Download Fortinet NSE 5 - Secure Wireless LAN 7.6 Administrator.NSE5_FWF_AD-7.6.DumpsBase.2026-07-01.40q.vcex

A is correct because local bridge mode retains centralized FortiAP and SSID management while bridging client frames onto the local wired network. Clients can use the branch DHCP server, local services, and local Internet gateway without consuming controller-bound WAN capacity for every packet. The branch switching configuration must carry the client VLAN appropriately.Option B still transports client data to the central controller and fragmentation does not create local breakout.Option C affects AP organization and association behavior, not the forwarding path.Option D protects tunneled data in transit but does not convert tunnel mode into local bridging.

C is correct because a FortiAP profile is associated with a particular FortiAP platform and defines the radio configuration supported by that hardware model. The common SSIDs can be referenced by multiple profiles, but settings such as a third dedicated scanning radio must remain specific to models that contain and support that radio.Option A confuses SSID organization with hardware abstraction; an SSID group can be referenced by a profile but does not translate radio capabilities between platforms.Option B cannot create a physical radio that does not exist and would introduce unnecessary per-device configuration drift.Option D assumes that a custom profile dynamically changes its platform structure, but platform-specific radio definitions remain part of the profile design.

A is correct because a radio in monitor mode is used for wireless scanning and is no longer operating as a normal client-serving access radio. If 5 GHz client access is required, that radio must return to access-point mode or the deployment must use a model with another radio that can be dedicated to monitoring.Option B confuses a WIDS profile with a VAP container; WIDS settings define monitoring behavior and do not cause a monitor radio to advertise client SSIDs.Option C changes the client forwarding method but does not override the physical radio mode.Option D assumes that an SSID assignment can supersede the radio's operating role, which it cannot.

C is correct because an enterprise transition configuration permits a controlled mixture of WPA2-Enterprise and WPA3-Enterprise clients while retaining the existing EAP-TLS identity infrastructure. The university should validate PMF and client compatibility, then remove the transition mode once the legacy systems are retired.Option A does not make WPA3-only backward compatible; disabling PMF would also weaken the intended security posture without allowing WPA2-only clients to negotiate WPA3.Option B replaces individual certificate authentication with personal-security keys and cannot negotiate enterprise authentication on behalf of incompatible clients.Option D is designed for open-to-OWE migration and does not provide a transition path between WPA2-Enterprise and WPA3-Enterprise.

D is correct because a compatible tri-radio FortiAP can dedicate one radio to monitoring while the remaining radios continue serving clients. Applying the WIDS profile and a targeted scan-channel list to the monitor radio provides sustained security visibility without repeatedly taking the production radios away from their serving channels.Option A can collect useful information but increases off-channel activity on client-serving radios and conflicts with the requirement to minimize production interruption.Option B retains radio 3 as a client-serving radio and therefore does not provide the same dedicated monitoring behavior.Option C removes the hardware resource required for scanning; a disabled radio cannot continue acting as an active monitor.

B is correct because enterprise wireless clients must validate the authentication server certificate against a trusted CA chain and, when configured, the expected server identity. The new server certificate can be cryptographically valid while still being rejected by clients that do not trust the new issuing authorities.Option A restores connectivity by eliminating a critical defense against fraudulent authentication servers and credential-capture attacks.Option C changes the FortiGate certificate store but does not install trust anchors into endpoint supplicants.Option D replaces enterprise authentication with a shared-password method, and SAE does not use the existing client certificates or RADIUS trust relationship.

A is correct because required PMF protects robust management frames and prevents clients that cannot negotiate the protection from associating with the SSID. This matches the agency's requirement because every approved handset supports the feature and legacy compatibility is unnecessary.Option B leaves a downgrade path by allowing non-PMF associations, so it does not enforce the stated security baseline.Option C can reduce repeated EAP exchanges during roaming, but cached key material does not by itself require management-frame protection.Option D confuses beacon protection with PMF; protecting beacon integrity does not replace the 802.11w controls required for deauthentication and disassociation protection.

B is correct because data-channel security must be compatible at both the FortiGate profile and the FortiAP. A DTLS-only controller policy cannot establish the required data channel with an AP that permits only clear text. The control channel is separately protected by DTLS, while the client data channel can use clear text, DTLS, or an applicable IPsec mode.Option A incorrectly treats interface administrative access and CAPWAP control encryption as the same setting.Option C secures the over-the-air client session but does not negotiate encryption between the FortiAP and controller.Option D is unreliable because when both clear text and DTLS are permitted at both ends, clear text can be selected rather than guaranteeing DTLS.

D is correct because DHCP option 138 directly influences which controller addresses the FortiAP attempts during discovery, and the first address has the highest priority. Updating the DHCP information provides a scalable migration mechanism without touching each AP locally. The team should confirm that the new cluster can discover and authorize the devices before deauthorizing or retiring the old controller entries.Option A does not create a supported active-active controller relationship in which one AP selects between simultaneous management sessions by latency.Option B confuses a FortiAP profile with controller-discovery configuration; profile assignment does not rewrite the third-party DHCP option.Option C uses FortiAP groups as though they influenced discovery order, but groups organize managed APs only after the devices have reached the controller.

A is correct because OWE provides individualized encryption for an otherwise unauthenticated wireless service. It protects the over-the-air link from passive observation without requiring accounts or a shared password, while FortiGate policies can continue controlling Internet usage.Option B still requires every client to know a common password, which directly violates the stated requirement and creates a shared secret.Option C may require legal acknowledgement or web authentication, but a captive portal on an open WLAN does not automatically encrypt the 802.11 link.Option D is not a valid WPA3-Enterprise deployment because enterprise security requires an authentication framework such as RADIUS and does not provide anonymous access merely by omitting the server.