Free Access to Fortinet.FCSS_LED_AR-7.6.v2026-08-19.q93 with Valid Practice Test (Page 5)

Question 16

Refer to the exhibits.

A NAC policy has been configured to apply traffic that flows through FortiSwitch port 2. Traffic that meets the NAC policy criteria will be assigned to the Students VLAN. However, the NAC policy does not seem to be taking effect.
Which configuration is missing?

A.Port2 Access mode should be set to NAC mode.
B.The MAC address or OS might be misconfigured for the connected device.
C.Port2 Access mode should be set to Port Policy mode.
D.The Students VLAN should be set to Allowed VLANs instead of Native VLAN.

Correct Answer: A

From the exhibits:
* FortiSwitch Ports viewshows:
* port2
* Mode: Static
* Native VLAN: Students
* Allowed VLANs: quarantine.fortilink (quarantine)
* NAC policy "Training":
* Switch FortiLink: fortilink
* Category:Device
* Matching criteria:
* MAC Address: 70:88:6b:8c:4b:0e (enabled)
* Operating System:Linux(enabled)
* Switch Controller Action:
* Assign VLAN = Students
* Bounce Port = enabled
Design intent:
Device with that MAC + OS Linux, when plugged intoport2, should be dynamically moved to VLAN Studentsby the NAC policy.
Why it doesn't work now
On FortiLink NAC,dynamic NAC decisions only apply on ports whose "Access Mode" is set to NAC:
* NAC mode = FortiGate controls theonboarding VLAN, evaluates NAC policies, and then dynamically reassigns the switch port VLAN (access, quarantine, etc.).
* Static mode(what we see on port2) means the port just uses its configurednative/allowed VLANs, and no NAC classificationhappens.
Right now:
* port2 is astatic access portwith Native VLAN = Students.
* The NAC policy exists, butFortiSwitch is not in NAC enforcement mode on that port, so the policy is never evaluated for traffic on port2.
Therefore, themissing configurationis:
Setport2toNAC mode(sometimes called "Access mode: NAC" or "NAC LAN edge port").
Once port2 is changed to NAC mode:
* Device initially lands in the onboarding/quarantine VLAN.
* FortiGate collects device info (MAC, OS, etc.).
* NAC policy "Training" matches MAC + Linux.
* Switch controller actionAssign VLAN = Studentsis applied.
* Port is bounced (if configured), bringing the device back up in VLAN Students.
Why the other options are wrong
* B. MAC or OS misconfigured
* Possible in general, but the question asks forwhich configuration is missing, and the exhibits clearly focus on port mode. Also, even with wrong MAC/OS, the port would still be in NAC mode; here NAC isn't even active.
* C. Port Policy mode
* Port policy (edge/trunk) is separate from NAC; NAC requires the specificNAC access mode.
* D. Students VLAN should be Allowed VLANs instead of Native VLAN
* For an access port, having Students as thenative VLANis correct. NAC policy's Assign VLAN will set that as access VLAN; no need to make it an allowed trunk VLAN.

Question 17

Which statement about generating a certificate signing request (CSR) for a CER certificate is true?

A.Inaccurate or missing fields in the CSR will prevent the CA from validating the request, leading to the rejection of the certificate and possible delays in the deployment process.
B.If key fields like the common name (CN) and organization (O) are incorrect, the certification authority (CA) will still issue the certificate, but it may not be trusted by certain applications or systems that rely on accurate field information for validation.
C.CSR fields are primarily used for internal recordkeeping by the requesting organization, and only the public key in the CSR must be accurate for successful certificate signing.
D.The fields in the CSR are primarily for documentation purposes; any missing or incorrect information will be automatically corrected by the CA during the signing process.

Question 18

Refer to the exhibit.

Which shows the WTP profile configuration.
The AP profile is assigned to two FAP-231F APs that are installed in an open plan area.
The first AP has 32 clients associated with the 5 GHz radios and 22 clients associated with the 2.4 GHz radio.
The second AP has 12 clients associated with the 5 GHz radios and 20 clients associated with the 2.4 GHz radio.
A dual-band-capable client enters the area near the first AP and the first AP measures the new client at - 3 3 dBm signal strength. The second AP measures the new client at -43 dBm signal strength.
If the new client attempts to conned to the student 01 wireless network, which AP radio will the client be associated with?

A.The first AP 2.4 GHz interface provides a stronger signal, which clients often prioritize.
B.The first AP 5 GHz interface because it has a stronger signal.
C.The second AP 5 GHz interface has fewer clients, which ensures better performance despite the weaker signal.
D.The second AP 2.4 GHz interface is preferred over 5 GHz for better speed and lower interference.

Question 19

Refer to the exhibits which show the FortiSwitch and FortiGate interface configurations.
FortiSwitch VLAN configuration

Port2 interface configuration

Which two statements describe how port2 handles tagged and untagged traffic? (Choose two.) Response:

A.Port2 accepts ingress untagged traffic for VLAN IDs 100, 4091, and 4093 only.
B.Port2 assigns ingress untagged traffic to VLAN 100.
C.Port2 accepts ingress tagged traffic for VLAN IDs 4091 and 4093 only.
D.Port2 tags egress traffic for VLAN 100.

Question 20

When configuring a FortiSwitch trunk port, which actions are needed?
(Choose two)
Response:

A.Specify allowed VLANs
B.Disable LLDP
C.Enable RSTP
D.Set native VLAN ID

Question 16

Question 17

Question 18

Question 19

Question 20

Download PDF File