NSE5_FWF_AD-7.6 Certification Exam Guide + Practice Questions Updated 2026

Explanation:
D is correct because the FortiAP is connected and the SSID object works on other APs, while the VAP diagnostic output confirms that the affected radio is not instantiating a BSSID. A radio placed in monitor mode performs wireless scanning instead of serving normal client VAPs. Removing the stale override restores the profile-defined access-point role and allows the employee SSID to be advertised.
Option A would modify a healthy global object and could disrupt every AP using it.
Option B changes the forwarding architecture but cannot make a monitor radio function as a client-serving radio.
Option C confuses a WIDS scanning policy with an SSID-assignment container; referencing a network in WIDS does not cause a monitor radio to beacon that network.

Explanation:
A is correct because the location-dependent behavior, sensitivity to rack contents, normal noise floor, and lack of consistent improvement after channel changes indicate a physical propagation problem rather than general channel congestion. Metal surfaces can block, reflect, and redirect RF energy, so an active survey under representative conditions is required before changing placement, antenna orientation, cell size, or channel boundaries.
Option B may cause radios to change channels in response to a symptom, but the same localized propagation pattern can persist on the replacement channel.
Option C can strengthen reflected energy as well as the desired path, expand contention domains, and create uplink asymmetry without guaranteeing that coverage nulls disappear.
Option D changes scheduling and association density but does not address the physical reason that nearby locations experience different signal quality.

Explanation:
A is correct because phishing-SSID detection can identify an SSID defined on FortiGate but broadcast by an uncontrolled AP, or match an administrator-defined offending SSID pattern. The controller can log or suppress matching services, subject to applicable legal and regulatory restrictions.
Option B incorrectly requires wired attachment for phishing detection and deliberately increases false-positive correlation.
Option C causes the managed infrastructure to advertise additional deceptive names and increases beacon overhead without removing the attack.
Option D suppresses neither the radio service nor user association attempts; certificate validation can protect correctly configured enterprise clients, but it is not a substitute for detection and response.

Explanation:
A is correct because required PMF protects robust management frames and prevents clients that cannot negotiate the protection from associating with the SSID. This matches the agency's requirement because every approved handset supports the feature and legacy compatibility is unnecessary.
Option B leaves a downgrade path by allowing non-PMF associations, so it does not enforce the stated security baseline.
Option C can reduce repeated EAP exchanges during roaming, but cached key material does not by itself require management-frame protection.
Option D confuses beacon protection with PMF; protecting beacon integrity does not replace the 802.11w controls required for deauthentication and disassociation protection.

Explanation:
C is correct because the security exposure originates from the VAP being included in an SSID group referenced by the trading-floor FortiAP profile. Restricting that profile to the approved employee SSID prevents the local-bridge contractor network from being instantiated in the sensitive area.
Option A uses client load balancing as though it were an access-control mechanism and cannot guarantee that the unwanted VAP will not accept associations.
Option B expands the bypass of centralized forwarding instead of meeting the inspection requirement.
Option D may prevent bridged client traffic from functioning, but the SSID can remain visible and accept associations, creating an unreliable failure state rather than removing the unauthorized service from the profile.