I85PREP
⌘ K
FCSS LAN Edge 7.6 study materials
FCSS LAN Edge 7.6 study resources

FCSS LAN Edge 7.6 practice questions

One question at a time. Build your FCSS LAN Edge 7.6 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1LAN Edge fundamentals and FortiOS 7.6 administration

In FortiOS 7.6, which CLI command displays the current configuration of a managed FortiSwitch port from the FortiGate?

  1. config switch-controller managed-switch
  2. show switch-controller managed-switch port-config Correct answer.
  3. diagnose switch-controller dump port
  4. get switch-controller port status

Explanation

The switch-controller tree holds FortiGate-side configuration for managed FortiSwitches, and show prints the running configuration for the selected object. Port-level settings such as VLAN assignment and STP state live under managed-switch port-config. The other commands are not valid syntax for reading that configuration.

Question 2LAN Edge fundamentals and FortiOS 7.6 administration

A FortiGate administers several FortiSwitches in a single switch-controller topology. Which statement describes the role of the FortiGate in this design?

  1. It requires each FortiSwitch to run a full routing protocol instance.
  2. It operates only as an SNMP trap receiver for the switches.
  3. It acts as the central management and control plane for the managed switches. Correct answer.
  4. It forwards all inter-switch traffic through a dedicated hardware stacking bus.

Explanation

In a FortiLink topology the FortiGate is the controller: it provisions VLANs, ports, and policies on the managed FortiSwitches and receives their status. The switches remain Layer 2 forwarding devices managed over the FortiLink interface. No stacking bus or routing protocol is required on each switch.

Question 3LAN Edge fundamentals and FortiOS 7.6 administration

Which interface type must be configured on a FortiGate before it can authorize and manage FortiSwitch units?

  1. A redundant IPsec tunnel
  2. A loopback interface
  3. A 6to4 tunnel interface
  4. A FortiLink interface Correct answer.

Explanation

FortiLink is the dedicated management channel between the FortiGate and managed FortiSwitches. It is created by enabling FortiLink on a physical or aggregate interface and is used for authorization, provisioning, and status collection. Other interface types cannot carry the FortiLink control traffic.

Question 4LAN Edge fundamentals and FortiOS 7.6 administration

What is the purpose of the FortiGate DHCP server on a FortiLink VLAN?

  1. It provides certificates for 802.1X supplicants.
  2. It distributes routing tables to neighboring Layer 3 switches.
  3. It assigns IP addresses to endpoints connected to ports that carry that VLAN. Correct answer.
  4. It assigns management addresses to the FortiSwitch units themselves.

Explanation

Each VLAN extended to the FortiSwitch carries a subnet whose gateway is the FortiGate; the DHCP server on that VLAN leases addresses to attached hosts. Switch management addressing is handled separately through the switch-controller configuration. DHCP does not distribute routes or certificates.

Question 5LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate feature lets an administrator apply a security profile to traffic between two hosts on the same managed FortiSwitch VLAN?

  1. 802.1Q trunking on the uplink
  2. Intra-VLAN blocking with a firewall policy on the FortiLink interface Correct answer.
  3. LLDP profile assignment
  4. STP root guard on the FortiGate

Explanation

By default, same-subnet traffic on a managed FortiSwitch is switched locally and bypasses the FortiGate. Enabling intra-VLAN blocking forces that traffic up the FortiLink so a firewall policy and its security profiles can inspect it. Trunking, STP, and LLDP affect topology and discovery, not inspection.

Question 6LAN Edge fundamentals and FortiOS 7.6 administration

An administrator wants FortiSwitch ports to authenticate wired users against a RADIUS server before granting network access. Which configuration is required?

  1. Enable LLDP-MED on every access port.
  2. Configure a static ARP entry for each wired client.
  3. Enable DHCP snooping on the FortiLink interface.
  4. Enable 802.1X on the managed switch ports and define the RADIUS server on the FortiGate. Correct answer.

Explanation

Wired 802.1X authentication requires the supplicant to be challenged at the switch port and the credentials validated by a RADIUS server reachable from the FortiGate. The FortiGate acts as the authenticator proxy for managed FortiSwitches. The other features affect learning and discovery, not access control.

