. The description for taildrop implicitly defines its function as dropping packets when the queue limit is reached.

3. Fortinet FortiSwitchOS 7.4.0 Administration Guide, Page 138, "Configuring QoS".

The guide distinguishes between drop policies and queue (scheduling) policies. It describes "Strict mode" and "Weighted round-robin mode" under the config switch qos queue-policy section, confirming they are for scheduling egress traffic, not for dropping packets due to congestion.

A FortiSwitch Access Control List (ACL) can process traffic that matches its rules in several ways. Two fundamental actions are dropping the traffic and redirecting it. The deny action explicitly instructs the FortiSwitch to discard the matching frames, preventing them from being forwarded. The mirror action sends a copy of the matching frames to a specified port, which is a form of redirection used for traffic analysis or monitoring. Both deny (drop) and mirror (redirect) are configurable actions directly within a FortiSwitch ingress ACL entry.

B. Assign traffic to a high-priority egress queue. This is a Quality of Service (QoS) function. While an ACL is used to classify traffic for a QoS policy, the ACL action itself is permit; the queue assignment is configured separately in the QoS policy that references the ACL.

C. Encrypt frames. Frame encryption is handled by specific security protocols like MACsec, which is configured on a per-port basis and is not a direct action available within a standard FortiSwitch ACL rule.

1. FortiSwitchOS 7.6.0 Administration Guide, Page 111, "Configuring an IPv4 ACL".

The guide details the CLI commands for configuring an ingress ACL. Under the config entries section for an ACL, the set action command is shown with the available parameters: set action {deny | permit | mirror}.

deny corresponds to option D (Drop frames).

mirror corresponds to option A (Redirect frames to another port, specifically for monitoring purposes).

2. FortiSwitch 7.6.0 Security Guide, Page 21, "Access control lists".

This document also confirms the available actions for ingress ACLs: "The following actions are available for ingress ACLs: permit, deny, mirror." This reinforces that dropping (deny) and redirecting/copying (mirror) are valid actions, while queue assignment and encryption are not direct ACL actions.

When untagged traffic arrives at FortiSwitch port1, the switch determines VLAN assignment based on configured policies. PC1's MAC address is explicitly configured as a member of VLAN 10 via MAC-based VLAN assignment, which overrides the port's native VLAN. Consequently, PC1's traffic is assigned to VLAN 10. PC2 lacks a specific MAC-based policy; thus, its untagged traffic defaults to port1's Native VLAN, which is VLAN 20. Upon egressing port2 towards the FortiGate, the traffic must be forwarded. Port2 is configured with Allowed VLANs 10 and 20, but neither is configured as an Untagged VLAN or the Native VLAN (4094) for that port. Therefore, FortiSwitch applies an 802.1Q tag corresponding to the assigned VLAN for each frame: VLAN 10 for PC1 and VLAN 20 for PC2.

A. Incorrect because MAC-based VLAN assignment intercepts PC1's traffic and places it into VLAN 10, preventing it from defaulting to the Native VLAN 20 alongside PC2.

B. Incorrect because PC2's MAC address is not mapped to VLAN 10; MAC-based overrides apply strictly to the specific MAC addresses defined in the policy.

D. Incorrect because egress port2 does not have VLAN 10 listed under Untagged VLANs, nor is it the native VLAN, so PC1 traffic must be tagged upon egress.

Fortinet, Inc. "FortiSwitchOS 7.2.0 Administration Guide." MAC-based VLANs, Document Identifier: 01-720-781523-20220804, pp. 154-156. (Details how MAC-to-VLAN binding supersedes standard port-based Native VLAN assignment for ingress traffic).

Fortinet, Inc. "FortiSwitchOS 7.2.0 Administration Guide." VLANs and port configuration, Document Identifier: 01-720-781523-20220804, pp. 148-151. (Specifies that egressing traffic on allowed VLANs receives an 802.1Q tag unless specifically defined in the port's untagged-vlans list or matched to the native VLAN).

