Best Way To Study For Fortinet NSE6_OTS_AR-7.6 Exam Brilliant NSE6_OTS_AR-7.6 Exam Questions PDF
Updated Verified Pass NSE6_OTS_AR-7.6 Exam - Real Questions and Answers
Fortinet NSE6_OTS_AR-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 46
You want to automate some tasks in your OT network. Which three configurations are directly available in a new basic event handler on FortiAnalyzer? (Choose three answers)
- A. Automatically create an incident
- B. Send alert email
- C. Automation stitch
- D. Create a report
- E. Quarantine an attacker
Answer: A,B,C
Explanation:
According to the OT Security 7.6 Architect study guide regarding FortiAnalyzer Event Management:
Notification Options: When configuring a new event handler, FortiAnalyzer provides several built-in notification methods to alert administrators when specific log criteria are met. The most common and direct method is Send alert email (Option A).
Incident Management: To streamline the SOC workflow, an event handler can be configured to Automatically create an incident (Option D) based on the triggered event. This moves the event into the Incident Manager for further analysis.
Security Fabric Integration: In the 7.6 architecture, event handlers can directly trigger an Automation stitch (Option E). This allows the FortiAnalyzer to notify the root FortiGate to take action (like running a CLI script or changing a policy) across the Security Fabric.
Exclusions: Create a report (Option B) is typically a task performed by a Playbook or a scheduled report job, not a direct setting inside the basic event handler configuration. Quarantine an attacker (Option C) is an action that results from an automation stitch or playbook, but it is not a direct configuration toggle within the event handler itself.
NEW QUESTION # 47
Which statemenl about the IEC 104 protocol is true?
- A. IEC 104 protects data transmission between OT devices and services.
- B. IEC 104 uses non-TCP/IP standards.
- C. IEC 104 is IEC 101 compliant in old SCADA systems.
- D. IEC 104 is used for telecontrol SCADA in electrical engineering applications.
Answer: D
Explanation:
IEC 104 is a widely used protocol in the field of Supervisory Control and Data Acquisition (SCADA) for electrical engineering applications, specifically telecontrol. It's designed to facilitate communication between control stations and substations in power grids.
NEW QUESTION # 48
Which two statements about the Modbus protocol are true? (Choose two.)
- A. You can implement Modbus networking settings on internetworking devices.
- B. Most of the PLC brands come with a built-in Modbus module.
- C. Modbus is used to establish communication between intelligent devices.
- D. Modbus uses UDP frames to transport MBAP and function codes.
Answer: B,C
NEW QUESTION # 49
You want to improve the security of your OT network and therefore deploy a FortiGate device with the OT signatures database. Which two statements about this database are true? (Choose two answers)
- A. You must install a valid OT security service license.
- B. You must set exclude-signatures to none in the console line interface.
- C. You must import the OT signatures database manually.
- D. The OT signatures database is enabled by default.
Answer: A,B
Explanation:
The correct answers are A and D .
Option A is correct because the study guide states that for OT protocol coverage, "a valid OT security service license is required to receive updates on both intrusion prevention and application control signatures." It also shows "Valid license required" in the FortiGuard subscriptions section for OT protocol coverage. This confirms that a valid OT security service license is required to use and maintain the OT signatures database correctly.
Option D is also correct because the guide explicitly shows the CLI configuration used "To enable OT signatures" :
config ips global
set exclude-signatures none
end
It then states that "By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI." This directly confirms that you must set exclude-signatures to none in the CLI to enable OT signatures.
Option B is incorrect because the study guide does not say you manually import the OT signatures database.
Instead, it explains that FortiGuard maintains updated OT signatures and that a valid license is required to receive updates. Option C is incorrect because the guide clearly says OT signatures are excluded by default until enabled from the CLI.
NEW QUESTION # 50
Which deployment option allows an administrator to detect intrusions without any modifications to production traffic?
- A. Offline IPS
- B. Offline IDS
- C. Virtual patching
- D. Inline IPS and IDS
Answer: B
NEW QUESTION # 51
Refer to the exhibit.