Question 7LAN Edge fundamentals and FortiOS 7.6 administration

Which spanning-tree mode allows a managed FortiSwitch to participate in multiple spanning-tree instances mapped to VLANs?

  1. STP
  2. MSTP Correct answer.
  3. PVST+
  4. RSTP

Explanation

Multiple Spanning Tree Protocol groups VLANs into instances, giving independent topologies and faster convergence than a single instance. FortiSwitch supports MSTP alongside RSTP. Classic STP is the older single-instance protocol, and PVST+ is a Cisco proprietary variant.

Question 8LAN Edge fundamentals and FortiOS 7.6 administration

A FortiSwitch port is connected to a workstation that must be placed in VLAN 20 while the uplink carries several VLANs. Which port configuration accomplishes this?

  1. Disable STP on both the access port and the uplink.
  2. Assign the access port to VLAN 20 and configure the uplink as a trunk carrying VLAN 20. Correct answer.
  3. Assign the access port as a trunk and the uplink as an access port in VLAN 20.
  4. Enable intra-VLAN blocking on the access port.

Explanation

An access port carries a single untagged VLAN to the endpoint, while the uplink must be a trunk that tags and forwards that VLAN toward the FortiGate. Reversing the roles would break VLAN separation. STP and intra-VLAN blocking do not affect VLAN membership.

Question 9LAN Edge fundamentals and FortiOS 7.6 administration

Which protocol should be enabled to prevent a rogue device from becoming the spanning-tree root on the FortiSwitch network?

  1. UDLD
  2. BPDU guard
  3. Root guard Correct answer.
  4. Loop guard

Explanation

Root guard keeps a port from accepting superior BPDUs, so an attached device cannot take over the root role. BPDU guard instead errs down a port that receives any BPDU, which is used on edge ports. Loop guard and UDLD address different failure modes.

Question 10LAN Edge fundamentals and FortiOS 7.6 administration

What does the FortiGate use to identify and authorize a newly connected FortiSwitch on the FortiLink interface?

  1. The switch serial number recorded during authorization Correct answer.
  2. The switch's DHCP lease time
  3. The switch's STP bridge priority
  4. The switch's LLDP chassis ID

Explanation

FortiSwitch authorization on FortiLink is based on the unit's serial number, which the administrator confirms before the switch is managed. Once authorized, the FortiGate can push configuration to it. DHCP, LLDP, and STP values are not used for authorization.

Question 11LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate interface setting is required for a FortiSwitch to receive its VLAN and port configuration automatically?

  1. The FortiLink interface must be enabled and the switch authorized. Correct answer.
  2. The FortiLink interface must be a member of a zone.
  3. The FortiLink interface must have a /32 address.
  4. The FortiLink interface must be in DHCP client mode.

Explanation

Automatic provisioning depends on an enabled FortiLink interface and an authorized switch; the FortiGate then pushes the switch-controller configuration. Address mode, prefix length, and zone membership do not control provisioning. A /32 would in fact prevent the interface from serving its VLAN subnets.

Question 12LAN Edge fundamentals and FortiOS 7.6 administration

Which statement about FortiSwitch standalone mode is accurate?

  1. The switch can only be managed through FortiCloud.
  2. The switch forwards no traffic until a FortiGate authorizes it.
  3. The switch is configured locally and is not managed by a FortiGate. Correct answer.
  4. The switch requires a FortiLink interface to boot.

Explanation

A FortiSwitch in standalone mode is administered through its own CLI or GUI and performs switching independently of a FortiGate. It can later be converted to managed mode. It does not require FortiLink to boot or forward traffic.

Question 13LAN Edge fundamentals and FortiOS 7.6 administration

An administrator configures a FortiSwitch port as a mirror source and a second port as the mirror destination. What is the effect?

  1. All VLANs are blocked on both ports.
  2. The source port is converted to a trunk.
  3. Traffic on the destination port is copied to the source port.
  4. Traffic on the source port is copied to the destination port for analysis. Correct answer.

Explanation

Port mirroring copies frames from a designated source to a destination where a capture or analysis device is attached. The direction is one way, from source to destination. Mirroring does not alter VLAN membership or port mode.

Question 14LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate feature provides a single logical FortiLink interface built from multiple physical links for redundancy and increased bandwidth?