A Routed VLAN Interface (RVI) is created on a FortiSwitch when a physical port or a trunk is configured with an IP address, effectively converting it into a Layer 3 interface. During this process, FortiSwitch OS automatically assigns the interface to an internal, reserved VLAN, which is VLAN 4095. This dedicated VLAN is used internally by the switch to handle the Layer 3 routing functions for that specific port or trunk. The port is no longer a simple Layer 2 port and can participate in IP routing.

A. VLAN 1 is the default native VLAN for trunks, not a management VLAN automatically assigned when creating a specific Layer 3 routed port.

C. An RVI makes the port a Layer 3 interface. While it can be configured on a trunk, this statement incorrectly describes the primary function and effect of creating an RVI.

D. The port does become a Layer 3 interface, but the internal VLAN assigned for routing purposes is VLAN 4095, not VLAN 1.

1. Fortinet. (2024). FortiSwitch OS 7.6.0 Administration Guide. Fortinet Document Library. Page 129.

In the "Layer 3 > Routed VLAN interface" section, it states: "A routed VLAN interface (RVI) is a layer-3 interface that is automatically assigned to VLAN 4095. You can assign an IP address to an RVI and enable it for routing... When you configure an IP address on a physical port, the port becomes an RVI." This directly confirms that the port becomes a Layer 3 interface and is assigned to VLAN 4095.

A primary application of a quarantine VLAN is to isolate devices that fail security checks, such as 802.1X authentication. When a device attempts to connect to a port configured with an 802.1X policy and fails the Extensible Authentication Protocol (EAP) exchange, the FortiSwitch can be configured to dynamically move that port to a pre-defined quarantine VLAN. This action effectively isolates the non-compliant device from the production network while allowing it limited access, typically to remediation services hosted on the FortiGate. This is a fundamental feature of Fortinet's Network Access Control (NAC) solution.

A. A quarantine VLAN is typically configured on the FortiGate with a DHCP server to assign an IP address for remediation portal access.

C. Using a quarantine VLAN is an action configured within a specific NAC or 802.1X policy; it is not exclusively dependent on a single global setting.

D. The quarantine VLAN must be explicitly added to the allowed-vlans list on the FortiLink trunk to permit traffic between the quarantined device and the FortiGate.

1. FortiOS 7.6.0 Handbook, FortiSwitch Manager, "Configuring 802.1X security policies" section: This section details the configuration of 802.1X policies, including the action to take upon authentication failure. It states, "If you enable set eap-fail-vlan enable, you can select a VLAN to assign to clients that fail EAP authentication." This directly supports the correct answer (B).

2. FortiSwitch 7.6.0 CLI Reference, config switch-controller security-policy 802-1X command: The documentation for this command includes the set eap-fail-vlan {enable | disable} and set eap-fail-vlan-id parameters. These options explicitly provide the functionality to assign a specific VLAN when 802.1X authentication fails, confirming the mechanism described in answer B.

3. FortiOS 7.6.0 Handbook, FortiSwitch Manager, "Configuring NAC policies" section: When describing the "Quarantine" action for a NAC policy, the guide explains that the device can be assigned to a specific VLAN. It also shows that for this to work, a VLAN interface with a DHCP server must be configured on the FortiGate and the VLAN must be allowed on the FortiLink trunk, which refutes options A and D.

The debug output captures the FortiLink protocol (FLP) state transitions and keepalive mechanisms between FortiSwitch and FortiGate. The transition from FL_STATE_WAIT_JOIN to FL_STATE_READY demonstrates that the switch has been successfully discovered and authorized by the FortiGate, rendering it fully operational. Once authorized and in the READY state, the switch begins sending keepalive messages. The flp_send_pkt log entries showing type(5) packets transmitted exactly three seconds apart (at 12:13:21 and 12:13:24) represent FortiLink heartbeats. These heartbeats are standard functionality, sent from the managed FortiSwitch to the FortiGate controller to maintain the connection status and confirm ongoing availability.

