I85PREP
⌘ K
NSE5 FortiSwitch 7.6 study materials
NSE5 FortiSwitch 7.6 study resources

NSE5 FortiSwitch 7.6 practice questions

One question at a time. Build your NSE5 FortiSwitch 7.6 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiSwitch Deployment and Management

In a FortiSwitch deployment managed by a FortiGate, which protocol does the FortiGate use to push configuration to the switch and to authorize it as a managed device?

  1. CAPWAP
  2. RADIUS
  3. LLDP-MED
  4. FortiLink Correct answer.

Explanation

FortiLink is the proprietary management tunnel between a FortiGate and a FortiSwitch, carrying configuration, authorization, and monitoring traffic. It is enabled on a FortiGate interface that is dedicated to switch management.

Question 2FortiSwitch Deployment and Management

Which FortiSwitch mode allows the switch to be fully configured and managed by a FortiGate through FortiLink?

  1. Standalone mode
  2. Transparent mode
  3. Local mode
  4. Managed mode Correct answer.

Explanation

A FortiSwitch in managed mode is authorized and configured by the FortiGate over FortiLink, so most configuration is performed on the FortiGate. Standalone mode means the switch is configured through its own GUI or CLI without a FortiGate.

Question 3FortiSwitch Deployment and Management

What is the default management IP address and access method used to reach a factory-default FortiSwitch before it is authorized?

  1. 192.168.1.1 over Telnet
  2. 169.254.1.1 over HTTPS Correct answer.
  3. 192.168.1.99 over HTTPS
  4. 10.0.0.1 over SSH

Explanation

A factory-reset FortiSwitch uses the link-local address 169.254.1.1 for its management GUI, reachable on any port in the default management VLAN. This is how an administrator first connects before FortiLink authorization.

Question 4FortiSwitch Deployment and Management

An administrator wants a FortiSwitch to obtain its management IP address automatically when connected to a FortiGate FortiLink interface. Which setting should be configured on the switch?

  1. DHCP client on the management VLAN Correct answer.
  2. A static IP in the FortiLink subnet
  3. PPPoE on the FortiLink port
  4. A secondary IP on the internal interface

Explanation

By default FortiSwitch management interfaces act as DHCP clients, and the FortiGate can serve addresses on the FortiLink interface. Leaving the switch as a DHCP client lets it receive a management address automatically.

Question 5FortiSwitch Deployment and Management

Which step must be completed on the FortiGate before a newly connected FortiSwitch can receive configuration over FortiLink?

  1. Authorize the switch serial number Correct answer.
  2. Create a static route to the switch
  3. Register the switch with FortiCloud
  4. Enable CAPWAP on the FortiLink

Explanation

The FortiGate discovers connected FortiSwitches but will not manage them until their serial numbers are authorized on the FortiLink interface. Authorization is the trust step that permits configuration to be pushed.

Question 6FortiSwitch Deployment and Management

What is the purpose of a FortiSwitch VLAN definition created on the FortiGate in a FortiLink deployment?

  1. It creates inter-VLAN routing on the switch only
  2. It defines Layer 2 segments that can be assigned to managed switch ports Correct answer.
  3. It replaces the switch's internal VLAN database
  4. It encrypts traffic between switch and FortiGate

Explanation

VLANs defined on the FortiGate are pushed to managed FortiSwitches and can be assigned to ports as native or allowed VLANs. This centralizes Layer 2 segmentation configuration.

Question 7FortiSwitch Deployment and Management

A managed FortiSwitch port must carry untagged traffic for VLAN 20 while also allowing tagged VLAN 30. Which port configuration accomplishes this?

  1. Native VLAN 30 with allowed VLAN 20
  2. Native VLAN 20 with allowed VLAN 30 Correct answer.
  3. Access port assigned to VLAN 30 only
  4. Trunk with no native VLAN and only VLAN 20 allowed

Explanation

The native VLAN carries untagged frames, so VLAN 20 must be the native VLAN. VLAN 30 is carried tagged and therefore must be listed as an allowed VLAN on the port.