An industrial Ethernet protocol skipping layers 3 to 6 is shown. Which industrial Ethernet protocol is it? (Choose one answer)
- A. EtherCAT
- B. Ethernet over industrial protocol
- C. POWERLINK
- D. Modbus
Answer: A
Explanation:
The correct answer is D. EtherCAT. The study guide explicitly states under the Ethernet/IP and EtherCAT section that "EtherCAT is a protocol that offers real-time communication in a primary-secondary configuration" and "EtherCAT skips layers 3 to 6 to deliver real-time communication." It also adds that "the most important feature of this protocol is that secondary devices collect only the information they need from the data packets." This matches the exhibit exactly, where the diagram shows Real-Time Data above a Proprietary MAC and Proprietary physical layer, reflecting the protocol structure that bypasses the intermediate OSI layers.
The other options do not match this behavior. The guide says POWERLINK uses layer 2 and layer 7 of the OSI model, not that it skips layers 3 to 6. It also explains that Ethernet/IP is the industrial protocol based entirely on Ethernet standards and adapts to the OSI model. Modbus is described as an open client/server protocol and is not suitable for transmitting data in real time. Therefore, the protocol in the exhibit is clearly EtherCAT.
NEW QUESTION # 52
Refer to the exhibit.
The Core Network Security Connectors page of the FortiGate-2 device is shown. Which statement is correct? (Choose one answer)
- A. You must configure the FortiAnalyzer settings on FortiGate-2.
- B. FortiGate-2 serves as Fabric Root.
- C. You must enable Security Fabric Connection on the FortiGate-2 interface.
- D. FortiGate-2 is not authorized on the root FortiGate.
Answer: D
Explanation:
Based on the provided exhibit and the OT Security 7.6 Architect curriculum regarding the Fortinet Security Fabric :
* Fabric Role : The exhibit clearly shows that FortiGate-2 has the role set to Join Fabric . This confirms it is a downstream device and not the Fabric Root (eliminating Option A).
* Upstream Connection : The device is configured to point to an Upstream FortiGate at IP address
10.1.2.254 .
* Fabric Status : The status is currently displayed as Not Connected . In a standard Fortinet Security Fabric deployment, once a downstream device is configured to join the fabric, it sends a request to the upstream root device. The root FortiGate must then explicitly authorize the downstream unit before the connection is established and the status changes to " Connected. "
* Authorization Requirement : The " Not Connected " status, while having the upstream IP correctly configured, is the classic indicator that the authorization step is pending on the root FortiGate.
Furthermore, under the LAN Edge Devices section, it shows another downstream FortiGate requiring authorization on this specific unit, highlighting that authorization is a manual security requirement for all stages of the Fabric hierarchy.
* FortiAnalyzer Status : While the Logging & Analytics section shows FortiAnalyzer is Disabled , this is a configuration choice and does not prevent the Security Fabric from connecting; therefore, configuring it is not the solution to the connectivity status shown (eliminating Option C).
In summary, FortiGate-2 cannot join the fabric until an administrator logs into the Root FortiGate (10.1.2.254) and authorizes the join request from FortiGate-2.
NEW QUESTION # 53
Refer to the exhibit. Which statement about the interfaces shown in the exhibit is true?
- A. port1-vlan10 and port2-vlan10 are part of the same broadcast domain
- B. port1, port1-vlan10, and port1-vlan1 are in different broadcast domains
- C. port2, port2-vlan10, and port2-vlan1 are part of the software switch interface.
- D. The VLAN ID of port1-vlan1 can be changed to the VLAN ID 10.
Answer: B
NEW QUESTION # 54
Refer to the exhibits.
A partial view of the Playbook Monitor page and the corresponding playbook configuration are shown.
Based on the monitor page and the configuration of the playbook, what has triggered the Run_Report task?
(Choose one answer)
- A. An IPS_Attack_Incident log
- B. An Event_Trigger log
- C. An IPS incident creation
- D. An IPS_Attack_Handling event
Answer: D
Explanation:
Based on the provided exhibits from the FortiAnalyzer playbook engine:
* Playbook Trigger Condition : The Partial Playbook configuration exhibit shows that the playbook is set to trigger based on a condition where the Basic Handler Name is Equal To IPS_Attack_Handling.
* Event vs. Log : In FortiAnalyzer, the field Basic Handler Name is a property of an Event record, indicating the specific Event Handler that generated it. A playbook configured with this condition is triggered by an Event , not directly by a raw log.
* Playbook Execution Flow : The Partial Playbook Monitor view shows the execution sequence:
* Event_Trigger (Starter) : This is the entry point of the playbook, which matches the condition defined in the configuration.