C. The switch is no longer waiting; it successfully transitioned from FL_STATE_WAIT_JOIN to FL_STATE_READY, confirming it has already joined the stack group and is fully authorized.

D. The output displays state transitions and heartbeat (Type 5) packet transmissions; it contains no logs or protocol events related to hostname configuration or pushing hostname updates.

Fortinet, "NSE 6 - FortiSwitch 7.2 Administrator Study Guide", Chapter: FortiLink, Section: Troubleshooting and Debugging FortiLink, p. 410.

Fortinet, "FortiOS 7.2.0 Administration Guide", Document ID: FT-FOS-72-Admin, Section: Switch Controller -> FortiLink Operation and Packet Types.

To enable SNMP version 2c (SNMPv2c) on a managed FortiSwitch, you must first enable the SNMP agent on the device. For SNMPv2c, access control and authentication are managed through community strings. Therefore, you must create and configure at least one SNMP community. This community defines the password (community string), the IP addresses of the SNMP managers allowed to query the agent, and the type of access (read-only or read-write). This configuration is performed on the managing FortiGate controller.

A. SNMP users, which involve authentication and encryption settings, are a requirement for the SNMPv3 protocol, not for the simpler community-based SNMPv2c.

B. Specifying an SNMP host to send traps to is an optional configuration for sending asynchronous alerts; it is not a requirement to enable the SNMP agent for polling.

C. SNMPv3 is a distinct and more secure version of the protocol. It is not required, nor is it used, to handle SNMPv2c messages or traps.

1. FortiSwitch Manager 7.6.0 Administration Guide:

Page 100, "Configuring SNMP for a managed FortiSwitch": This section details the process. It explicitly shows that for SNMPv1/v2c, you must create an "SNMP Community," which involves setting the community name and hosts. This directly supports the requirement to configure communities.

2. FortiOS 7.6.0 Administration Guide:

Page 111, "SNMP": This section describes the SNMP configuration within FortiOS, which is used to manage the FortiSwitch. It clearly distinguishes between creating "Communities" for SNMPv1/v2c and creating "Users" for SNMPv3. It states, "To add an SNMP community, select Create New in the SNMP v1/v2c section." This confirms that configuring communities is the correct procedure for SNMPv2c.

In a FortiGate multi-tenancy configuration managing FortiSwitches, there are two primary methods to assign switch ports to a specific Virtual Domain (VDOM).

1. VLAN-to-VDOM Mapping: You can create a VLAN interface on the FortiLink aggregate interface within the managing VDOM (e.g., root). This VLAN interface is then assigned to a specific tenant VDOM. Subsequently, you assign physical FortiSwitch ports to this VLAN, which effectively directs all traffic from those ports to the designated tenant VDOM.

2. Virtual Port Pool: This feature is designed specifically for multi-tenancy. A global administrator creates a pool of FortiSwitch ports and assigns this entire pool to a tenant VDOM. The administrator of that VDOM can then manage and configure the ports within their assigned pool.

C. VDOM configuration is a FortiGate function. A managed FortiSwitch receives its configuration, including port assignments, from the FortiGate controller and cannot be configured directly with VDOMs.

D. The FortiLink interface itself is the management channel and must reside in the VDOM managing the FortiSwitch. Moving it to a tenant VDOM would break the management connection.

1. Fortinet FortiOS 7.6.0 Administration Guide, FortiSwitch Manager > Multi-tenancy (VDOMs), Page 1. This section explicitly states: "There are two ways to assign a FortiSwitch port to a VDOM: Create a virtual port pool... Assign a VLAN to a VDOM..."

2. Fortinet FortiSwitch Manager 7.6.0 Administration Guide, Multi-tenancy (VDOMs) > Assigning a VLAN to a VDOM. This section details the procedure: "You can assign a VLAN to a VDOM and then assign FortiSwitch ports to that VLAN."