Question 8FortiSwitch Deployment and Management

Which statement describes a FortiSwitch LAG (link aggregation group) configured from a FortiGate?

  1. It converts access ports into routed ports automatically
  2. It bundles multiple physical ports into one logical interface for increased bandwidth and redundancy Correct answer.
  3. It disables STP on all member ports permanently
  4. It assigns each member port a separate IP address for routing

Explanation

A LAG combines several physical links into a single logical link, providing aggregated throughput and link redundancy. Member ports must share compatible settings such as speed and VLAN configuration.

Question 9FortiSwitch Deployment and Management

Which Spanning Tree protocol variant should be selected on FortiSwitch when rapid convergence and per-VLAN instances are required in a mixed-vendor network?

  1. MSTP (802.1s) Correct answer.
  2. STP (802.1D)
  3. PVST+
  4. RSTP (802.1w)

Explanation

MSTP (802.1s) supports multiple spanning tree instances mapped to VLANs and converges rapidly, making it suitable for per-VLAN topologies across vendors. It is an IEEE standard interoperable with other vendors' switches.

Question 10FortiSwitch Deployment and Management

What does enabling STP edge (portfast) on a FortiSwitch port accomplish?

  1. It disables the port if a loop is detected
  2. It immediately places the port in forwarding state for end-station connections Correct answer.
  3. It blocks all BPDUs on the port permanently
  4. It forces the port into a trunk

Explanation

Edge/portfast ports skip the listening and learning delays and move directly to forwarding, which is appropriate for ports connected to end devices. The port still participates in loop detection if a BPDU is received.

Question 11FortiSwitch Deployment and Management

An administrator wants to prevent unauthorized devices from connecting to a FortiSwitch access port by requiring 802.1X authentication. Which component performs the actual authentication decision?

  1. The RADIUS server acting as authentication server Correct answer.
  2. The FortiSwitch acting as authenticator
  3. The supplicant on the endpoint
  4. The FortiGate acting as supplicant

Explanation

In 802.1X, the switch is the authenticator that relays credentials, while the RADIUS server is the authentication server that makes the accept or reject decision. The endpoint runs the supplicant.

Question 12FortiSwitch Deployment and Management

Which feature on a FortiSwitch port dynamically assigns a VLAN based on the authenticated user's RADIUS attributes?

  1. Dynamic VLAN assignment Correct answer.
  2. Private VLAN
  3. Voice VLAN
  4. Static native VLAN

Explanation

Dynamic VLAN assignment uses RADIUS attributes returned after successful 802.1X or MAC authentication to place the port into a specific VLAN. This lets user identity determine network segmentation.

Question 13FortiSwitch Deployment and Management

What is the role of a FortiSwitch in a FortiGate-managed network when using MCLAG?

  1. It replaces FortiLink with a standard LACP trunk
  2. It merges two FortiGates into one management domain
  3. It provides redundant switch pairs with a shared logical link for dual-homed servers Correct answer.
  4. It provides wireless controller functions

Explanation

MCLAG (multi-chassis LAG) lets two FortiSwitches act as a redundant pair so servers can dual-home without STP blocking. It provides link and device redundancy at the access layer.

Question 14FortiSwitch Deployment and Management

Which FortiGate feature allows a FortiSwitch port to be configured with a specific VLAN and then automatically placed in that VLAN when a device is detected?

  1. Dynamic ARP inspection
  2. LLDP-MED network policy Correct answer.
  3. DHCP snooping
  4. Storm control

Explanation

LLDP-MED network policies advertise VLAN and QoS settings to capable endpoints such as IP phones, which then tag their traffic accordingly. This automates voice VLAN assignment.

Question 15FortiSwitch Deployment and Management

Which statement about the FortiSwitch firmware upgrade process in a FortiLink deployment is correct?

  1. Firmware must be upgraded from FortiCloud directly
  2. Managed switches cannot be upgraded while authorized
  3. The FortiGate can push a firmware image to managed FortiSwitches Correct answer.
  4. Each FortiSwitch must be upgraded only via USB

Explanation

When managed by a FortiGate, FortiSwitch firmware images can be uploaded to the FortiGate and pushed to the switches over FortiLink. This centralizes firmware management across the switch fleet.