* IPS_Attack_Incident : The first task executed after the trigger.
* Run_Report : The task in question, which is executed as part of the automated workflow initiated by the starter.
* Conclusion : Since the playbook ' s " Starter " is defined by the IPS_Attack_Handling handler name, an event produced by that handler is the root trigger for the entire playbook execution, including the Run_Report task.
Therefore, the Run_Report task was triggered (as part of the playbook) by an IPS_Attack_Handling event .
NEW QUESTION # 55
To improve visibility into the risks in your OT network, you would like to create a new report on FortiAnalyzer.
What must you do to create this report? (Choose one answer)
- A. Clone a predefined report to create a new one.
- B. Create a template or use an existing one.
- C. Enable the FortiAnalyzer Fabric settings.
- D. Import a report created in FortiSIEM.
Answer: B
NEW QUESTION # 56
An OT network architect must deploy a solution to protect fuel pumps in an industrial remote network. All the fuel pumps must be closely monitored from the corporate network for any temperature fluctuations.
How can the OT network architect achieve this goal?
- A. Configure a fuel server on the corporate network, and deploy a FortiSIEM with a single pattern temperature performance rule on the remote network.
- B. Configure both fuel server and FortiSIEM with a single-pattern temperature performance rule on the corporate network.
- C. Configure a fuel server on the remote network and deploy a FortiSIEM with a single pattern temperature performance rule on the corporate network.
- D. Configure a fuel server on the remote network, and deploy a FortiSIEM with a single pattern temperature security rule on the corporate network.
Answer: C
Explanation:
A fuel server placed in the remote OT network gathers the pump temperature data locally, and FortiSIEM at the corporate side analyzes it with a single-pattern performance rule to detect temperature fluctuations. This gives central visibility without exposing the pumps directly and uses the correct rule type for monitoring operational metrics (temperature).
NEW QUESTION # 57
Refer to the exhibit. An OT administrator ran a report to identify device inventory in an OT network.
Based on the report results, which report was run?
- A. A FortiSIEM incident report
- B. A FortiSIEM CMDB report
- C. A FortiSIEM analytics report
- D. A FortiAnalyzer device report
Answer: B
NEW QUESTION # 58
Refer to the exhibit. An OT network architect must implement inter-VLAN routing in the topology.
Traffic from each client is tagged with a unique VLAN. Each client is directly connected to a Layer
2 switch.
Which action must the OT network architect take to achieve this goal?
- A. Replace the switch with a Layer 3 device.
- B. Make FortiGate a router on a stick.
- C. Set the same forward domain on each switch interface.
- D. Configure a software switch to handle traffic for each client.
Answer: B
Explanation:
With clients in separate VLANs on a Layer 2 switch, inter-VLAN traffic must be routed. Creating VLAN subinterfaces on a single FortiGate physical port ("router on a stick") lets the FortiGate route and apply policy between those VLANs.
NEW QUESTION # 59
Refer to the exhibits.
A partial OT network and firewall policies configuration are shown.
You added authentication in the firewall policy from Engineering Workstation to RTU to improve the security. When verifying your configuration, you notice that you can still access RTU from Engineering Workstation without an authentication prompt.
What must you do to enforce authentication?
- A. You must enable Fortinet Single Sign-On (FSSO).
- B. You must add authentication in firewall policy 9.
- C. You must add a local user instead of FortiAuthenticator.
- D. You must reboot FortiGate.
Answer: B
Explanation:
Firewall policies are evaluated top-down, and a matching policy without authentication is applied before the one requiring authentication. Adding authentication to the higher-priority policy ensures that all matching traffic is subject to authentication.
NEW QUESTION # 60
Drag and Drop Question
Match each industrial protocol to its corresponding characteristics.
Select each OT industrial protocol in the column on the left and drag and drop it into the blank space next to its corresponding characteristics in the column on the right. After matching a device type to its characteristics, you can move it again if you want to change your answer by clicking the industrial protocol name. You must match all four industrial protocols to their characteristics in the work area.
Answer:
Explanation:
NEW QUESTION # 61
During layer 2 polling , which two pieces of information are gathered by FortiNAC to identify a device?