3. Fortinet FortiSwitch Manager 7.6.0 Administration Guide, Multi-tenancy (VDOMs) > Creating a virtual port pool. This section describes the alternative method: "You can create a virtual port pool and then assign the virtual port pool to a VDOM."

4. Fortinet CLI Reference - FortiOS 7.6.0, config switch-controller virtual-port-pool. This command reference details the CLI structure for creating and managing virtual port pools for VDOM assignment.

In a Fortinet Multi-Chassis Link Aggregation Group (MCLAG) configuration, the peer switches are designed to operate as a single logical switch from the perspective of downstream devices and the Spanning Tree Protocol (STP). To achieve this, the MCLAG primary switch synchronizes its Bridge MAC address and STP priority with the secondary switch. Consequently, both Core-1 and Core-2 share the exact same Bridge ID (Priority 20480 and MAC 02090f000701, as seen in the exhibits). Because they represent a single logical entity in the MSTP topology with the lowest shared bridge ID, both devices correctly report themselves as the root bridge.

A. FortiGate firewalls typically do not participate in switch-level STP. Furthermore, external participation would not cause two distinct switches to share an identical Bridge MAC address.

B. An incorrectly configured ISL would likely cause a split-brain scenario, but the exhibits explicitly show synchronized identical Bridge MACs, confirming proper logical operation, not an inconsistency.

D. The provided CLI exhibits clearly display active MSTP instance parameters, such as Forward Time and Max Age, directly contradicting the assertion that MCLAG automatically disables STP.

Fortinet, Inc. FortiSwitchOS Administration Guide. "Multi-chassis link aggregation groups (MCLAG)" -> "MCLAG and spanning tree protocol (STP)". The documentation specifies that "the MCLAG peer group acts as a single STP node. Both MCLAG peer switches share the same bridge ID."

When DHCP snooping is enabled on a VLAN, the switch acts as a layer 2 firewall between untrusted hosts and valid DHCP servers. Client-facing ports are designated as untrusted, while ports connected to legitimate DHCP servers must be designated as trusted. When an untrusted port receives a DHCP broadcast (such as a DISCOVER message) from a client, the switch intercepts the packet and forwards it exclusively to the configured trusted ports. Because the Linux-Server is acting as the DHCP server, its connected switch port (port4) must be trusted. If port4 is left untrusted, the switch will not forward the client's DHCP broadcasts to it, resulting in the server receiving no DHCP traffic.

A. The scenario explicitly states this is intra-VLAN traffic and tcpdump confirms broadcasts, indicating the client is successfully broadcasting on the established Student VLAN.

B. Port1 connects to the Linux-Client, so it must remain untrusted. An untrusted client port successfully accepts DHCP discovery broadcasts to forward to trusted ports.

D. The FortiSwitch port table demonstrates that the Native VLAN on port1 is already configured as "Student," meaning untagged traffic is natively placed on this VLAN.

Fortinet Document Library: FortiSwitchOS 7.2 Administration Guide. "Layer 2 Security: DHCP Snooping." (Details the default untrusted state of ports and the requirement to configure trusted ports for DHCP servers to receive forwarded requests).

Fortinet Knowledge Base (Technical Note): "Technical Tip: How to configure DHCP snooping." (Confirms that DHCP DISCOVER packets received on an untrusted port are only forwarded to trusted ports).

IEEE/IETF RFC Documentation: IETF RFC 3046 "DHCP Relay Agent Information Option" / Core DHCP Snooping Principles. (Outlines the fundamental mechanism of trusted versus untrusted network segments for DHCP traffic handling).

To manage a FortiSwitch stack, the FortiGate must be configured as the switch controller. This requires two fundamental steps. First, the Switch Controller feature must be enabled under System > Feature Visibility on the FortiGate, which makes the FortiSwitch management options available in the GUI. Second, a FortiLink interface must be configured on the FortiGate. This dedicated interface is used for the management and data communication between the FortiGate and the connected FortiSwitch stack, enabling the FortiGate to discover, authorize, and manage the switches.