Question 16FortiSwitch Deployment and Management

An administrator needs to back up the configuration of a managed FortiSwitch. Where is the configuration typically stored and retrieved in a FortiLink deployment?

  1. Only on an external TFTP server
  2. Only on the switch's USB drive
  3. On the FortiGate, which stores the managed switch configuration Correct answer.
  4. Only in FortiCloud

Explanation

In a FortiLink deployment the FortiGate holds the configuration for managed switches and can display or back it up. This means restoring the FortiGate configuration also restores switch settings.

Question 17FortiSwitch Deployment and Management

Which command-line approach allows an administrator to view the current configuration of a standalone FortiSwitch?

  1. execute backup config
  2. diagnose switch physical-ports
  3. show full-configuration Correct answer.
  4. get system status

Explanation

On a FortiSwitch CLI, show full-configuration displays the complete running configuration. The other commands display status, port information, or perform a backup rather than showing the full config.

Question 18FortiSwitch Deployment and Management

A FortiSwitch port shows as 'down' after cabling to a server. Which troubleshooting step is most appropriate first?

  1. Reboot the FortiGate
  2. Delete the FortiLink interface
  3. Reset the switch to factory defaults
  4. Verify the port admin status and speed/duplex settings Correct answer.

Explanation

Checking whether the port is administratively enabled and whether speed and duplex match the attached device is the least disruptive first step. Link状态 issues are commonly caused by disabled ports or mismatched settings.

Question 19FortiSwitch Deployment and Management

Which FortiSwitch feature limits the rate of broadcast, multicast, and unknown unicast frames on a port to protect against flooding?

  1. Port mirroring
  2. Storm control Correct answer.
  3. Flow control
  4. Jumbo frame support

Explanation

Storm control sets thresholds for broadcast, multicast, and unknown unicast traffic and can drop or block excess frames. This protects the network from broadcast storms and loops.

Question 20FortiSwitch Deployment and Management

Which protocol should be enabled on FortiSwitch ports facing other switches to help detect and prevent Layer 2 loops in addition to STP?

  1. NTP
  2. Loop guard or BPDU guard Correct answer.
  3. DHCP relay
  4. SNMP

Explanation

Loop guard and BPDU guard help detect misconfigured or unidirectional links that could create loops, complementing STP. They act when BPDUs are unexpectedly received or missing.

Question 21FortiSwitch Deployment and Management

Which statement best describes how a FortiGate handles a FortiSwitch that is connected but not yet authorized?

  1. The switch is automatically configured with default VLANs
  2. The switch is converted to standalone mode automatically
  3. The switch appears as discovered and remains unmanaged until authorized Correct answer.
  4. The switch is blocked at Layer 2 and cannot pass any traffic

Explanation

Unauthorized FortiSwitches are discovered by the FortiGate but are not managed until an administrator authorizes them. Until then, the FortiGate does not push configuration to them.

Question 22FortiSwitch Deployment and Management

An administrator wants to isolate a group of ports so they can communicate only with an uplink port and not with each other. Which FortiSwitch feature should be used?

  1. Storm control
  2. MCLAG
  3. Private VLAN Correct answer.
  4. Voice VLAN

Explanation

Private VLANs isolate ports within the same VLAN so they can reach only designated uplink or promiscuous ports. This is useful for separating untrusted devices on a shared segment.

Question 23FortiSwitch Deployment and Management

Which setting on a FortiSwitch port determines whether it operates as an access port or a trunk port in a FortiLink deployment?

  1. The port's VLAN configuration (native and allowed VLANs) Correct answer.
  2. The port's description field
  3. The switch's hostname
  4. The port's LED status

Explanation

Whether a port behaves as access or trunk depends on its native VLAN and allowed VLAN list. An access port carries a single untagged VLAN, while a trunk carries multiple tagged VLANs.

