2 packs: 15% off with code BUY2. 3 or more: 20% off with code BUY3.

Free Fortinet NSE5_FSW_AD-7.6 Practice Questions

16 free Fortinet NSE5_FSW_AD-7.6 practice questions from the CertStash pack of 64, each with the correct answer and a full explanation. The rule is the same for every exam: ten free on the product page, 16 free here, all 64 in the pack, and each step includes the one before it.

Get all 64 questions (US$39) · Download the first 10 as a PDF

Question 1

Which two are valid traffic processing actions that a FortiSwitch access control list (ACL) can apply to matching traffic? (Choose two.)

  1. Redirect frames to another port.
  2. Assign traffic to a high-priority egress queue.
  3. Encrypt frames.
  4. Drop frames.
Show answer and explanation

Correct answer: A, D. Redirect frames to another port; Drop frames.

A FortiSwitch ACL matches traffic using classifier fields such as MAC addresses, IP addresses, VLAN, protocol and ports, and then applies an action to the matching frames in hardware. Two of the core forwarding actions are drop, which discards the matching frames so they never leave the switch, and redirect, which sends the matching frames out of a specified port instead of following the normal forwarding path. Both act directly on where the frame goes, and both are performed at wire speed by the switch ASIC without involving the CPU.

Why the other options are wrong

  • B. Placing traffic into a high-priority egress queue is a QoS treatment that changes how a frame is scheduled, not a traffic processing action that decides where the frame goes.
  • C. FortiSwitch ACLs operate on frame headers in the switching ASIC and have no ability to encrypt frames.

Question 2

Which two statements about 802.1X authentication on FortiSwitch ports are true? (Choose two.)

  1. In port-based 802.1X, all hosts behind an authenticated port are allowed access after a successful authentication.
  2. A port policy is used to apply 802.1X authentication on a FortiSwitch interface.
  3. 802.1X authentication can be applied only to trunk ports and not access ports.
  4. All devices connecting to FortiSwitch must support 802.1X authentication.
Show answer and explanation

Correct answer: A, B. In port-based 802.1X, all hosts behind an authenticated port are allowed access after a successful authentication; A port policy is used to apply 802.1X authentication on a FortiSwitch interface.

FortiSwitch supports port-based and MAC-based 802.1X security modes. In port-based mode, the port is opened as soon as one supplicant authenticates successfully, and every host connected behind that port, for example through an unmanaged hub or switch, is then allowed access without authenticating individually. The authentication settings themselves are defined in a port security policy (user groups, guest VLAN, authentication fail VLAN, MAC authentication bypass and similar options), and that policy is then applied to the FortiSwitch interface to enforce 802.1X on it. These two statements describe how 802.1X is deployed on FortiSwitch ports.

Why the other options are wrong

  • C. 802.1X is normally applied to access ports where end devices connect; it is not limited to trunk ports.
  • D. Devices without 802.1X support can still connect through options such as MAC authentication bypass or a guest VLAN.

Question 3

What happens if FortiSwitch fails to discover either FortiEdge Cloud or a FortiGate with FortiLink?

  1. It switches to FortiLink mode by default.
  2. It remains in local management mode.
  3. It requires manual reimaging.
  4. It disables auto-network.
Show answer and explanation

Correct answer: B. It remains in local management mode.

A FortiSwitch can be managed by FortiGate through FortiLink, by FortiEdge Cloud, or locally as a standalone switch. When it boots, it looks for a management platform. If it does not discover either FortiEdge Cloud or a FortiGate with FortiLink, nothing takes over control of the switch, so it simply continues to operate in local management mode. The administrator can then manage it through its own GUI or CLI, and it can still be brought under FortiGate or cloud management later once one of those becomes reachable.

Why the other options are wrong

  • A. FortiLink management requires a discovered FortiGate, so failing to find one cannot place the switch under FortiLink control.
  • C. A failed discovery does not damage the firmware or configuration, so no reimaging is needed.
  • D. Discovery failure does not cause the switch to turn off its auto-network setting.

Question 4

An administrator must deploy managed FortiSwitch devices in a remote location where multiple VLANs must be used to segment devices. No layer 3 switch or router is present at the site, and the only WAN connectivity is an ISP-provided router connected to the public internet.