C. Only a hardware-based FortiGate can manage a FortiSwitch stack.

This is incorrect. FortiGate-VM models also support the FortiLink protocol and can function as a switch controller to manage FortiSwitch stacks.

D. FortiSwitch must be operating in standalone mode before authorization.

This is incorrect. A FortiSwitch must be in FortiLink mode to be discovered and authorized by the FortiGate. It automatically enters this mode upon detecting a FortiLink signal from the FortiGate.

---

1. Fortinet, FortiSwitch Manager 7.6.0 Administration Guide, Page 10, "Basic configuration".

This section explicitly states: "Before you can use your FortiGate unit to manage a FortiSwitch unit, you need to enable the Switch Controller feature." This supports answer B.

The same section details the next step: "The FortiLink is a dedicated interface for communication between a FortiGate unit and a FortiSwitch unit." This supports answer A.

2. Fortinet, FortiSwitch Manager 7.6.0 Administration Guide, Page 6, "Introduction".

This section clarifies platform support: "You can use a FortiGate or FortiGate-VM unit to manage the FortiSwitch units." This directly refutes option C.

3. Fortinet, FortiSwitch Manager 7.6.0 Administration Guide, Page 12, "Authorizing a FortiSwitch unit".

This section describes the process: "When you connect a FortiSwitch unit to a FortiGate port that is part of FortiLink, the FortiGate unit automatically discovers the FortiSwitch unit." The discovery and subsequent authorization occur while the switch is in FortiLink mode, not standalone mode, refuting option D.

The switch-controller-dhcp-snooping-verify-mac command is a security feature designed to mitigate DHCP starvation/exhaustion attacks. It accomplishes this by verifying that the source MAC address of the Ethernet frame matches the client hardware address (CHADDR) field within the DHCP request payload, dropping mismatched packets.

Configuration settings for DHCP Option 82, which allows a relay agent to insert circuit-specific information into DHCP requests, are not available in the FortiGate GUI for managed FortiSwitches. These settings, such as enabling Option 82 insertion or trusting incoming Option 82 data, must be configured through the command-line interface (CLI).

A. DHCP snooping restricts DHCP traffic. It forwards client requests received on untrusted ports only to trusted ports where legitimate DHCP servers are connected, not to all servers.

C. By default, all ports are untrusted. DHCP requests from clients on these untrusted ports are forwarded only to trusted ports, not to other untrusted ports.

1. FortiGate CLI Reference 7.6.0, Page 2018, config switch-controller dhcp-snooping.

The documentation for verify-mac states: "Enable/disable verification of source MAC address in DHCP request packets to filter out invalid packets." This confirms the command's purpose is to validate MAC addresses to prevent attacks like DHCP exhaustion, supporting the intent of option B.

The same section lists multiple CLI-only settings for Option 82, such as set dhcp-option82-insertion enable, set dhcp-option82-circuit-id, and set dhcp-option82-remote-id, confirming that these settings are configured via CLI, which supports option D.

2. FortiSwitchOS 7.4.0 Administration Guide, Page 113, "DHCP snooping".

The guide states: "When you enable DHCP snooping on a VLAN, all ports are untrusted by default. You must configure which ports are trusted." and "DHCP client requests are only forwarded on trusted ports." This directly refutes options A and C.

To allow managed FortiSwitch ports and connected PoE endpoints to exchange power information and negotiate requirements, the LLDP profile must be configured to transmit the power management TLV. In FortiOS, the set med-tlvs command dictates which LLDP-MED Type-Length-Values are advertised. Currently, the exhibit shows only network-policy is enabled. By adding power-management to the med-tlvs configuration, the switch will include the Extended Power-via-MDI TLV in its LLDP packets. This enables advanced PoE negotiation and granular power allocation with compatible endpoint devices.

A. LLDP-MED application types (like voice or streaming-video) classify traffic for QoS policies, not for defining hardware-level PoE negotiation parameters.