(Choose two answers)
- A. The MAC-to-IP correlation learned
- B. The system name learned
- C. The time it was learned
- D. Where it was learned
Answer: C,D
Explanation:
According to the OT Security 7.6 Architect study guide section on Asset Management , specifically regarding FortiNAC Visibility :
* Layer 2 Polling Data : Because each physical address is unique, FortiNAC identifies hosts as they connect to the network. The information gathered during this process fills in the physical address and location information in the database.
* Visibility Components : The guide states that the physical address learned , the time it was learned , and where it was learned from provide the foundation of endpoint visibility in the form of " what, where, and when " information. This confirms that Where it was learned (Option A) and The time it was learned (Option D) are correct.
* Exclusions :
* Layer 3 Polling : The MAC-to-IP correlation (Option B) is explicitly defined as a function of Layer 3 polling , where the correlated IP address is added to the database record for the corresponding MAC address.
* DHCP Fingerprinting : The host name or system name (Option C) and the operating system are gathered via DHCP fingerprinting , not layer 2 polling.
NEW QUESTION # 62
Refer to the exhibit. In order for a FortiGate device to act as router on a stick, what configuration must an OT network architect implement on FortiGate to achieve inter-VLAN routing?
- A. Set a unique forward domain on each interface on the network.
- B. Set a software switch on FortiGate to handle inter-VLAN traffic.
- C. Set FortiGate to operate in transparent mode.
- D. Set a FortiGate interface with the switch to operate as an 802.1 q trunk.
Answer: D
Explanation:
The router on a stick configuration requires a single physical interface on the FortiGate to carry traffic for multiple VLANs using 802.1q VLAN tagging.
The FortiGate interface connected to the switch must be configured as a trunk port to handle tagged VLAN traffic.
Sub-interfaces on the FortiGate are then created for each VLAN to route traffic between VLANs.
This setup enables efficient inter-VLAN routing over a single physical link, as shown in the diagram where traffic from multiple VLANs converges on a switch and is carried over a trunk port.
NEW QUESTION # 63
Which two of the following features do most industrial protocols lack? (Choose two.)
- A. TLS encryption
- B. Real-time data exchange
- C. Deterministic timing
- D. Authentication
Answer: A,D
Explanation:
Most legacy OT/industrial protocols were built for speed and determinism, not security, so they typically omit built-in TLS encryption and authentication mechanisms.
NEW QUESTION # 64
Refer to the exhibit.
An automation trigger creation wizard is shown. You want to automate some tasks in your OT network. In a FortiGate device, you create a new automation trigger based on a FortiAnalyzer event handler. When you want to configure the Event handler name field, the event handler created in FortiAnalyzer is not shown.
What are two reasons for this? (Choose two answers)
- A. You must enable Automation Stitch in the event handler on FortiAnalyzer.
- B. You must add the FortiGate device to FortiAnalyzer and authorize it.
- C. You must click + Create in the Event handler name field.
- D. You must configure the Fabric settings on the FortiGate device.
Answer: A,D
Explanation:
The correct answers are A and B .
Option B is correct because the study guide states that "When a handler generates an event with the automation stitch option enabled, FortiAnalyzer sends a notification" to FortiGate. If Automation Stitch is not enabled in the FortiAnalyzer event handler, that handler will not be usable for the FortiGate automation- stitch workflow. The guide also explains that the configuration of each event handler can include
"Automation stitches" and "Rules," showing that this is a required part of the FortiAnalyzer-to-FortiGate automation path.
Option A is also correct. The study guide explains the automation flow in the Security Fabric:
"FortiAnalyzer parses the logs and notifies the root FortiGate" and then "The root FortiGate triggers the action." That means FortiGate must have the FortiAnalyzer connection configured through the Security Fabric side before it can consume FortiAnalyzer event handlers. The warning in the exhibit about configuring a FortiAnalyzer connection also points directly to that requirement.
Option C is incorrect because + Create is not the reason the existing event handler is missing; it is only an interface control. Option D is not the best answer for this item because the question is about why the event handler name list on FortiGate is empty for FortiAnalyzer-triggered automation. The study guide's verified requirements for that workflow are the FortiAnalyzer-to-FortiGate Fabric connection and enabling Automation Stitch on the FortiAnalyzer event handler.
NEW QUESTION # 65
What are two benefits of a Nozomi integration with FortiNAC? (Choose two.)