  1. A loopback interface
  2. A VLAN sub-interface
  3. A redundant IPsec tunnel
  4. A FortiLink aggregate interface Correct answer.

Explanation

An aggregate interface bundles several physical links into one logical FortiLink channel, providing link redundancy and combined throughput. A VLAN sub-interface only adds tagging, and a loopback is local to the FortiGate. IPsec is unrelated to switch management.

Question 15LAN Edge fundamentals and FortiOS 7.6 administration

What is the primary function of the switch-controller VLAN definition on the FortiGate?

  1. It encrypts traffic between the FortiGate and the FortiSwitch.
  2. It assigns a serial number to each FortiSwitch.
  3. It defines a VLAN that can be assigned to managed FortiSwitch ports and the FortiLink interface. Correct answer.
  4. It creates a routing instance for each managed switch.

Explanation

Switch-controller VLANs define the VLAN ID and its interface so the same VLAN can be extended to managed FortiSwitch ports over FortiLink. They do not create routing instances or encrypt the link, and serial numbers are hardware identifiers.

Question 16LAN Edge fundamentals and FortiOS 7.6 administration

Which protocol allows a FortiSwitch to advertise its identity, port, and VLAN information to neighboring devices?

  1. LLDP Correct answer.
  2. DHCP
  3. LACP
  4. STP

Explanation

LLDP is a neighbor-discovery protocol that advertises device identity, port, and VLAN information to directly connected peers. LACP bundles links, STP prevents loops, and DHCP assigns addresses. LLDP information can be used for topology mapping and voice VLAN assignment.

Question 17LAN Edge fundamentals and FortiOS 7.6 administration

A voice endpoint must receive a VLAN ID automatically through LLDP-MED. Which configuration supports this?

  1. An LLDP profile with voice VLAN advertising applied to the access port Correct answer.
  2. A BPDU filter on the access port
  3. A static route to the voice subnet
  4. A DHCP option that carries the switch serial number

Explanation

An LLDP profile configured to advertise the voice VLAN lets an LLDP-MED phone learn its VLAN automatically and tag its traffic accordingly. DHCP options, static routes, and BPDU filters do not deliver VLAN information. This simplifies moves and changes for voice deployments.

Question 18LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate action is required before a FortiSwitch detected on FortiLink can be managed?

  1. Assigning the switch a static IP address
  2. Authorizing the switch by its serial number Correct answer.
  3. Creating a firewall policy for the switch
  4. Enabling NAT on the FortiLink interface

Explanation

A detected FortiSwitch remains unauthorized until an administrator confirms its serial number. Authorization establishes trust and allows the FortiGate to push configuration. Address assignment, firewall policy, and NAT are separate concerns.

Question 19LAN Edge fundamentals and FortiOS 7.6 administration

An administrator wants to limit which VLANs a FortiSwitch port can carry when it is configured as a trunk. Which setting controls this?

  1. The DHCP lease time for the VLAN
  2. The LLDP transmit interval
  3. The allowed VLAN list on the trunk port Correct answer.
  4. The STP priority of the port

Explanation

A trunk port forwards only the VLANs permitted by its allowed VLAN list, which limits broadcast domains and improves security. STP priority influences topology, and DHCP and LLDP timers are unrelated to VLAN membership.

Question 20LAN Edge fundamentals and FortiOS 7.6 administration

Which statement describes the default behavior of a FortiSwitch access port that has not been assigned a VLAN?

  1. It drops all frames until a VLAN is assigned.
  2. It forwards all VLANs in the trunk allowed list.
  3. It automatically becomes a trunk port.
  4. It uses the native VLAN configured for the switch. Correct answer.

Explanation

An access port without an explicit VLAN assignment falls back to the switch's native VLAN, which is typically VLAN 1. It does not become a trunk or silently drop all traffic. Administrators normally assign an explicit access VLAN for segmentation.

Question 21LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate object maps a RADIUS server to wired 802.1X authentication for managed FortiSwitches?

  1. A DNS forwarder entry
  2. A user RADIUS object referenced by the switch-controller 802.1X settings Correct answer.
  3. An IPsec phase 2 selector
  4. A virtual IP object

Explanation

Wired 802.1X uses a RADIUS user object that the switch-controller settings reference for authentication. The FortiGate proxies requests from the switch port to that server. IPsec selectors, virtual IPs, and DNS entries do not authenticate supplicants.