B. Creating a completely new profile is unnecessary; the current profile can simply be modified by appending the required TLV to the existing med-tlvs list.

C. The LLDP-MED location ID is utilized to transmit civic addresses or coordinates (such as for emergency E911 services) and has no functionality for power protocols.

Fortinet. (n.d.). FortiSwitchOS Administration Guide. "LLDP-MED configuration."

Fortinet. (n.d.). FortiOS CLI Reference. "config switch-controller lldp-profile" (Section: med-tlvs).

IEEE. (2016). IEEE Standard for Local and metropolitan area networks - Station and Media Access Control Connectivity Discovery (IEEE Std 802.1AB-2016). Section 10: LLDP-MED TLVs.

When a FortiSwitch operating in Layer 3 mode receives a packet, it first examines the destination IP address. The switch then performs a lookup in its hardware routing table, which is programmed by the forwarding information base (FIB). The FIB itself is populated by the control plane from configured static routes, connected interfaces, and dynamic routing protocols. If a matching route is found in the hardware table, the packet is forwarded out the corresponding interface at wire speed. If no match is found, the packet is dropped.

A. Hardware-based routing is offloaded to specialized ASICs for high-speed forwarding. The CPU's role is in the control plane, managing routing protocols and programming the hardware, not handling the actual packet forwarding.

B. ASIC hardware routing is not limited to dynamic routes. The hardware forwarding table is populated with all types of routes (static, connected, and dynamic) learned by the control plane.

D. This behavior describes a FortiSwitch operating as a Layer 2 extension in FortiLink mode. In standalone mode, a FortiSwitch is fully capable of making its own routing decisions locally.

1. Fortinet. (2024). FortiSwitchOS 7.6.0 Administration Guide (Standalone Mode). Fortinet Document Library. Page 121, "Routing" section.

The document states: "When a packet is received on an interface, the FortiSwitch unit gets the destination IP address. The FortiSwitch unit looks up the destination IP address in the hardware routing table and then the forwarding information base (FIB). If a matching entry is found, the FortiSwitch unit forwards the packet to the corresponding interface. If no matching entry is found, the FortiSwitch unit drops the packet." This directly supports the process described in answer C.

A full mesh topology, where every FortiSwitch connects to every other FortiSwitch, inherently creates multiple redundant Layer 2 paths. Without a loop-prevention mechanism, this design would lead to broadcast storms and MAC address table instability, rendering the network unusable. The Spanning Tree Protocol (STP) is the industry-standard protocol designed specifically to address this issue. STP identifies redundant links and logically blocks them to create a single, loop-free path between any two network devices. It maintains the physical redundancy, allowing a blocked path to become active if the primary path fails, thus ensuring both connectivity and a loop-free environment.

A. Multichassis link aggregation group (MCLAG) is a feature for device-level redundancy, typically between two core switches, not a general loop-prevention protocol for a full mesh topology.

C. Full mesh high availability (HA) describes the physical network design and its goal, not the specific protocol or feature configured to prevent loops within that design.

D. A link aggregation group (LAG) bundles multiple physical links into a single logical link for bandwidth and redundancy but does not prevent loops formed between separate switches.

1. Fortinet FortiSwitchOS 7.6.0 Administration Guide, Page 101, "Spanning Tree Protocol (STP)" section: "The Spanning Tree Protocol (STP) is a link-management protocol that provides path redundancy while preventing undesirable loops in a network. For an Ethernet network to function properly, only one active path can exist between any two stations. STP prevents loops by blocking redundant links." This directly confirms STP's role in preventing loops in redundant topologies.

2. Fortinet FortiSwitchOS 7.6.0 Administration Guide, Page 113, "Multichassis Link Aggregation (MCLAG)" section: This section describes MCLAG as a feature to provide redundancy by allowing a client to connect to two different FortiSwitch units. While it has loop-prevention mechanisms for its specific topology, it is not the fundamental protocol for a generic full mesh. The guide states, "STP is still required to provide a loop-free topology with other switches in the network." This highlights that STP is the underlying requirement.