Which two components are required to enable VLAN segmentation across this remote site? (Choose two.)

  1. FortiGate and FortiSwitch configured with VXLAN to tunnel VLANs over the WAN
  2. A layer 3 router at the remote location to handle inter-VLAN routing
  3. A FortiSwitch model that supports VXLAN hardware acceleration
  4. FortiSwitch and FortiGate devices configured with IPsec interfaces
  5. FortiGate with a layer 3 interface to terminate the VXLAN overlay
Show answer and explanation

Correct answer: A, E. FortiGate and FortiSwitch configured with VXLAN to tunnel VLANs over the WAN; FortiGate with a layer 3 interface to terminate the VXLAN overlay

With no router or layer 3 switch at the remote site and only an ISP router to the internet, the VLANs cannot be routed locally, so they must be extended back to FortiGate. Configuring FortiGate and FortiSwitch with VXLAN encapsulates the layer 2 VLAN traffic inside UDP packets that cross the WAN, so the remote switch ports keep their VLAN segmentation. On the FortiGate side, a layer 3 interface terminates the VXLAN overlay, which gives each VLAN its gateway and lets FortiGate route and apply security policy between the segments.

Why the other options are wrong

  • B. The scenario states no layer 3 router is present, and the VXLAN design moves inter-VLAN routing to FortiGate instead.
  • C. The requirement is VXLAN tunneling with FortiGate termination, not a specific hardware acceleration capability on the switch.
  • D. IPsec interfaces alone do not carry the VLANs as layer 2 segments; the overlay that extends them is VXLAN.

Question 5

Which QoS mechanism maps packets with specific class of service (CoS) or Differentiated Services Code Point (DSCP) markings to an egress queue?

  1. Classification for ingress traffic
  2. Queuing for egress traffic
  3. Policing for ingress traffic
  4. Shaping for egress traffic
Show answer and explanation

Correct answer: B. Queuing for egress traffic

FortiSwitch QoS works in stages. Traffic is first classified on ingress, and the egress side then decides how that traffic is scheduled out of the port. Queuing for egress traffic uses a QoS map that associates CoS or DSCP values with one of the port's egress queues, and the egress scheduling policy then services those queues. This mapping of CoS or DSCP markings to a specific egress queue is the job of the egress queuing mechanism.

Why the other options are wrong

  • A. Ingress classification identifies and marks traffic as it enters; it is not the mechanism that places marked packets into egress queues.
  • C. Ingress policing limits the rate of incoming traffic and drops or remarks excess, rather than mapping markings to queues.
  • D. Egress shaping controls the outgoing rate of a port or queue; it does not decide which queue a marked packet uses.

Question 6

What does the switch auto-network setting control on FortiSwitch?

  1. The automatic VLAN assignment based on connected devices
  2. The automatic discovery of the FortiGate FortiLink interface
  3. The root bridge priority for Multiple Spanning Tree Protocol (MSTP)
  4. Whether the FortiSwitch can be managed by FortiManager
Show answer and explanation

Correct answer: B. The automatic discovery of the FortiGate FortiLink interface

The switch auto-network setting on FortiSwitch controls whether the switch automatically detects a FortiLink connection from FortiGate. With it enabled, the switch can recognize the FortiGate FortiLink interface on its uplink and prepare the port for FortiLink management without manual configuration. This lets a new FortiSwitch be connected to FortiGate and discovered with zero-touch provisioning.

Why the other options are wrong

  • A. Assigning devices to VLANs dynamically is handled by features such as 802.1X or MAC-based VLAN assignment, not auto-network.
  • C. MSTP root priority is set in the spanning tree configuration, not by auto-network.
  • D. Auto-network concerns FortiLink detection with FortiGate, not whether FortiManager can manage the switch.

Question 7

Which statement best describes a benefit of using MAC, IP address, or protocol-based VLAN assignments on FortiSwitch?

  1. It disables 802.1X authentication while preserving user access control.
  2. It requires devices to authenticate through a RADIUS server before VLAN tagging.
  3. It assigns ports to VLANs regardless of device type or traffic.
  4. It offers dynamic segmentation benefits similar to 802.1X authentication.
Show answer and explanation

Correct answer: D. It offers dynamic segmentation benefits similar to 802.1X authentication.