Question 22LAN Edge fundamentals and FortiOS 7.6 administration

A network engineer needs to inspect traffic between two hosts on the same VLAN attached to one FortiSwitch. Which setting must be enabled to force that traffic through the FortiGate?

  1. Intra-VLAN blocking on the managed switch Correct answer.
  2. LACP on the FortiLink aggregate
  3. STP root guard on the uplink
  4. DHCP snooping on the FortiLink interface

Explanation

Intra-VLAN blocking prevents the managed switch from shortcutting same-VLAN traffic locally, so frames are sent to the FortiGate for policy enforcement. DHCP snooping, root guard, and LACP address other concerns and do not redirect flows. This is essential when security profiles must apply to peer-to-peer traffic.

Question 23LAN Edge fundamentals and FortiOS 7.6 administration

Which command output on the FortiGate confirms the operational state of a managed FortiSwitch?

  1. config system interface
  2. execute ping-options
  3. show full-configuration
  4. diagnose switch-controller status Correct answer.

Explanation

The diagnose switch-controller status command reports the connection and operational state of managed FortiSwitches. The other commands either edit or display interface configuration, or set ping parameters, and none report switch state.

Question 24LAN Edge fundamentals and FortiOS 7.6 administration

An administrator notices that a newly cabled FortiSwitch appears as detected but not managed. What is the most likely cause?

  1. The switch serial number has not been authorized on the FortiGate. Correct answer.
  2. The access ports are assigned to VLAN 1.
  3. The FortiLink interface is configured as a trunk.
  4. The switch is running MSTP.

Explanation

Detected-but-unmanaged state means the FortiGate sees the switch on FortiLink but has not confirmed its serial number. Authorization is the required step before configuration is pushed. Trunking, MSTP, and VLAN 1 assignment do not block management.

Question 25LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiSwitch feature prevents a loop from forming when two access ports on the same switch are accidentally cabled together?

  1. LLDP-MED
  2. DHCP relay
  3. Port mirroring
  4. Spanning tree with loop protection Correct answer.

Explanation

Spanning tree detects the redundant path and blocks one port to keep the topology loop-free, while loop protection adds safeguards against loops on edge ports. LLDP-MED advertises capabilities, DHCP relay forwards requests, and mirroring copies traffic.

Question 26LAN Edge fundamentals and FortiOS 7.6 administration

On a FortiGate running FortiOS 7.6, which interface role must be assigned to the port that connects to a managed FortiSwitch so that the switch-controller functions become available?

  1. DMZ
  2. LAN
  3. WAN
  4. FortiLink Correct answer.

Explanation

The FortiLink role is what enables the FortiGate to act as switch controller and push configuration to attached FortiSwitches. Without that role the FortiGate treats the port as an ordinary routed or switched interface and no switch management occurs.

Question 27LAN Edge fundamentals and FortiOS 7.6 administration

Which statement describes how a FortiGate running FortiOS 7.6 handles a FortiSwitch that is physically connected to the FortiLink interface but has never been authorized?

  1. The FortiGate lists the switch as detected and waits for an administrator to authorize it. Correct answer.
  2. The FortiGate blocks all traffic on the port until the switch is factory reset.
  3. The FortiGate converts the port into a routed interface and ignores the switch.
  4. The FortiGate immediately pushes the full switch configuration and manages the device.

Explanation

Newly discovered FortiSwitches appear in the detected list and remain unmanaged until an administrator explicitly authorizes them. This safeguard prevents an unknown device from silently receiving the managed switch configuration.

Question 28LAN Edge fundamentals and FortiOS 7.6 administration

An administrator wants to see which FortiSwitches are currently managed by the FortiGate and their serial numbers. Which FortiOS CLI command provides this overview?

  1. show switch-controller managed-switch Correct answer.
  2. get system interface physical
  3. diagnose switch-controller status
  4. diagnose switch physical-ports summary

Explanation

The managed-switch configuration table lists every FortiSwitch the FortiGate has authorized, along with serial number and management details. Operational link data lives in separate diagnose commands, but the managed inventory comes from this configuration branch.

Question 29LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiSwitch port mode should be configured when the attached device is a plain workstation that sends untagged frames and must be placed in a single VLAN?