Classification is the Quality of Service (QoS) mechanism responsible for inspecting incoming (ingress) traffic and categorizing it based on specific criteria. On a FortiSwitch, a QoS policy classifies packets by matching their existing Class of Service (CoS) or Differentiated Services Code Point (DSCP) markings. Based on this classification, the policy then maps the packet to a specific egress queue for prioritized transmission. This entire decision-making process of reading the markings and assigning a queue happens upon ingress.

A. Queuing for egress traffic: Queuing is the process of buffering packets in their assigned queues before transmission; it is the result of classification, not the mapping mechanism itself.

C. Rate limiting for egress traffic: Rate limiting (policing) controls the maximum rate of traffic by dropping excess packets. It does not map packets to queues based on their markings.

D. Marking for ingress traffic: Marking is the process of altering the CoS or DSCP value of a packet. The question asks about using existing markings for mapping, not changing them.

---

1. Fortinet FortiSwitch OS 7.6.0 Administration Guide, Page 178, "Quality of Service" chapter.

The guide states, "You can configure a quality of service (QoS) policy to classify, police, and mark incoming traffic." It further details the classification criteria: "You can classify incoming traffic by matching the 802.1p priority, the IP precedence, or the DSCP value." The action taken after classification includes set queue , which explicitly maps the classified traffic to an egress queue. This confirms classification happens on ingress to map to an egress queue.

FortiSwitch, when managed by FortiGate in a FortiLink configuration, uses "FortiSwitch Security Policies" to enable and configure 802.1X on switch ports. This policy is then assigned to the desired ports.

FortiSwitch supports multiple 802.1X modes. One of these is port-based authentication. In this mode, once a single device successfully authenticates on a port, the port state is set to authorized, and all traffic from any device connected to that same port (for example, through a downstream unmanaged switch) is permitted onto the network. This behavior is described in option A.

C. FortiSwitch 802.1X configurations can use external RADIUS servers for authentication. A local user database on the FortiGate is an option but is not mandatory.

D. FortiSwitch supports features like MAC Authentication Bypass (MAB) specifically for devices that do not have an 802.1X supplicant, allowing them to be authenticated based on their MAC address.

1. FortiSwitch™ Managed by FortiOS 7.6 Administration Guide, Page 111, "Configuring 802.1X port-based authentication".

Reference for B: The guide states, "You can configure 802.1X port-based authentication by creating a security policy and then applying the policy to one or more FortiSwitch ports." This directly supports option B.

Reference for A: The same section describes the behavior: "You can configure port-based network access control to block traffic from a client on a specific port until the client is authenticated. After one client is authenticated, any traffic from other clients on the same port is allowed." This confirms option A.

Reference for C: On page 112, Step 4 of the configuration process instructs to "Select one or more RADIUS servers from the User Groups list," demonstrating that external RADIUS servers are used, invalidating the claim that a local database must be used.

Reference for D: On page 112, a configuration option is "MAC authentication bypass (MAB)," which is explicitly for devices that do not support 802.1X, proving option D is false.

Remote Switched Port Analyzer (RSPAN) functions by encapsulating mirrored traffic into a dedicated VLAN to transport it between switches. The best practice is to create and use a VLAN exclusively for this RSPAN traffic. This isolates the potentially high-volume mirrored data from regular production traffic, preventing network congestion, performance degradation on user VLANs, and security complications. This dedicated VLAN is then trunked between the source, transit, and destination switches to deliver the mirrored packets to the monitoring device.

A. Use the same VLAN already configured for regular data traffic.

This is incorrect because mixing high-volume mirrored traffic with production data can cause network congestion and performance issues for users on that VLAN.

C. Use a dynamic VLAN that includes all switch ports.

This is a severe misconfiguration. Including all switch ports would unnecessarily flood the entire network with mirrored traffic, causing a broadcast storm and network outage.