FortiSwitch can place traffic into a VLAN based on the source MAC address, the source IP address or subnet, or the protocol type, instead of relying only on the static VLAN of the port. Because the VLAN follows the device or traffic type, users and devices land in the right segment wherever they connect. This gives dynamic segmentation similar to what 802.1X with dynamic VLAN assignment provides, and it works for devices that cannot run an 802.1X supplicant.

Why the other options are wrong

  • A. These assignment methods do not disable 802.1X, and on their own they do not provide user authentication or access control.
  • B. MAC, IP and protocol-based assignments match locally configured criteria and do not require RADIUS authentication.
  • C. These methods assign VLANs based on the device or traffic, which is the opposite of ignoring device type or traffic.

Question 8

How does enabling an IGMP snooping proxy on FortiSwitch help reduce the number of IGMP reports processed by the IGMP querier?

  1. By converting IGMP reports into broadcast packets to reach all VLAN members
  2. By converting IGMP traffic to unicast
  3. By suppressing duplicate IGMP reports within the VLAN
  4. By forwarding IGMP reports only when the first member joins and the last member leaves
Show answer and explanation

Correct answer: D. By forwarding IGMP reports only when the first member joins and the last member leaves

With IGMP snooping proxy enabled, FortiSwitch answers on behalf of its attached receivers instead of passing every host report upstream. It tracks group membership locally and sends a join report toward the IGMP querier only when the first member joins a group, and a leave only when the last member leaves. Reports from additional hosts joining a group that already has members are handled by the switch, so the querier processes far fewer IGMP reports.

Why the other options are wrong

  • A. Turning reports into broadcasts would increase traffic and processing, which is the opposite of what the proxy achieves.
  • B. The proxy does not convert IGMP into unicast traffic; it consolidates membership reporting.
  • C. Simply suppressing duplicates within the VLAN does not describe the first-join and last-leave reporting the proxy performs toward the querier.

Question 9

How does FortiSwitch determine the route for traffic traversing its interfaces?

  1. Hardware-based routing on FortiSwitch is handled by the CPU.
  2. ASIC hardware routing can handle only dynamic routing, if supported.
  3. FortiSwitch looks up the hardware routing table and then the forwarding information base (FIB).
  4. FortiSwitch forwards all traffic to FortiGate for routing decisions.
Show answer and explanation

Correct answer: C. FortiSwitch looks up the hardware routing table and then the forwarding information base (FIB).

FortiSwitch performs layer 3 forwarding in its switching ASIC whenever possible. For routed traffic it first looks up the destination in the hardware routing table programmed into the ASIC, which forwards matching traffic at wire speed. If no hardware entry handles the packet, the lookup moves to the forwarding information base maintained by the software routing process. This two-step lookup lets static and dynamic routes be offloaded to hardware while the FIB remains the complete reference.

Why the other options are wrong

  • A. Hardware routing is performed by the ASIC, not by the CPU; CPU handling is the software path.
  • B. The ASIC hardware routing table can hold static routes as well as dynamic routes.
  • D. FortiSwitch can route between its own interfaces and does not have to send all traffic to FortiGate for routing decisions.

Question 10

A FortiGate is connected to a pair of FortiSwitch devices.

For redundancy, FortiGate must use uplinks on both switches simultaneously without depending on Spanning Tree Protocol (STP). Which configuration is required?

  1. Multi-tier topology
  2. Multichassis link aggregation group (MCLAG)
  3. Full mesh high availability (HA)
  4. Link aggregation group (LAG)
Show answer and explanation

Correct answer: B. Multichassis link aggregation group (MCLAG)

To use uplinks to two separate FortiSwitch devices at the same time, the two switches must appear to FortiGate as a single link partner. A multichassis link aggregation group pairs the two switches as MCLAG peers connected by an ICL, so FortiGate can bundle one link to each switch into one aggregate. All member links forward traffic simultaneously and failover happens within the aggregate, so redundancy does not depend on Spanning Tree Protocol blocking one of the paths.

Why the other options are wrong

  • A. A multi-tier topology describes layering of switches and does not by itself let FortiGate use links to two switches as one bundle.
  • C. Full mesh HA concerns redundancy between FortiGate cluster members and their switches, not an active aggregate to two switches.
  • D. A standard LAG must terminate on a single switch, so it cannot span two separate FortiSwitch devices.

