Authentic Fortinet Certification Exam NSE5_FSW_AD-7.6 Questions Answers

Page 452 of 7.6 study guide, specifically states " Although you can use the sniffer command to capture traffic on switch ports, the types of packets capture by the sniffer are very limited.

The use of the sniffer command on FortiSwitch CLI can be unreliable on port 23 for specific reasons related to the nature of traffic on the port:

D.The switch port might be used as a trunk member.When a switch port is configured as a trunk, it can carry traffic for multiple VLANs. If the sniffer is set up without specifying VLAN tags or a range of VLANs to capture, it may not accurately capture or display all the VLAN traffic due to the volume and variety of VLAN-tagged packets passing through the trunk port. This limitation makes using the sniffer on a trunk port unreliable for capturing specific VLAN traffic unless properly configured to handle tagged traffic.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, the Routing Monitor provides a comprehensive view of the Routing Information Base (RIB), which includes all routes learned via static configuration or dynamic protocols (OSPF, BGP, etc.). However, not every route present in the RIB is active for traffic forwarding. The switch must select the " best " path for any given destination to be installed into theForwarding Information Base (FIB).

The provided exhibit shows a routing table with multiple sources for the same destination. Specifically, there is aStaticdefault route ($0.0.0.0/0$) with an administrative distance of 220, and anOSPFdefault route ($0.0.0.0/0$) with an administrative distance of 110. In FortiSwitchOS routing logic, when multiple routes to the exact same destination exist, the system compares theirAdministrative Distance (AD). The route with the lowest AD is considered the most " preferred " or " trustworthy " .

In this case, the OSPF route ($AD 110$) is more preferred than the Static route ($AD 220$). Consequently, the OSPF route is marked with a green checkmark in theFIBcolumn, while the Static route—despite being " Available " in the RIB—is excluded from the FIB. The same logic applies to the $10.0.100.0/30$ subnet, where theConnectedroute is preferred over the OSPF learned route for the same destination. Therefore, the status reflects standard route selection behavior where less-preferred routes remain in the RIB as backups but are not used for active forwarding.

According to theFortiOS 7.6 Administration Guideand theFortiSwitch 7.6 FortiLink Guide, managing FortiSwitch units in a multi-VDOM environment allows for granular control over physical switch resources. By default, when a FortiSwitch is discovered and authorized via FortiLink, its ports reside in the same VDOM as the FortiLink interface (typically the root or a dedicated management VDOM).

To allocate these ports to other VDOMs, administrators have two primary methods. The first method isdirect assignment(Option A). Using the FortiGate CLI or GUI, an administrator can export a specific physical port directly to a target VDOM. For example, the command set export-to < VDOM_name > under the config switch-controller managed-switch port settings physically isolates that port for use only by the specified VDOM. This is ideal for multi-tenant scenarios where a specific physical connection must be dedicated to a single business unit.

The second method involves using aVirtual Port Pool (VPP)(Option D). This method provides a layer of virtualization for switch ports. An administrator first creates a pool (VPP) in the management VDOM and assigns physical ports to it. Then, from the tenant VDOM, an administrator can " request " a port from that specific pool. This allows for a more flexible " shared " infrastructure where ports are not permanently tethered to a single VDOM until they are claimed from the pool. Both methods ensure that traffic remains logically and physically isolated between VDOMs, supporting the security requirements of complex enterprise deployments. Options B and C are incorrect as they relate to traffic routing and device identification rather than the foundational assignment of hardware ports to virtual domains.