Score Higher on Verified NSE5_FSW_AD-7.6 | Fortinet NSE 5 - FortiSwitch 7.6 Administrator Exam Questions with Answers

According to the FortiSwitchOS 7.6 Administration Guide and the FortiSwitch 7.6 Study Guide , the Loop Guard feature protects Layer 2 networks from switching loops and broadcast storms. Unlike standard STP loop protection mechanisms, FortiSwitch Loop Guard operates by periodically sending out proprietary Loop Guard Data Packets (LGDP) / probe frames out of ports where loop guard is enabled.

The loop-detection logic evaluates whether these probe frames return to the switch:

Frame Received Back on the Same Port (Option B): If a loop guard broadcast frame transmitted out of port1 traverses an external unmanaged hub, switch, or looped cable and is received back on port1, the switch detects a downstream loop directly connected to that port.

Frame Received on Another Port of the Same Switch (Option A): In multi-homed connections to a switched network (such as port1 and port2 sharing the same Layer 2 broadcast domains/VLANs), a loop guard frame sent from port1 that loops through the switched network and is received on port2 proves that an active Layer 2 loop exists between those two switch interfaces.

When a loop condition is verified by either scenario, FortiSwitch changes the status of the protected port to Triggered (as verified in the CLI output of the exhibit) and takes the port out of service to isolate the loop.

Regarding the incorrect options: Option C describes Spanning Tree loop guard behavior (loss of BPDUs on non-designated ports), not the FortiSwitch proprietary loop guard mechanism. Option D describes Storm Control or rate limiting, which acts on packet volume thresholds rather than loop-detection probe frames.

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6 Study Guide, Remote Switched Port Analyzer (RSPAN) is a method used to monitor traffic across a network of switches by carrying mirrored traffic over a specific RSPAN VLAN. Because RSPAN floods mirrored traffic to all ports that are members of that specific VLAN across the intermediate switches (Switch B, etc.) until it reaches the destination port, it is critical to manage how that traffic is isolated.

The documentation explicitly states that the best practice is touse a dedicated VLAN assigned only to monitoring devices (Option B). When a VLAN is designated for RSPAN, the switch disables MAC address learning on that VLAN to ensure that the mirrored traffic—which contains the source and destination MAC addresses of the original conversation—does not interfere with the switch ' s normal MAC address table entries for those devices.2

Using a VLAN that already carries regular data traffic (Option A) would result in a massive amount of duplicate traffic being flooded to normal production hosts, leading to network congestion and potential security risks. Similarly, using a dynamic VLAN that includes all ports (Option C) would cause the mirrored traffic to be broadcast to every port in the switch fabric, significantly degrading performance. Finally, using the RSPAN VLAN as a native VLAN (Option D) is not recommended because native VLANs typically handle untagged traffic, whereas RSPAN requires consistent tagging to ensure the mirrored packets stay within the isolated monitoring domain across trunk links. Therefore, creating a unique, dedicated VLAN that is used exclusively for the transport of mirrored traffic is the architectural standard for FortiSwitch RSPAN deployments.

According to theFortiGate Switch Best Practicesand theFortiSwitch 7.6 FortiLink Guide, the recommended best practice for a scalable and high-performance FortiLink deployment is to use alink aggregation group (LAG)interface, also known as an802.3ad aggregate.3

While ahardware-based switch interface (Option A)offers low latency by switching traffic directly in the ASIC, it has significant limitations regardingscalability and redundancy. Hardware switches are restricted by the number of physical ports on the Integrated Switch Fabric (ISF) and cannot be easily expanded to include additional redundant links as the network grows. Conversely,software-based switch interfaces (Option B)are processed by the system CPU, leading to higher utilization and a lack ofNPU hardware acceleration, which makes them unsuitable for high-performance or growing environments.4

By configuring FortiLink as aLAG (Option C), the administrator ensures that the network can support future growth seamlessly. A LAG interface allows for the addition of multiple physical ports to increase bandwidth between the FortiGate and the switch fabric while providing link-level redundancy.5This configuration is the default for modern FortiOS versions because it supports NPU offloading and serves as the technical prerequisite for more advanced topologies, such asMCLAG (Option D). While MCLAG is an excellent solution for high availability in multi-switch environments, it is a topology feature rather than the primary interface type used to define the FortiLink connection on the FortiGate unit itself. Therefore, starting with an aggregate (LAG) interface provides the most flexible foundation for migrating to more complex infrastructures as additional switches are added.