What people say about the full NSE5_FSW_AD-7.6 pack 5.0 from 2

Passed!!! Wonderful Fortinet NSE5_FSW_AD-7.6 exam study materials.
RyanNSE5_FSW_AD-7.6
Really thank you so much for all your Fortinet NSE 5 - FortiSwitch 7.6 Administrator dumps help.
VicNSE5_FSW_AD-7.6

Question 11

What is one key advantage of using a sniffer profile on FortiSwitch compared to using the sniffer command?

  1. It allows packet capture on all switch ports without limitations.
  2. It eliminates the need to use access control lists (ACLs) or port mirroring for analysis.
  3. It automatically filters irrelevant traffic types.
  4. It automatically decrypts SSL/TLS traffic for full packet inspection.
Show answer and explanation

Correct answer: C. It automatically filters irrelevant traffic types.

A sniffer profile on FortiSwitch stores the capture parameters, including the interface and a filter that defines which traffic is of interest. Once the profile is defined, captures run against that saved filter, so traffic that is irrelevant to the troubleshooting task is left out automatically. The ad hoc sniffer command requires the filter to be typed each time, while the profile applies it consistently, producing a smaller and more focused capture.

Why the other options are wrong

  • A. A sniffer profile still has practical limits, such as the packet count and the interface it is tied to.
  • B. A sniffer profile complements tools such as ACLs and port mirroring rather than removing the need for them.
  • D. FortiSwitch packet capture does not decrypt SSL or TLS traffic.

Question 12

When Dynamic Host Configuration Protocol (DHCP) snooping is enabled on a FortiSwitch VLAN, which two statements are true? (Choose two.)

  1. DHCP replies are accepted only on trusted ports.
  2. DHCP snooping blocks all unicast traffic.
  3. Option 82 can be inserted into DHCP requests.
  4. DHCP requests are dropped if sent from trusted ports.
Show answer and explanation

Correct answer: A, C. DHCP replies are accepted only on trusted ports; Option 82 can be inserted into DHCP requests.

DHCP snooping divides switch ports into trusted and untrusted. Ports toward legitimate DHCP servers are set as trusted, and DHCP server replies such as offers and acknowledgments are accepted only on trusted ports, while replies arriving on untrusted ports are dropped to stop rogue servers. FortiSwitch can also insert DHCP option 82 (relay agent information) into client DHCP requests, adding details such as the circuit ID and remote ID so the server can identify the switch and port a client is connected to.

Why the other options are wrong

  • B. DHCP snooping inspects DHCP messages only and does not block ordinary unicast traffic.
  • D. Trusted ports are where valid DHCP traffic is expected, so requests on them are not dropped.

Question 13

You are configuring FortiSwitch to perform layer 3 inter-VLAN routing while managed by FortiGate over FortiLink. On supported hardware models, FortiSwitch can offload routing decisions for better performance.

How does FortiSwitch perform routing between VLANs?

  1. By using a hardware forwarding table (FIB) programmed into ASIC.
  2. By supporting only dynamic routing protocols in hardware.
  3. By disabling routing when managed by FortiGate.
  4. By relying entirely on the CPU in software.
Show answer and explanation

Correct answer: A. By using a hardware forwarding table (FIB) programmed into ASIC.

On models that support layer 3 features, FortiSwitch routes between VLANs in hardware. The routing table built from static and dynamic routes is used to program a forwarding information base into the switch ASIC, and the ASIC then forwards routed packets at wire speed without involving the CPU for each packet. The CPU still runs the control plane, such as routing protocols and table calculation, but the actual packet forwarding between VLAN interfaces is offloaded to the hardware table. This is why hardware routing on FortiSwitch delivers much higher performance than software forwarding.

Why the other options are wrong

  • B. Hardware forwarding applies to installed routes regardless of whether they are static, connected or learned dynamically.
  • C. FortiSwitch can still route between VLANs when managed by FortiGate; FortiLink management does not disable layer 3 features.
  • D. CPU forwarding is slow and is not how supported models route; the ASIC performs forwarding while the CPU handles only control functions.

Question 14

What is an advantage of using a FortiSwitch stack in managed switch mode with FortiGate when deploying VLANs?