Question 24FortiSwitch Deployment and Management

A FortiSwitch is managed by a FortiGate, and the administrator wants to see per-port traffic statistics. Which approach is correct?

  1. Check the FortiCloud portal
  2. Connect a console cable and run show full-configuration
  3. View the port statistics from the FortiGate's managed switch monitor Correct answer.
  4. Run execute backup config on the switch

Explanation

The FortiGate provides monitoring views for managed FortiSwitches, including per-port traffic and status. This avoids needing to connect directly to each switch.

Question 25FortiSwitch Deployment and Management

Which consideration is most important when planning a FortiLink deployment for a large campus with multiple wiring closets?

  1. Disabling all VLANs to simplify management
  2. Avoiding firmware consistency across switches
  3. Designing the FortiLink topology and switch stacking or MCLAG for redundancy Correct answer.
  4. Using only standalone mode for all switches

Explanation

A large deployment needs a clear FortiLink topology, redundancy through stacking or MCLAG, and consistent firmware to avoid outages. These design choices determine resilience and manageability.

Question 26FortiSwitch Deployment and Management

Which interface on a FortiGate is dedicated to managing FortiSwitch units through the FortiLink protocol?

  1. A redundant interface paired with a WAN port
  2. A software switch bound to the internal hardware switch
  3. A VLAN sub-interface carrying the management VLAN only
  4. A physical or logical interface configured with the fortilink role Correct answer.

Explanation

FortiLink is enabled by assigning the fortilink role to a FortiGate interface, which can be a physical port or a logical aggregate. Once the role is set, the FortiGate runs the FortiLink discovery and management protocol over that interface toward the FortiSwitch. Other interface types do not carry the FortiLink management channel.

Question 27FortiSwitch Deployment and Management

What does the FortiGate do when a FortiSwitch is first discovered on a fortilink interface and the administrator has enabled automatic authorization?

  1. It reboots the switch into standalone mode
  2. It authorizes the switch and pushes a default configuration Correct answer.
  3. It converts the switch into a FortiAP controller
  4. It blocks all switch ports until a manual approval is given

Explanation

With auto-authorization enabled, a newly discovered FortiSwitch is authorized without manual intervention and receives the FortiGate-managed configuration. This is the default behavior in many FortiLink setups and simplifies onboarding of new units. Manual authorization is the alternative when auto-authorization is disabled.

Question 28FortiSwitch Deployment and Management

Which FortiGate configuration object holds the per-switch settings, such as port profiles and VLAN assignments, that are pushed to a managed FortiSwitch?

  1. The managed-switch configuration entry Correct answer.
  2. The router static route entry
  3. The system dhcp server entry
  4. The wireless-controller wtp entry

Explanation

Each authorized FortiSwitch appears as a managed-switch object on the FortiGate, and port-level settings are defined within it. The FortiGate translates those settings into the configuration pushed to the switch. Other object types serve unrelated functions.

Question 29FortiSwitch Deployment and Management

An administrator wants a managed FortiSwitch to obtain its management IP address from the FortiGate DHCP server on the fortilink interface. Which setting on the FortiGate makes this happen automatically?

  1. Disabling the administrative access on the interface
  2. Configuring a DHCP server on the fortilink interface Correct answer.
  3. Enabling captive portal on the fortilink interface
  4. Setting the fortilink interface as a WAN zone member

Explanation

When a DHCP server is configured on the fortilink interface, managed FortiSwitch units receive management addresses from it automatically. This is the standard way to provide reachability for switch management. The other settings do not supply addresses to switches.

Question 30FortiSwitch Deployment and Management

Which FortiGate feature lets an administrator apply the same port configuration to many managed FortiSwitch ports without editing each port individually?

  1. A static route with multiple next hops
  2. A port profile assigned to the ports Correct answer.
  3. An IPsec phase 1 with multiple proposals
  4. A DHCP reservation per port

Explanation

Port profiles bundle settings such as VLAN membership, STP options, and security features so they can be applied consistently across many ports. This reduces configuration drift in large deployments. The other features are unrelated to switch port provisioning.