  1. Mirror
  2. Trunk
  3. Access Correct answer.
  4. RSPAN

Explanation

An access port accepts untagged traffic and internally associates it with one native VLAN, which suits an ordinary workstation. Trunk ports are used when multiple VLAN tags must traverse the link.

Question 30LAN Edge fundamentals and FortiOS 7.6 administration

Which spanning-tree variant is the default on managed FortiSwitches and interoperates with standard IEEE 802.1D and 802.1w bridges?

  1. Multiple Spanning Tree Protocol
  2. Rapid Spanning Tree Protocol Correct answer.
  3. Spanning Tree Protocol disabled by default
  4. Per-VLAN Spanning Tree Plus

Explanation

FortiSwitches default to Rapid Spanning Tree Protocol, the IEEE 802.1w standard that converges faster than legacy STP while remaining backward compatible. MSTP must be explicitly configured when per-instance VLAN mapping is required.

Question 31LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate object is used to define the VLANs that managed FortiSwitches will carry, so that the same definitions are pushed to every authorized switch?

  1. A static route entry
  2. An IPsec phase 1 proposal
  3. A switch-controller VLAN definition Correct answer.
  4. A firewall address object

Explanation

Switch-controller VLAN definitions on the FortiGate are the source of truth for VLANs distributed to managed FortiSwitches. Ports on the switches then reference these VLANs by name when they are configured as members.

Question 32LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate feature lets an administrator group several physical FortiLink-capable ports into one logical interface so that a FortiSwitch uplink survives a single cable failure?

  1. A redundant interface
  2. A hardware switch
  3. A zone
  4. A FortiLink LAG Correct answer.

Explanation

A FortiLink link aggregation group bundles multiple physical links into one logical FortiLink interface, providing redundancy and added bandwidth toward the FortiSwitch. The FortiSwitch side must be configured with a matching aggregate.

Question 33LAN Edge fundamentals and FortiOS 7.6 administration

In FortiOS 7.6, which protocol does a managed FortiSwitch use to advertise its identity, management address, and capabilities to the FortiGate over FortiLink?

  1. DHCP
  2. LLDP Correct answer.
  3. STP
  4. CDP

Explanation

FortiSwitches use LLDP to advertise chassis identity and management information, which the FortiGate uses during discovery on the FortiLink interface. This is why LLDP must remain enabled on the FortiLink path.

Question 34LAN Edge fundamentals and FortiOS 7.6 administration

An administrator needs to inspect traffic between two hosts that sit on the same VLAN on one FortiSwitch. Which configuration copies the frames from the monitored port to an analysis tool?

  1. Enable STP root guard on both ports.
  2. Configure both ports as access ports in the same VLAN.
  3. Configure a trunk between the two ports.
  4. Set the monitored port as a mirror source and the analysis port as the mirror destination. Correct answer.

Explanation

Port mirroring copies frames from a designated source port to a destination port where a capture device is attached. Because the traffic stays within the switch, only mirroring exposes it to an external analyzer.

Question 35LAN Edge fundamentals and FortiOS 7.6 administration

A FortiSwitch port must carry VLAN 10, VLAN 20, and VLAN 30 to a downstream switch. Which port configuration accomplishes this?

  1. An access port with native VLAN 10 only.
  2. A mirror destination port with all three VLANs.
  3. An access port with native VLAN 10 and VLAN 20.
  4. A trunk port with all three VLANs as allowed members. Correct answer.

Explanation

A trunk port forwards frames for every VLAN in its allowed member list, keeping the 802.1Q tags intact across the link. Access ports can only map untagged traffic to one VLAN and cannot carry several tagged VLANs.

Question 36LAN Edge fundamentals and FortiOS 7.6 administration

Which statement accurately describes a FortiSwitch operating in standalone mode?

  1. It requires a FortiManager license to boot.
  2. It can only forward traffic on VLAN 1.
  3. It is configured locally through its own GUI or CLI without FortiGate switch-controller provisioning. Correct answer.
  4. It is fully managed by a FortiGate over FortiLink.

Explanation

In standalone mode the FortiSwitch is administered directly and receives no configuration from a FortiGate. Moving to managed mode later requires authorizing the device on the FortiLink interface.