  1. FortiGate executing the routing and FortiSwitch managing its configuration.
  2. Ensuring VLAN traffic can pass between connected switches in the stack.
  3. FortiGate no longer needing to manage any VLAN configuration.
  4. FortiGate provides visibility and control for inter-VLAN traffic.
Show answer and explanation

Correct answer: D. FortiGate provides visibility and control for inter-VLAN traffic.

In managed switch mode, VLANs are created as FortiLink interfaces on FortiGate, and FortiGate acts as the gateway for each VLAN on the FortiSwitch stack. Because traffic moving between VLANs is routed by FortiGate, it passes through firewall policies, which gives the administrator visibility into that traffic and control over it with security profiles, logging and policy enforcement. This centralized inspection of inter-VLAN traffic is a key advantage of the managed switch design.

Why the other options are wrong

  • A. In managed mode FortiGate manages the switch configuration as well, so the switch does not manage its own configuration.
  • B. Passing VLAN traffic between connected switches is basic trunking and is not an advantage specific to managed mode.
  • C. FortiGate is where the VLANs are configured in managed mode, so it still manages the VLAN configuration.

Question 15

When you change FortiSwitch management mode from standalone to managed, what happens to the existing standalone configuration?

  1. FortiSwitch registers to FortiSwitch Cloud to save a copy before managing with FortiGate.
  2. FortiSwitch merges the existing standalone configuration with the default FortiLink configuration.
  3. FortiSwitch saves the standalone configuration and changes to the default FortiLink configuration.
  4. FortiGate automatically saves the existing FortiSwitch configuration during the FortiLink management process.
Show answer and explanation

Correct answer: C. FortiSwitch saves the standalone configuration and changes to the default FortiLink configuration.

Changing FortiSwitch from standalone mode to managed (FortiLink) mode does not merge or discard the existing settings. FortiSwitch saves its standalone configuration and then starts with the default FortiLink configuration, so that FortiGate can take over and push its own configuration through FortiLink. Because the standalone configuration is preserved, it can be used again if the switch is later returned to standalone mode. This keeps the managed configuration clean and fully controlled by FortiGate.

Why the other options are wrong

  • A. FortiSwitch Cloud is a separate management option and is not used as a backup step when switching to FortiLink management.
  • B. Merging standalone settings with FortiLink settings would create conflicts; the switch starts from the default FortiLink configuration instead.
  • D. FortiGate pushes its own configuration to the switch; it does not back up the previous standalone configuration.

Question 16

You are deploying a small office network with a single FortiGate and a single FortiSwitch. The office currently has moderate traffic, but the IT team expects the network to grow in the near future, adding more FortiSwitch devices and endpoints.

Which FortiLink configuration should you deploy to provide the best combination of current performance and scalability for future growth?

  1. Configure FortiLink using hardware-based switch interfaces.
  2. Configure FortiLink using software-based switch interfaces.
  3. Configure FortiLink as a link aggregation group (LAG) interface.
  4. Configure FortiLink as a multichassis LAG (MCLAG) interface.
Show answer and explanation

Correct answer: C. Configure FortiLink as a link aggregation group (LAG) interface.

Configuring FortiLink as a link aggregation group bundles several physical FortiGate ports into one logical FortiLink interface. Traffic is load balanced across the member links, which increases bandwidth for the current office, and the loss of a single member link does not break FortiSwitch management. As the network grows, more member links can be added to the aggregate and additional FortiSwitch devices can be connected behind the first switch, so the same design scales without rebuilding the FortiLink setup. With a single FortiGate and a single FortiSwitch, a LAG gives the best balance of performance, redundancy and growth.

Why the other options are wrong

  • A. A hardware switch interface groups FortiGate ports into one switching domain, but it does not aggregate bandwidth or provide link redundancy toward a single FortiSwitch.
  • B. A software switch bridges ports through the FortiGate CPU, which limits performance and adds no aggregated bandwidth for growth.
  • D. MCLAG requires a pair of peer FortiSwitch devices acting as one logical switch, which a single FortiSwitch deployment cannot provide.

That was 16 of 64.

The full Fortinet NSE5_FSW_AD-7.6 pack has all 64 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack

Not ready yet? Get the first 32 free as one PDF by email. Get the Half Pack →