Important Fortinet NSEI_OTS_AR-7.6 Exam Questions

Answer: B, C

Explanation:

The correct answers are B and C. The study guide states that ''You can use application control signatures to detect OT protocols'' and that ''Application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages''. It also shows that a Modbus application control profile can be enabled on a firewall policy ''for OT protocol visibility in the monitor status.'' This directly supports B, because application control is the feature used to identify and monitor OT protocols on FortiGate.

The guide also explains under IPS that ''By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI'' using config ips global and set exclude-signatures none. Once enabled, FortiGate can use those OT signatures for OT-aware inspection and protection. That supports C as the second required configuration. A is related to device discovery, not protocol identification, and D is focused on exploit and vulnerability detection rather than the first-step goal of identifying OT protocols.

Answer: B, C

Explanation:

The correct answers are B. IPS on FortiGate_Level5 and C. Virtual patching on FortiGate_Level2.

The study guide explains that ''the first line of defense is securing the IT side of your network'' and that FortiGate should be placed to protect ICS environments and stop threats from propagating from IT into OT. It also states that IPS improves OT security because ''today's threat landscape requires IPS to block a wider range of threats and improve OT security'' and that in IPS mode, vulnerable devices are protected. This makes FortiGate_Level5, at the upper boundary near the DMZ and external connectivity, the correct place to implement IPS as a primary protection control.

The study guide also states in the Purdue model section that ''Level 2 consists of the processes and programs that control the PLCs, RTUs, and IEDs found at Level 1'' and that ''it is necessary to segment, or even microsegment, these servers with firewall segmentation, along with policies that include application control and virtual patching.'' In addition, the virtual patching section says ''Virtual patching protects OT devices that have not yet been updated against vulnerability exploits'' and applies when traffic related to the vulnerable device reaches the firewall policy. Since FortiGate_Level2 sits between the process network and the control network, it is the right enforcement point for virtual patching to protect the PLC-side assets.

Option A is not one of the best answers because offline IDS only detects and logs attacks; the guide says ''no traffic flows through FortiGate'' in offline IDS mode, whereas IPS can actually block threats. Option D is also not the best answer because OT signatures are enabled within the IPS framework, but the stronger control explicitly described for this design is to deploy IPS at the upper boundary and virtual patching closer to vulnerable OT devices.

Answer: A

Explanation:

The correct answer is

Answer: D

Explanation:

The correct answer is D. EtherCAT. The study guide explicitly states under the Ethernet/IP and EtherCAT section that ''EtherCAT is a protocol that offers real-time communication in a primary-secondary configuration'' and ''EtherCAT skips layers 3 to 6 to deliver real-time communication.'' It also adds that ''the most important feature of this protocol is that secondary devices collect only the information they need from the data packets.'' This matches the exhibit exactly, where the diagram shows Real-Time Data above a Proprietary MAC and Proprietary physical layer, reflecting the protocol structure that bypasses the intermediate OSI layers.

The other options do not match this behavior. The guide says POWERLINK uses layer 2 and layer 7 of the OSI model, not that it skips layers 3 to 6. It also explains that Ethernet/IP is the industrial protocol based entirely on Ethernet standards and adapts to the OSI model. Modbus is described as an open client/server protocol and is not suitable for transmitting data in real time. Therefore, the protocol in the exhibit is clearly EtherCAT.

Answer: A, C

Explanation:

The correct answers are A and C.

Option A is correct because the study guide explains that with active authentication, FortiGate prompts the user only when they use ''an acceptable login protocol.'' It states: ''When you use only active authentication, if all possible policies that could match the source IP address have authentication enabled, then the user will receive a login prompt (assuming they use an acceptable login protocol).'' A direct ping to PLC-1 uses ICMP, which is not the kind of login protocol used to trigger user authentication. So the supervisor must first authenticate through a protocol such as HTTPS or Telnet, then the ICMP traffic can match the authenticated policy.

Option C is also correct because the exhibit shows policy ID 8 greyed out, meaning it is not enabled. That policy appears above the Supervisor_access (9) policy and allows broader access to PLC-1, whereas policy 9 is limited to ALL_ICMP. The study guide explains that ''Because the user has not yet authenticated, the user group aspect of the traffic does not match'' and FortiGate continues searching for another complete match. In this case, with policy 8 disabled, the supervisor is left with only the ICMP rule, which cannot be used to perform the initial login step needed for active authentication.

Option B is not supported by the exhibit. Option D is incorrect because auth-on-demand always would force authentication prompts more aggressively, but the core problem here is that the user is trying to start with ICMP and the broader policy that could permit the initial authenticated access is disabled.