According to theFortiSwitchOS 7.6 Administration Guideand theNSE 5 FortiSwitch 7.6 Administrator Study Guide, Access Control Lists (ACLs) are used to perform multiple actions on matching traffic as it passes through the switch pipeline. The documentation explicitly categorizes these valid actions into three distinct functional groups:Traffic processing,QoS (Quality of Service), andVLANmodifications.
* Traffic Processing (Option C):This is a primary category of ACL actions. It includes operations that dictate how a frame is physically handled or monitored. Valid specific actions under this category includedrop(discarding the packet),count(incrementing a packet counter for statistics),redirect (sending the packet to a specific interface or CPU queue), andmirror(copying the traffic to a monitor port).
* QoS (Option E):The QoS category allows the switch to manage traffic prioritization and bandwidth.
ACLs can be configured toset the egress queue(assigning a frame to one of the eight priority queues), remark CoS (Class of Service)orDSCP (Differentiated Services Code Point)values in the frame header, and applypolicersfor rate limiting.
* VLAN / Set outer VLAN tags (Option D):Under the VLAN category, the most notable action is the ability toset outer VLAN tagson frames. This is particularly useful in scenarios involving Q-in-Q tunneling or service provider environments where a secondary tag is required for transport across a managed fabric.
It is important to note thatAssign the VLAN ID (Option A)is typically a function ofNAC (Network Access Control)orDynamic VLAN Assignmentrather than a standard ACL action; within an ACL context, vlan-id is primarily used as aclassifier(to match traffic) rather than an action.Quarantine devices (Option B)is a high- level security response triggered by the FortiGate NAC engine and is not a direct action available within the FortiSwitch ACL configuration menu.

To enable access to the FortiSwitch management interface from the network, certain configuration adjustments need to be made, particularly considering the VLAN settings displayed in the exhibit:
* Adding port24 native VLAN to the allowed VLANs on internal (Option A): The management VLAN (VLAN 4094 in this case, as it is set as the native VLAN on the ' internal ' interface of the FortiSwitch) must be included in the allowed VLANs on the interface that provides management connectivity. Since port24 is set with a different native VLAN (VLAN 100), VLAN 4094 (the management VLAN) should be allowed through to ensure connectivity.
* Allow VLAN ID 4094 on port24 if management traffic is tagged (Option C): Management traffic is tagged on VLAN 4094. Since port24 is connected to the network and serves as an uplink, allowing VLAN 4094 ensures that management traffic can reach the management interface of the FortiSwitch through this port.
The changes align with Fortinet's best practices for setting up management VLANs and ensuring they are permitted on the relevant switch ports for proper management traffic flow.
References:
FortiGate Infrastructure and Security 7.6 Study Guides
Best practices for VLAN configurations in Fortinet's technical documentation

FortiGate ' s multi-tenancy feature, specifically Virtual Domains (VDOMs), is the most appropriate tool for segmenting network operations and the administration of managed FortiSwitch devices on FortiGate. Here ' s why:
* VDOMs as Virtual Firewalls:VDOMs function as independent virtual firewalls within a single FortiGate device. Each VDOM can have its own:
* Security policies
* Interfaces (Including FortiLink interfaces for FortiSwitch management)
* Routing table
* Administrative access
* Segmenting Network Operations:By assigning different FortiSwitch devices (or groups of ports) to separate VDOMs, you effectively partition your network. Network administrators can manage specific FortiSwitches through their assigned VDOMs, maintaining operational isolation.
* Enhanced Administration:VDOMs offer granular administrative control. Different administrators can be assigned to specific VDOMs, limiting their management scope and reducing the risk of accidental configuration changes.
Why Other Options Are Less Suitable:
* B. Multi-chassis link aggregation trunk:This focuses on link redundancy and bandwidth aggregation, not network segmentation.
* C. FortiGate clustering protocol:This is aimed at high availability and scalability of the firewall functions themselves, not the management of switches.
* D. FortiLink split interface:This allows dividing a FortiLink interface on the FortiGate for managing multiple FortiSwitches, but it doesn ' t provide the true segmentation and administrative isolation that VDOMs offer.
References:
Fortinet Document Library - VDOMs:[invalid URL removed]
Fortinet Document Library - FortiSwitch Multi-tenancy (using VDOMS):https://docs.fortinet.com/document
/fortiswitch/7.4.2/fortilink-guide/801172/multitenancy-and-vdoms

According to theFortiSwitchOS 7.6 Administration Guideand theFortiSwitch 7.6.1 Administration Guide-Standalone Mode, aRouted VLAN Interface (RVI)is a physical port or trunk interface that is converted to support Layer 3 routing protocols.2This transformation changes the fundamental nature of the interface from a switching component to a routing component.
When an RVI is enabled on a specific physical port or trunk, the system automatically assignsVLAN 4095to that interface at the backend.3This specific VLAN ID is reserved across the FortiSwitch platform to signal that the interface is no longer operating as a standard Layer 2 switch port.4Once configured as an RVI, the interface supports advanced Layer 3 features such asOSPF, BGP, RIP, IS-IS, and static routing, as well as Virtual Routing and Forwarding (VRF)for routing isolation.5 Importantly, the documentation states that upon enabling RVI,Layer 2 protocols(such as Spanning Tree Protocol or 802.1X port-based security) and most standard switch interface features aredisabledon that port.
6This is because the port is now treated as a dedicated Layer 3 "routed" interface rather than a member of the Layer 2 switching fabric.7Additionally, if the underlying physical port or trunk interface is administratively shut down, the associated RVI will also transition to a "down" state.