When untagged traffic arrives at FortiSwitch port1, the switch determines VLAN assignment based on configured policies. PC1's MAC address is explicitly configured as a member of VLAN 10 via MAC-based VLAN assignment, which overrides the port's native VLAN. Consequently, PC1's traffic is assigned to VLAN 10. PC2 lacks a specific MAC-based policy; thus, its untagged traffic defaults to port1's Native VLAN, which is VLAN 20. Upon egressing port2 towards the FortiGate, the traffic must be forwarded. Port2 is configured with Allowed VLANs 10 and 20, but neither is configured as an Untagged VLAN or the Native VLAN (4094) for that port. Therefore, FortiSwitch applies an 802.1Q tag corresponding to the assigned VLAN for each frame: VLAN 10 for PC1 and VLAN 20 for PC2.

A. Incorrect because MAC-based VLAN assignment intercepts PC1's traffic and places it into VLAN 10, preventing it from defaulting to the Native VLAN 20 alongside PC2.

B. Incorrect because PC2's MAC address is not mapped to VLAN 10; MAC-based overrides apply strictly to the specific MAC addresses defined in the policy.

D. Incorrect because egress port2 does not have VLAN 10 listed under Untagged VLANs, nor is it the native VLAN, so PC1 traffic must be tagged upon egress.

Fortinet, Inc. "FortiSwitchOS 7.2.0 Administration Guide." MAC-based VLANs, Document Identifier: 01-720-781523-20220804, pp. 154-156. (Details how MAC-to-VLAN binding supersedes standard port-based Native VLAN assignment for ingress traffic).

Fortinet, Inc. "FortiSwitchOS 7.2.0 Administration Guide." VLANs and port configuration, Document Identifier: 01-720-781523-20220804, pp. 148-151. (Specifies that egressing traffic on allowed VLANs receives an 802.1Q tag unless specifically defined in the port's untagged-vlans list or matched to the native VLAN).