Question 37LAN Edge fundamentals and FortiOS 7.6 administration

An administrator wants to prevent an unauthorized switch from becoming the spanning-tree root when it is plugged into a FortiSwitch access port. Which feature should be enabled on that port?

  1. BPDU guard
  2. Loop guard
  3. Flood guard
  4. Root guard Correct answer.

Explanation

Root guard keeps a port from accepting superior BPDUs, so a newly attached device cannot take over as the spanning-tree root. BPDU guard instead errs the port down when any BPDU arrives, which is a different protection.

Question 38LAN Edge fundamentals and FortiOS 7.6 administration

A FortiSwitch port connects to an IP phone that must learn its voice VLAN automatically through LLDP-MED. Which configuration is required on the FortiSwitch port?

  1. Disable LLDP and rely on DHCP option 43.
  2. Enable LLDP profile assignment with a voice VLAN and set the port as a member of that VLAN. Correct answer.
  3. Configure the port as a mirror source.
  4. Enable root guard and BPDU guard together.

Explanation

LLDP-MED conveys the voice VLAN to the endpoint through a network policy TLV, so the port needs an LLDP profile that advertises the voice VLAN and must also be a member of it. Without the VLAN membership the phone learns the VLAN but cannot pass tagged voice traffic.

Question 39LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiGate setting must be configured so that wired 802.1X users on managed FortiSwitch ports are authenticated against a RADIUS server?

  1. An IPsec phase 2 selector for the user VLAN.
  2. A switch-controller 802.1X object referencing a RADIUS server, applied to the switch ports. Correct answer.
  3. A firewall authentication rule with a local user group.
  4. A DHCP relay entry pointing to the RADIUS server.

Explanation

Wired 802.1X on managed FortiSwitches is driven by a switch-controller 802.1X configuration that names the RADIUS server and is bound to the relevant ports. The FortiGate then acts as the authenticator for the wired supplicants.

Question 40LAN Edge fundamentals and FortiOS 7.6 administration

An administrator has authorized a FortiSwitch but its ports still show the factory default configuration. What is the most likely explanation?

  1. The FortiSwitch is running standalone firmware.
  2. The FortiGate has not enabled DHCP on the FortiLink interface.
  3. The FortiLink interface is configured with an incorrect IP address.
  4. The switch was authorized but no switch-controller port configuration has been defined for its ports. Correct answer.

Explanation

Authorization only grants management; the FortiGate pushes port configuration that exists in the switch-controller configuration. If no port settings are defined, the switch keeps its default port behavior.

Question 41LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiSwitch feature stops a loop from forming when two access ports on the same switch are accidentally cabled together?

  1. Port mirroring
  2. LLDP-MED
  3. Spanning tree with loop protection Correct answer.
  4. DHCP snooping

Explanation

Spanning tree detects the redundant path and blocks one of the ports, preventing a broadcast loop. Loop protection adds an additional safeguard by acting on ports where a loop is detected.

Question 42LAN Edge fundamentals and FortiOS 7.6 administration

An administrator needs to confirm the operational status of a specific managed FortiSwitch port, including link state and speed. Which FortiOS CLI command is most appropriate?

  1. diagnose ip arp list
  2. show system interface
  3. get router info routing-table all
  4. diagnose switch physical-ports summary Correct answer.

Explanation

The physical-ports diagnose command reports link state, speed, and duplex for the ports of managed FortiSwitches. It is the standard way to verify layer-1 status from the FortiGate.

Question 43LAN Edge fundamentals and FortiOS 7.6 administration

A FortiSwitch uplink is configured as a FortiLink LAG on the FortiGate, but the FortiSwitch side is left as separate physical ports. What is the likely result?

  1. All VLANs are automatically removed from the FortiGate.
  2. The FortiLink LAG fails to come up because the aggregation must be configured on both ends. Correct answer.
  3. The FortiSwitch reverts to standalone mode.
  4. The LAG operates normally because the FortiSwitch auto-detects it.

Explanation

Link aggregation requires matching configuration on both peers, so the FortiSwitch ports must also be placed in an aggregate. A mismatch leaves the LAG down or unstable and can cause a loop if the links are also bridged independently.

Question 44LAN Edge fundamentals and FortiOS 7.6 administration

Which statement best describes the purpose of the FortiGate switch-controller in a FortiLink deployment?