D. Use the RSPAN VLAN as a native VLAN on all trunk ports.

This is incorrect. The RSPAN VLAN carries tagged traffic across trunks. Designating it as the native VLAN is for untagged traffic and is not the standard or recommended RSPAN configuration.

---

1. FortiSwitch OS 7.4.0 Administration Guide, Page 168, "Port mirroring" section.

The documentation explicitly states: "RSPAN uses a dedicated VLAN to transport the mirrored traffic between the switches." This directly supports the use of a dedicated VLAN (Answer B) and contradicts using an existing data VLAN (Answer A).

2. FortiSwitch OS 7.4.0 Administration Guide, Page 169, "Configuring RSPAN" section.

The configuration example demonstrates creating a new, dedicated VLAN for RSPAN: config system interface, edit "rspanvlan", set vlanid , set remote-span enable. This procedure confirms that the standard method is to create a new, dedicated VLAN for this purpose.

In the FortiOS graphical user interface under the "FortiSwitch Ports" section, a specific visual indicator is used for Inter-Switch Links (ISLs). When a managed FortiSwitch port is connected to an adjacent managed FortiSwitch, the FortiGate automatically forms a trunk for the ISL. To quickly visually identify this topology, the GUI replaces the standard Native VLAN text with a link icon alongside the serial number of the adjacent FortiSwitch. Therefore, the presence of the serial number "S424DPTF20000027" and the link icon on port23 confirms that this port connects directly to a neighboring managed FortiSwitch bearing that specific serial number.

A: The port is not a dedicated management interface. Management interfaces utilize specific VLANs but do not automatically display adjacent device serial numbers with a link icon in this column.

C: The displayed serial number belongs to the adjacent connected switch. It does not belong to the local Access-1 switch, which possesses a distinctly different serial number ending in 29.

D: Standalone unmanaged switches do not form FortiLink ISLs. The link icon and adjacent serial number confirm the connected device is a managed FortiSwitch participating in the FortiLink topology.

Fortinet Document Library. "FortiSwitch Manager Administration Guide 7.2.5." Operation and Maintenance: Port List Display, pp. 149-150.

Fortinet Document Library. "FortiSwitchOS 7.4.1 FortiLink Guide." Devices Managed by FortiOS: Managed FortiSwitch Display.

The exhibit displays the current state of the DHCP snooping database and its global configuration on a FortiSwitch. Option B is correct because the trusted ports list explicitly includes _FlInK1_, which is the system-generated interface name for the FortiLink trunk. This indicates the FortiSwitch is configured to trust inbound DHCP server replies (such as DHCPOFFER and DHCPACK) arriving over the FortiLink interface from the FortiGate. Option D is correct because, under the DHCP Global Configuration section, the DHCP Broadcast Mode is set to All. According to Fortinet documentation, this setting instructs the switch to flood DHCP broadcast packets (like DHCPDISCOVER) to all ports in the VLAN, rather than restricting them exclusively to trusted ports (forward-to-server mode).

A: The "Max Client Database Entries: 2000" represents a fixed system or hardware limit for stored snooping bindings, not a value dynamically derived from the DHCP server's available IP pool range.

C: "Client Database: 1" simply indicates there is currently one active, dynamically learned IP-MAC binding lease being tracked by the switch, not a statically configured "trusted" client limitation.

Fortinet, Inc. FortiSwitchOS 7.2.0 Administration Guide. "DHCP snooping and IP source guard", pp. 268-270. Document ID: 04-720-798835-20220811. (Provides conceptual validation that FortiLink ports are trusted by default to allow DHCP server traffic from the FortiGate controller).

Fortinet, Inc. FortiOS 7.2.0 CLI Reference. "config switch global -> set dhcp-broadcast", p. 1145. (Explicitly defines the all parameter as forcing the switch to forward DHCP broadcast packets to all ports in the VLAN).