Question 31FortiSwitch Deployment and Management

In a FortiLink deployment, which protocol does the FortiGate use to discover FortiSwitch units on the fortilink interface?

  1. RADIUS accounting requests
  2. LLDP only
  3. The FortiLink discovery protocol over the fortilink interface Correct answer.
  4. CDP relayed from Cisco neighbors

Explanation

The FortiGate runs a dedicated discovery mechanism on the fortilink interface to detect FortiSwitch units and establish management. LLDP may be present for topology but is not the management discovery channel. The other protocols serve different purposes.

Question 32FortiSwitch Deployment and Management

Which FortiGate CLI command displays the list of FortiSwitch units currently authorized and managed through FortiLink?

  1. get switch-controller managed-switch Correct answer.
  2. show system interface fortilink
  3. diagnose ip arp list
  4. diagnose switch physical-ports list

Explanation

The switch-controller managed-switch configuration node lists the switches the FortiGate manages, including their serial numbers and status. Administrators use it to confirm which units are authorized. The other commands show ports, interface settings, or ARP entries rather than the managed switch inventory.

Question 33FortiSwitch Deployment and Management

What is the effect of assigning a FortiSwitch port the 'fortilink' role in a FortiGate-managed topology?

  1. The port becomes an uplink toward the managing FortiGate Correct answer.
  2. The port is converted to a mirrored span destination
  3. The port is disabled until a device authenticates
  4. The port is reserved for out-of-band console access

Explanation

A port with the fortilink role is used as the uplink that connects the FortiSwitch to the managing FortiGate. This carries both management traffic and user VLANs depending on configuration. The other roles describe unrelated port functions.

Question 34FortiSwitch Deployment and Management

An administrator has two FortiSwitch units connected to the same FortiGate fortilink interface and wants them to appear as a single logical switch for management. Which FortiGate construct should be used?

  1. A VRRP group on the fortilink interface
  2. A static route per switch
  3. A FortiLink aggregate switch Correct answer.
  4. A redundant interface on each switch

Explanation

An aggregate (or stacked) FortiLink configuration groups multiple FortiSwitch units so they are managed as one logical entity, simplifying port naming and configuration. This is distinct from a LAG, which bundles physical links. The other options do not provide unified switch management.

Question 35FortiSwitch Deployment and Management

After authorizing a FortiSwitch, an administrator notices the switch is reachable but port changes made on the FortiGate are not taking effect. Which action is most appropriate to investigate?

  1. Verify the switch configuration synchronization status and re-push the configuration Correct answer.
  2. Disable STP globally on the FortiGate
  3. Replace the fiber patch cable between the switches
  4. Reboot the FortiGate into maintenance mode

Explanation

When a managed switch is authorized but not receiving changes, the configuration synchronization state between the FortiGate and switch should be checked, and the configuration can be re-pushed. This isolates a control-plane sync issue from a physical or spanning-tree problem. The other actions do not address configuration delivery.

Question 36FortiSwitch Deployment and Management

Which FortiGate setting determines whether a newly discovered FortiSwitch is automatically authorized or must be approved manually?

  1. The DHCP lease time on the fortilink interface
  2. The administrative timeout on the switch profile
  3. The LLDP transmit interval
  4. The auto-authorization setting under the switch controller Correct answer.

Explanation

The switch controller includes an auto-authorization option that, when enabled, approves new FortiSwitch units without administrator action. Disabling it forces manual approval of each discovered switch. The other settings affect addressing, session timeouts, or neighbor discovery, not authorization.

Question 37FortiSwitch Deployment and Management

An administrator wants to manage a FortiSwitch from a FortiGate but keep the switch on a separate management VLAN from user traffic. Which approach best accomplishes this?

  1. Move all user VLANs onto the fortilink native VLAN
  2. Disable the fortilink role and use standalone management
  3. Configure the fortilink interface with a dedicated management VLAN and assign switch management to it Correct answer.
  4. Enable DHCP snooping on every user port

Explanation

Using a dedicated management VLAN on the fortilink interface separates switch management traffic from user data. The FortiGate assigns management addresses on that VLAN while user VLANs remain distinct. The other approaches either remove centralized management or blur the separation.