- A. Importation and classification of hosts
- B. Enhanced point of connection details
- C. Adapter consolidation for multi-adapter hosts
- D. Direct VLAN assignment
Answer: A,C
Explanation:
Devices known to Nozomi can be imported and registered or classified automatically. The imported devices will be profiled based on information retrieved from the Nozomi product.
Devices with multiple network adapters will have the devices consolidated under the single device in the FortiNAC.
NEW QUESTION # 66
Refer to the exhibit. Which statement is true about application control inspection?
- A. Security actions cannot be applied on the lowest level of the hierarchy.
- B. The parent signature takes precedence over the child application signature.
- C. The industrial application control inspection process is unique among application categories.
- D. You can control security actions only on the parent-level application signature
Answer: B
Explanation:
Application control inspection in Fortinet firewalls utilizes a hierarchical structure where applications are categorized and classified. A parent signature encompasses a group of related child applications. If a security action is defined on the parent signature, it will apply to all child applications within that group. Therefore, the parent signature takes precedence over the child application signature, meaning if a child application is allowed access based on its own signature but the parent signature has a blocking rule, the child application will still be blocked.
NEW QUESTION # 67
Refer to the exhibit. A Logical Topology page of a FortiGate device is shown.
Your OT company wants to gain visibility into the network. You decide to implement device detection with the Security Fabric.
Based on the exhibit, which statement is correct? (Choose one answer)
- A. Device Detection is enabled on port3.
- B. The other identified device must be authorized on FortiAnalyzer.
- C. Device Detection is enabled on the other identified device.
- D. The other identified device must be authorized on the root FortiGate.
Answer: D
NEW QUESTION # 68
Refer to the exhibit. The OT devices behind the ruggedized FortiGate have vulnerabilities and you want to apply a virtual patching profile in the firewall policy.
Why is Virtual Patching not available in the Security Profiles section? (Choose one answer)
- A. You must enable OT signatures.
- B. You must have a valid OT security service license.
- C. You must have a ruggedized FortiGate allowing the virtual patching feature.
- D. You must enable Virtual Patching in the Feature Visibility section.
Answer: D
NEW QUESTION # 69
With the limit of using one firewall device, the administrator enables multi-VDOM on FortiGate to provide independent multiple security domains to each ICS network.
Which statement ensures security protection is in place for all ICS networks?
- A. Each traffic VDOM must have a direct connection to FortiGuard services to receive the required security updates.
- B. Traffic between VDOMs must pass through the physical interfaces of FortiGate to check for security incidents.
- C. Each VDOM must have an independent security license.
- D. The management VDOM must have access to all global security services.
Answer: D
Explanation:
In a multi-VDOM setup, one VDOM typically acts as the management VDOM (often called "root") which manages global settings and security services like FortiGuard updates.
This management VDOM handles access to global security services that benefit all traffic VDOMs.
Individual traffic VDOMs process their own traffic and enforce security policies but rely on the management VDOM for centralized access to global security services.
Each VDOM does not need an independent security license; the license is for the device as a whole.
Traffic between VDOMs does not need to pass through physical interfaces to be inspected; inter- VDOM links and policies handle traffic inspection.
Each VDOM does not require direct FortiGuard connections; this can be centralized in the management VDOM.
NEW QUESTION # 70
In the Purdue model, at which level are physical assets like the Industrial Internet of Things (IIoT) placed? (Choose one answer)
- A. At Level 5 only
- B. Above Level 4
- C. Below Level 3.5
- D. At Level 1 only
Answer: C
Explanation:
According to the OT Security 7.6 Architect study guide regarding the Purdue Model:
Asset Location: The study guide states that "All critical physical assets are located on the plant floor and equipped with IIoT sensors." Level Classification: The "plant floor" is further defined as the "control area zone," which consists of Levels 0, 1, and 2.
Hierarchy: The "Operations & Control" zone is identified as Level 3 and Level 3.5.
Direct answer: In the "Introduction" lesson's Knowledge Check, the specific question "In
NEW QUESTION # 71
......
Updated PDF (New 2026) Actual Fortinet NSE6_OTS_AR-7.6 Exam Questions: https://www.itexamdownload.com/NSE6_OTS_AR-7.6-valid-questions.html
Dumps Moneyack Guarantee - NSE6_OTS_AR-7.6 Dumps Approved Dumps: https://drive.google.com/open?id=1sxQB5FdkDtlpnxWJffaxFY4X2TVazg7n