NSE5_FSW_AD-7.6 Exam Preparation Material | Fortinet NSE 5 - FortiSwitch 7.6 Administrator

Explanation:
According to theFortiOS 7.6 Administration Guideand the FortiSwitch 7.6 FortiLink Guide, managing FortiSwitch units in a multi-VDOM environment allows for granular control over physical switch resources. By default, when a FortiSwitch is discovered and authorized via FortiLink, its ports reside in the same VDOM as the FortiLink interface (typically the root or a dedicated management VDOM ).
To allocate these ports to other VDOMs, administrators have two primary methods. The first method isdirect assignment (Option A). Using the FortiGate CLI or GUI, an administrator can export a specific physical port directly to a target VDOM. For example, the command set export-to <VDOM_name> under the config switch-controller managed-switch port settings physically isolates that port for use only by the specified VDOM. This is ideal for multi-tenant scenarios where a specific physical connection must be dedicated to a single business unit.
The second method involves using aVirtual Port Pool (VPP) (Option D). This method provides a layer of virtualization for switch ports. An administrator first creates a pool (VPP) in the management VDOM and assigns physical ports to it. Then, from the tenant VDOM, an administrator can "request" a port from that specific pool. This allows for a more flexible "shared" infrastructure where ports are not permanently tethered to a single VDOM until they are claimed from the pool. Both methods ensure that traffic remains logically and physically isolated between VDOMs, supporting the security requirements of complex enterprise deployments. Options B and C are incorrect as they relate to traffic routing and device identification rather than the foundational assignment of hardware ports to virtual domains.

Explanation:
According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, the primary physical constraint when deploying PoE devices is the total power capacity of the switch's internal power supply unit (PSU). The provided exhibit shows the PoE status forAccess-1, highlighting three critical metrics: theUnit Power Budget (185.00W), the current Unit Power Consumption (12.70W), and theUnit Guard Band.
The Unit Power Budgetrepresents the maximum amount of power the switch can provide to all connected Powered Devices (PDs) simultaneously. As more devices (such as access points, VoIP phones, or cameras) are connected, the cumulative power draw increases. The most important consideration is ensuring that thetotal PoE consumption does not exceed this budget. If the budget is exceeded, the switch will stop providing power to new devices or, depending on the configuration, may shut down lower-priority ports to protect the system hardware.
In this specific exhibit, theUnit Poe Power Modeis set toPriority Based. This means that if the power consumption approaches the budget limit, the switch will use the configured port priorities (seen as "Low" for port1 and port2) to decide which devices to keep powered. TheGuard Band (set to a dynamic value) also plays a role by reserving a small amount of power to handle spikes when devices initialize, further emphasizing that the power budget is a hard limit that must be actively managed by the administrator.

Explanation:
According to theFortiSwitchOS 7.6 Administration Guideand theFortiLink 7.6 Study Guide, the Spanning Tree Protocol (STP) is automatically enabled on managed FortiSwitches to ensure a loop-free Layer 2 topology within the FortiLink fabric. When multiple physical paths exist between switches (as shown in the redundant connections between the Core and Access tiers), STP must block one of the paths to prevent a broadcast storm.
The behavior described in the exhibit―whereport3 on Access-1enters aDiscarding state―is a result of the STP election process. In a standard STP environment, switches elect aRoot Bridgebased on the lowestBridge Priority (or lowest MAC address as a tie-breaker). Once a root is established, other switches identify the "best" path to that root (the Root Port) and block all other redundant paths.
The provided exhibit shows that Access-1 has two paths to the core: one to Core-1 and one to Core-2. The fact that the path to Core-2 is discarded suggests that the STP topology was recalculated when Core-2 was enabled. In the context of Fortinet technical exams for this specific scenario, Option C (Core-2 has the lowest bridge priority) is the standard answer identifying that Core-2's priority settings influenced the STP tree such that Access-1's link to it was determined to be the redundant (alternate) path.
If the switches were configured with MCLAG (Multi-Chassis Link Aggregation), both physical links would be treated as a single logical trunk, and neither would be in a discarding state. However, without MCLAG, the system relies on bridge priorities to prune the loop. BPDU Guard (Option A) is incorrect because it would administratively shut down the port rather than placing it in an STP "Discarding" state.
Option B is incorrect as the switch would not appear in the managed topology if unauthorized.

Explanation:
According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6.1 Administration Guide―Standalone Mode, FortiSwitch units support two primary methods for processing Layer 3 traffic: software-based routing and hardware-based routing. To maximize performance, the documentation specifies thatHardware-based routing (Option A) is the superior choice for high-speed environments.
The primary technical reason for this performance advantage is the use ofApplication-Specific Integrated Circuits (ASICs). In hardware-based routing, the routing table and forwarding information are programmed directly into the switch's specialized hardware silicon. This allows the FortiSwitch to perform packet lookups and forwarding decisions at "wire speed, " which refers to the full throughput capacity of the physical ports. By offloading these tasks to the ASIC, the switch minimizes latency and prevents the performance bottlenecks associated with general-purpose CPU processing.
In contrast, software-based routing (Options B and D) requires the main system CPU and kernel to process every packet, which is significantly slower and can lead to high CPU utilization during heavy traffic loads.
Option C is factually incorrect because hardware-based routing specifically avoids the kernel's software path to increase speed. Therefore, for a deployment focused on maximizing routing performance, especially in a backbone or high-density branch environment, utilizing the ASIC-driven hardware forwarding path is the recommended approach in FortiSwitchOS 7.6.

Explanation:
According to theFortiSwitchOS 7.6 Administration Guideand theNSE 5 FortiSwitch Study Guide, Access Control Lists (ACLs) are used to provide granular control over the traffic entering or leaving a switch port. ACLs function by defining classifiers (to match specific traffic based on criteria like MAC address, IP address, or VLAN ID) and then applying specificactionsto that matched traffic.
The documentation explicitly categorizes ACL actions into three distinct groups:
Traffic Processing: This category includes actions that dictate the physical handling of the frame. Valid actions listed in the official documents under this header includecount (to track packet volume), drop (to block the traffic), redirect (to forward the frame to a specific physical port or interface instead of its original destination), andmirror (to send a copy to a monitoring port ).
Quality of Service (QoS): This category focuses on traffic prioritization and bandwidth management. It includes actions such asrate limiting, remarking CoS/DSCP values, andsetting the egress queue (e.g., assigning a packet to a specific queue number from 0 to 7 ).
VLAN: This allows for modifications such as setting anouter VLAN tagon frames.
The question specifically asks for "traffic processing actions." Based on the 7.6 documentation, Redirect frames to another port (Option A) andDrop frames (Option D) are explicitly defined under the "Traffic Processing" action header. While "Assign traffic to a high-priority egress queue" (Option B) is a valid action an ACL can perform, it is technically categorized as aQoS action, not a traffic processing action.Encrypt frames (Option C) is not a supported ACL action on FortiSwitch hardware, as encryption is typically handled at higher layers or via dedicated MACsec configurations on specific models.