Question 38FortiSwitch Deployment and Management

Which statement describes how a FortiGate handles firmware images for managed FortiSwitch units?

  1. The FortiGate stores approved firmware images and can push upgrades to managed switches Correct answer.
  2. Firmware is upgraded only through a USB drive inserted into the switch
  3. Each switch must download firmware directly from the internet without FortiGate involvement
  4. Firmware version is fixed at manufacture and cannot be changed

Explanation

In a FortiLink deployment the FortiGate can hold FortiSwitch firmware images and orchestrate upgrades across managed units. This centralizes version control and reduces manual steps. The other statements misrepresent how firmware distribution works.

Question 39FortiSwitch Deployment and Management

An administrator plans to deploy many FortiSwitch units across several buildings connected to one FortiGate. Which design consideration most affects FortiLink scalability?

  1. The color coding of patch cables in each building
  2. The choice of desktop wallpaper on management stations
  3. The number of unused USB ports on the FortiGate
  4. The number of switches and hops supported per fortilink interface and the use of aggregate configurations Correct answer.

Explanation

FortiLink scalability depends on how many switches and cascaded hops a fortilink interface can support, and aggregate configurations help organize large numbers of units. These factors determine whether the design meets platform limits. The other items have no bearing on FortiLink capacity.

Question 40FortiSwitch Deployment and Management

Which FortiGate action is required before per-port settings can be configured on a newly discovered FortiSwitch?

  1. The switch must be assigned a public IP address
  2. The switch must be converted to a FortiAP
  3. The switch must be authorized in the switch controller Correct answer.
  4. The switch must be added to a WAN zone

Explanation

Per-port configuration is available only after the FortiSwitch is authorized and managed by the FortiGate. Authorization establishes the management relationship that allows configuration push. Public addressing, wireless conversion, and WAN zoning are unrelated requirements.

Question 41FortiSwitch Deployment and Management

An administrator wants to confirm which VLANs a managed FortiSwitch port is currently a member of. Which FortiGate view is most direct?

  1. The FortiGate routing table
  2. The antivirus profile list
  3. The managed switch port configuration and status in the switch controller Correct answer.
  4. The IPsec tunnel list

Explanation

The switch controller shows each managed switch port's configuration, including VLAN membership, and its current status. This is the direct place to verify port VLANs. Routing, IPsec, and antivirus views do not describe switch port VLAN membership.

Question 42FortiSwitch Deployment and Management

Which FortiGate mechanism distributes configuration to multiple managed FortiSwitch units so that identical port settings remain consistent?

  1. Per-switch manual CLI sessions on each unit
  2. Static ARP entries on the FortiGate
  3. OSPF area assignments
  4. Global switch controller settings combined with port profiles Correct answer.

Explanation

Global switch controller settings and port profiles let administrators define consistent configuration that is applied across managed switches. This avoids configuring each unit individually. Manual CLI sessions, static ARP, and OSPF areas do not provide centralized consistent port provisioning.

Question 43FortiSwitch Deployment and Management

A FortiSwitch connected to a FortiGate fortilink interface shows as unauthorized. What is the most likely cause?

  1. Auto-authorization is disabled and no administrator has approved the switch Correct answer.
  2. The switch uplink is a copper cable
  3. The fortilink interface has a DHCP server configured
  4. The switch is running a supported firmware version

Explanation

An unauthorized state typically means the switch has been discovered but not approved, which occurs when auto-authorization is disabled and manual approval has not happened. Supported firmware, DHCP configuration, and cable type do not by themselves prevent authorization. Approving the switch resolves the state.

Question 44FortiSwitch Deployment and Management

Which FortiGate CLI command is useful for viewing the current status of a specific managed FortiSwitch, including its connection state?

  1. diagnose switch-controller switch status Correct answer.
  2. diagnose hardware deviceinfo disk
  3. get system performance status
  4. show router bgp summary

Explanation

Switch controller diagnostics expose the connection and management state of managed FortiSwitch units. This helps confirm whether a switch is connected and synchronized. The other commands report routing, storage, or system performance rather than switch status.