  1. It converts all switch ports into routed layer-3 interfaces.
  2. It replaces the need for any VLAN definitions on the switches.
  3. It provides a centralized configuration and monitoring point for managed FortiSwitches. Correct answer.
  4. It acts as a RADIUS server for wired clients.

Explanation

The switch-controller centralizes provisioning and monitoring of authorized FortiSwitches from the FortiGate. It distributes VLANs and port settings but does not eliminate the need for those definitions.

Question 45LAN Edge fundamentals and FortiOS 7.6 administration

An administrator wants to restrict a trunk port on a managed FortiSwitch so that only VLAN 100 can traverse it, even though other VLANs exist on the switch. Which setting controls this?

  1. The native VLAN on the port.
  2. The LLDP profile assigned to the port.
  3. The spanning-tree priority of the switch.
  4. The allowed VLAN list for the trunk port. Correct answer.

Explanation

The allowed VLAN list defines which VLANs a trunk port forwards, so removing all but VLAN 100 restricts the link. The native VLAN only governs untagged traffic and does not limit tagged VLANs.

Question 46LAN Edge fundamentals and FortiOS 7.6 administration

After a FortiSwitch is authorized, an administrator notices that the FortiGate still shows it as detected. Which condition would best explain this?

  1. The FortiSwitch is receiving an address conflict on the management VLAN.
  2. The FortiSwitch serial number was entered incorrectly during authorization. Correct answer.
  3. The FortiLink interface is configured as a WAN interface.
  4. The FortiGate is running an older firmware that lacks switch-controller support.

Explanation

Authorization binds a specific serial number to management, so a typo or mismatched serial leaves the physical device unrecognized and it remains in the detected list. Correcting the serial resolves the mismatch.

Question 47LAN Edge fundamentals and FortiOS 7.6 administration

Which FortiSwitch setting determines the VLAN that untagged frames received on a trunk port are placed into?

  1. The LLDP network policy
  2. The native VLAN Correct answer.
  3. The spanning-tree instance
  4. The allowed VLAN list

Explanation

On a trunk port, untagged frames are assigned to the native VLAN, which is typically used for management traffic. Tagged frames continue to be forwarded according to their 802.1Q tag.

Question 48LAN Edge fundamentals and FortiOS 7.6 administration

An administrator configures a FortiSwitch port as an access port in VLAN 50, but the connected host receives an address from the wrong subnet. Which configuration is the most likely cause?

  1. Spanning tree has blocked the port.
  2. The host is using a static IP address.
  3. The port is a member of a different VLAN than intended, or the native VLAN on the uplink differs. Correct answer.
  4. The FortiGate has disabled DHCP on the FortiLink interface.

Explanation

A VLAN mismatch between the access port and the uplink native VLAN causes frames to land in the wrong broadcast domain, so the host receives a lease from another subnet. Verifying VLAN membership on both ends resolves it.

Question 49LAN Edge fundamentals and FortiOS 7.6 administration

Which combination best describes how a FortiGate running FortiOS 7.6 provisions a new FortiSwitch from first cable connection to fully managed state?

  1. The switch boots into managed mode only after a factory reset triggered by the FortiGate.
  2. The switch is detected over LLDP, authorized by an administrator, and then receives the switch-controller configuration. Correct answer.
  3. The switch is auto-authorized, then the FortiGate pushes VLANs and port configuration.
  4. The switch must be configured manually in standalone mode before it can be managed.

Explanation

Discovery relies on LLDP on the FortiLink interface, after which an administrator authorizes the serial number. Only then does the FortiGate push the switch-controller VLAN and port configuration.

Question 50LAN Edge fundamentals and FortiOS 7.6 administration

A FortiSwitch is managed over FortiLink, but its management address is unreachable from the FortiGate. Which configuration should be verified first?

  1. The LLDP-MED voice VLAN advertised on access ports.
  2. The spanning-tree priority of the FortiSwitch.
  3. The mirror destination port assignment.
  4. The IP address and DHCP settings on the FortiLink interface and the switch management VLAN. Correct answer.

Explanation

Management reachability depends on the FortiLink interface addressing and the switch management VLAN matching the FortiGate. If those do not align, the FortiGate cannot reach the switch even though it is authorized.