Fortinet Updated NSE5_FSW_AD-7.6 Exam Questions and Answers by kylan

According to theFortiSwitchOS 7.6 Administration Guideand theFortiLink 7.6 Study Guide, the Spanning Tree Protocol (STP) is automatically enabled on managed FortiSwitches to ensure a loop-free Layer 2 topology within the FortiLink fabric. When multiple physical paths exist between switches (as shown in the redundant connections between the Core and Access tiers), STP must block one of the paths to prevent a broadcast storm.

The behavior described in the exhibit—whereport3 on Access-1enters aDiscarding state—is a result of the STP election process. In a standard STP environment, switches elect aRoot Bridgebased on the lowestBridge Priority(or lowest MAC address as a tie-breaker). Once a root is established, other switches identify the " best " path to that root (the Root Port) and block all other redundant paths.

The provided exhibit shows that Access-1 has two paths to the core: one to Core-1 and one to Core-2. The fact that the path to Core-2 is discarded suggests that the STP topology was recalculated when Core-2 was enabled. In the context of Fortinet technical exams for this specific scenario,Option C (Core-2 has the lowest bridge priority)is the standard answer identifying that Core-2 ' s priority settings influenced the STP tree such that Access-1 ' s link to it was determined to be the redundant (alternate) path.

If the switches were configured withMCLAG (Multi-Chassis Link Aggregation), both physical links would be treated as a single logical trunk, and neither would be in a discarding state. However, without MCLAG, the system relies on bridge priorities to prune the loop.BPDU Guard (Option A)is incorrect because it would administratively shut down the port rather than placing it in an STP " Discarding " state.Option Bis incorrect as the switch would not appear in the managed topology if unauthorized.

According to theFortiSwitchOS 7.6 Administration Guideand theNSE 5 FortiSwitch 7.6 Administrator Study Guide, Access Control Lists (ACLs) are used to perform multiple actions on matching traffic as it passes through the switch pipeline. The documentation explicitly categorizes these valid actions into three distinct functional groups:Traffic processing,QoS (Quality of Service), andVLANmodifications.

Traffic Processing (Option C):This is a primary category of ACL actions. It includes operations that dictate how a frame is physically handled or monitored. Valid specific actions under this category includedrop(discarding the packet),count(incrementing a packet counter for statistics),redirect(sending the packet to a specific interface or CPU queue), andmirror(copying the traffic to a monitor port).

QoS (Option E):The QoS category allows the switch to manage traffic prioritization and bandwidth. ACLs can be configured toset the egress queue(assigning a frame to one of the eight priority queues),remark CoS (Class of Service)orDSCP (Differentiated Services Code Point)values in the frame header, and applypolicersfor rate limiting.

VLAN / Set outer VLAN tags (Option D):Under the VLAN category, the most notable action is the ability toset outer VLAN tagson frames. This is particularly useful in scenarios involving Q-in-Q tunneling or service provider environments where a secondary tag is required for transport across a managed fabric.

It is important to note thatAssign the VLAN ID (Option A)is typically a function ofNAC (Network Access Control)orDynamic VLAN Assignmentrather than a standard ACL action; within an ACL context, vlan-id is primarily used as aclassifier(to match traffic) rather than an action.Quarantine devices (Option B)is a high-level security response triggered by the FortiGate NAC engine and is not a direct action available within the FortiSwitch ACL configuration menu.

According to theFortiOS 7.6 Study Guideand theFortiSwitch 7.6 FortiLink Guide, the automatic discovery and subsequent management of a FortiSwitch by a FortiGate controller is primarily facilitated by theLink Layer Discovery Protocol (LLDP). LLDP is an industry-standard, layer-2 protocol that allows network devices to advertise their identities and capabilities to neighbors on the same physical link.

When a factory-default FortiSwitch is connected to a FortiGate port (specifically one configured as a FortiLink interface), the switch automatically sends outLLDP advertisements. These advertisements include specificOrganizationally Specific TLVs (Type-Length-Values)that identify the device as a FortiSwitch and provide its management MAC address and current state. The FortiGate " listens " for these LLDP frames; once it receives a frame from a compatible FortiSwitch, it automatically lists the switch in theManaged FortiSwitchinventory as a " discovered " device awaiting authorization.

WhileZero-touch deployment (Option A)describes the overall goal of deploying a switch without manual CLI configuration, it is the underlyingLLDPprotocol that provides the technical mechanism for the initial detection. Once the switch is discovered via LLDP and authorized, the FortiGate uses a DHCP server on the FortiLink interface to assign an IP address to the switch and establishes a secureCAPWAP(Control and Provisioning of Wireless Access Points) tunnel for management. TheFortiLink heartbeat (Option D)is a secondary mechanism usedafterthe connection is established to monitor the health and status of the link, rather than for the initial detection of the device.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, the classification of untagged traffic entering a switch port is determined by the port ' s hierarchy of VLAN assignment rules.

For the traffic arriving atport1:

PC1 (MAC 58:ef:68:b4:33:32):The exhibit shows an explicitMAC-based VLAN assignmentrule for this specific MAC address, placing it intoVLAN 10. In FortiSwitchOS, dynamic assignments like MAC-based or protocol-based rules take precedence over the port ' s static native VLAN. Therefore, PC1 ' s traffic is internally associated with VLAN 10.

PC2 (MAC 58:ef:68:b4:33:c3):There is no MAC-based rule for this device. As a result, the switch falls back to the default behavior and assigns the traffic to the port ' sNative VLAN, which isVLAN 20.

For the traffic exiting port2:

The egress behavior depends on the VLAN tagging configuration of the outgoing interface. On port2, the Native VLAN is 4094, and VLANs 10 and 20 are listed as Allowed VLANs. According to Fortinet documentation, any traffic belonging to an allowed VLAN that does not match the native VLAN ID of the egress port must be sent as tagged 802.1Q frames. Since neither VLAN 10 nor VLAN 20 matches the native ID of 4094, the FortiSwitch will apply a VLAN 10 tag to PC1 ' s traffic and a VLAN 20 tag to PC2 ' s traffic as they are forwarded to the FortiGate.