NSE6_OTS_AR-7.6 Practice Questions Preview

Question 1

Single choice

Refer to the exhibit.

A partial OT network is shown. You must improve the security of this OT network and implement internal segmentation between network 1 and network 2.

How can you achieve the segmentation? (Choose one answer)

A
You can configure universal ZTNA.
B
You can configure one traffic VDOM.
C
You can configure an explicit software switch.
D
You can configure forward domain IDs for each network.

Reveal answer details Close answer details

Correct answerD

Explanation

Forward domain IDs separate Layer 2 forwarding domains on the FortiGate path. Assigning different IDs to network 1 and network 2 prevents them from sharing the same internal switching segment.

Question 2

Single choice

Refer to the exhibit.

A partial Incident Analysis page is shown.

How was the 360-Degree Security Review OT report attached to the incident? (Choose one answer)

A
Automatically by a stitch
B
Automatically by an event handler
C
Automatically by a playbook
D
Manually by an administrator

Reveal answer details Close answer details

Correct answerD

Explanation

The incident history attributes the report attachment to the admin account. That points to an administrator adding the 360-Degree Security Review OT report manually, not to a stitch, event handler, or playbook action.

Question 3

Single choice

Refer to the exhibit.

A Logical Topology page of a FortiGate device is shown. Your OT company wants to gain visibility into the network. You decide to implement device detection with the Security Fabric.
Based on the exhibit, which statement is correct? (Choose one answer)

A
Device Detection is enabled on the other identified device.
B
The other identified device must be authorized on the root FortiGate.
C
The other identified device must be authorized on FortiAnalyzer.
D
Device Detection is enabled on port3.

Reveal answer details Close answer details

Correct answerA

Explanation

The topology has already discovered the other identified device in the Fabric view. That means device detection is active for that device; authorization is a separate Fabric onboarding state, not the detection result itself.

Question 4

Multiple choice

A plant is planning asset management for an OT network that includes managed switches, engineering workstations, and industrial controllers. Which two outcomes are supported by implementing device detection on FortiGate and FortiNAC? Choose two.

A
Building an inventory of connected OT assets
B
Replacing network segmentation with a single broadcast domain
C
Identifying devices before assigning access decisions
D
Disabling all monitoring after the first asset scan
E
Avoiding any need for policy review when new devices appear

Reveal answer details Close answer details

Correct answersA, C

Explanation

Device detection builds an inventory by discovering connected OT assets and their attributes. FortiGate and FortiNAC can then use that identity context before applying access decisions or enforcement policies.

Question 5

Single choice

FortiAnalyzer receives events from multiple OT enforcement points. Which event handler design is most appropriate?

A
Create focused filter conditions for events that require review or response.
B
Trigger the same action for every log regardless of severity or context.
C
Ignore asset context because all OT devices have identical risk.
D
Disable reporting whenever an event handler is enabled.

Reveal answer details Close answer details

Correct answerA

Explanation

FortiAnalyzer should filter for events that actually need review or response. Focused conditions reduce noise and let the handler act on severity, asset context, or event type instead of treating every log the same.

Question 6

Single choice

Refer to the exhibit.

The OT devices behind the ruggedized FortiGate have vulnerabilities and you want to apply a virtual patching profile in the firewall policy.

Why is Virtual Patching not available in the Security Profiles section? (Choose one answer)

A
You must enable Virtual Patching in the Feature Visibility section.
B
You must have a ruggedized FortiGate allowing the virtual patching feature.
C
You must enable OT signatures.
D
You must have a valid OT security service license.

Reveal answer details Close answer details

Correct answerA

Explanation

Security profile menu entries can be hidden until their feature visibility is enabled. Since Virtual Patching is missing from the Security Profiles list, enabling Virtual Patching in Feature Visibility exposes that profile type.

Question 7

Single choice

An OT security architect wants to inspect industrial protocol traffic while keeping production communication under policy control. Which design choice supports this requirement?

A
Apply security inspection to the traffic path that carries the industrial protocol.
B
Disable inspection because industrial protocols cannot be evaluated by policy.
C
Route industrial protocol traffic around enforcement points whenever possible.
D
Allow all industrial commands after the protocol is first detected.

Reveal answer details Close answer details

Correct answerA

Explanation

Industrial protocol traffic can be governed only when it crosses an enforcement point. Placing security inspection on that traffic path lets policy evaluate commands and sessions while production communication remains controlled.

Question 8

Multiple choice

Refer to the exhibit.

A basic event handler is shown. You have enabled Automation Stitch to automate the handling of an alert.

Which two steps must you take to use this automation stitch? (Choose two answers)

A
You must configure Action on FortiAnalyzer.
B
You must configure a Playbook task on FortiAnalyzer.
C
You must configure a FortiAnalyzer event handler trigger on FortiGate.
D
You must configure Rules on FortiAnalyzer.

Reveal answer details Close answer details

Correct answersC, D

Explanation

A Basic Event Handler still needs matching rules on FortiAnalyzer so the alert condition is defined. With Automation Stitch enabled, FortiGate must also use a FortiAnalyzer event handler trigger to call that handler from the automation workflow.

Question 9

Single choice

Refer to the exhibit.

The Core Network Security Connectors page of the FortiGate-2 device is shown.

Which statement is correct? (Choose one answer)

A
FortiGate-2 serves as Fabric Root.
B
You must enable Security Fabric Connection on the FortiGate-2 interface.
C
You must configure the FortiAnalyzer settings on FortiGate-2.
D
FortiGate-2 is not authorized on the root FortiGate.

Reveal answer details Close answer details

Correct answerD

Explanation

FortiGate-2 is configured to join a Fabric but the status is not connected, and the connector view reports a FortiGate requiring authorization. That points to FortiGate-2 not yet being authorized on the Fabric root.

Question 10

Multiple choice

Refer to the exhibits.

A partial Basic Event Handler page on FortiAnalyzer and the creation of a trigger in a FortiGate device are shown. To improve the protection of your OT network, you want to automate the handling of compromised devices notified through FortiAnalyzer. You have configured an event handler named Alert_trigger as shown in the exhibit.

When you create the trigger on the FortiGate device, the Event handler name field does not provide the Alert_trigger option.

What two actions must you perform to make the Alert_trigger option available? (Choose two answers)

A
You must click + Create in the Event handler name field.
B
You must authorize the FortiGate device on FortiAnalyzer.
C
You must configure the FortiAnalyzer setting on the FortiGate device.
D
You must configure the trigger on the root FortiGate.

Reveal answer details Close answer details

Correct answersC, D

Explanation

The FortiGate trigger depends on a working FortiAnalyzer connection before handler names can populate. Because the automation trigger is created in the Fabric context, it also must be configured on the root FortiGate.

Question 11

Single choice

Refer to the exhibit. A partial OT network is shown. You must improve the security of this OT network and implement internal segmentation between network 1 and network 2.

How can you achieve the segmentation? (Choose one answer)

A
You can configure universal ZTNA.
B
You can configure one traffic VDOM.
C
You can configure an explicit software switch.
D
You can configure forward domain IDs for each network.

Reveal answer details Close answer details

Correct answerD

Explanation

Forward domain IDs divide the Layer 2 forwarding behavior between the two network groups. Assigning separate IDs to each network creates internal segmentation without relying on ZTNA, VDOMs, or a shared software switch.