Question 45FortiSwitch Deployment and Management

An administrator needs to replace a failed managed FortiSwitch with an identical model. Which step ensures the replacement inherits the same port configuration?

  1. Disable the fortilink role on the FortiGate
  2. Assign the replacement a new public IP address
  3. Convert the replacement to standalone mode
  4. Authorize the replacement and, if needed, map it to the existing managed-switch entry or reapply the port profile Correct answer.

Explanation

Replacing a switch requires authorizing the new unit and ensuring its configuration matches the intended managed-switch settings, often by reapplying the port profile or mapping the serial number. Public addressing, standalone mode, and disabling FortiLink do not preserve managed configuration. This keeps port settings consistent after replacement.

Question 46FortiSwitch Deployment and Management

When planning a FortiLink topology with cascaded FortiSwitch units, what is the primary reason to limit the number of cascade hops?

  1. To stay within supported hop limits and avoid management or convergence problems Correct answer.
  2. To reduce the number of VLANs that can be created
  3. To prevent the FortiGate from assigning DHCP addresses
  4. To ensure each switch uses a unique firmware build

Explanation

Cascaded FortiSwitch topologies have supported hop limits, and exceeding them can cause management instability or slow convergence. Designing within those limits keeps the FortiLink domain reliable. VLAN counts, firmware uniqueness, and DHCP are not the reason for hop limits.

Question 47FortiSwitch Deployment and Management

An administrator observes that a managed FortiSwitch repeatedly loses and re-establishes its FortiLink management session. Which factor is most likely to cause this behavior?

  1. A port profile with STP edge enabled
  2. An unstable uplink or an IP address conflict on the management network Correct answer.
  3. The use of a copper rather than fiber uplink
  4. A DHCP lease time set to several days

Explanation

Flapping management sessions usually point to link instability or an address conflict that prevents stable reachability. STP edge settings, long lease times, and cable media choice do not by themselves cause repeated session loss. Stabilizing the uplink and resolving conflicts restores a steady session.

Question 48FortiSwitch Deployment and Management

Which approach best ensures that a FortiSwitch firmware upgrade across many managed units completes predictably during a maintenance window?

  1. Upgrade every switch simultaneously and ignore uplink capacity
  2. Stage the approved firmware on the FortiGate and schedule upgrades in controlled batches Correct answer.
  3. Disable FortiLink during the upgrade to speed it up
  4. Rely on each switch to fetch firmware from the internet at random times

Explanation

Staging firmware on the FortiGate and upgrading in controlled batches limits disruption and keeps the process predictable. Simultaneous upgrades stress uplinks and increase risk, random internet fetches are not the managed model, and disabling FortiLink removes the management channel needed for the upgrade.

Question 49FortiSwitch Deployment and Management

A company needs FortiSwitch management to survive the failure of a single FortiGate in an HA pair. Which design element is most relevant?

  1. Disabling switch authorization so any FortiGate can manage the switch
  2. Using standalone mode on all switches
  3. Connecting each switch to both FortiGates with a single non-redundant cable
  4. Configuring FortiLink on interfaces that follow the HA failover so the surviving FortiGate manages the switches Correct answer.

Explanation

In an HA pair, FortiLink must be configured so the management interface and switch controller state follow the active unit during failover. This keeps managed switches under control of the surviving FortiGate. Single cables, disabled authorization, and standalone mode do not provide resilient centralized management.

Question 50FortiSwitch Deployment and Management

Which statement accurately describes how a FortiGate represents a managed FortiSwitch's serial number in the switch controller?

  1. The serial number is generated randomly each boot
  2. The serial number identifies the managed-switch entry and is used to authorize the unit Correct answer.
  3. The serial number is the same as the management IP address
  4. The serial number is used only for licensing FortiAPs

Explanation

The FortiSwitch serial number is the unique identifier in the managed-switch entry and is used during authorization. It distinguishes units even when addressing changes. It is not a license artifact, a random value, or an IP address.