NSE7_OTS-6.4 Online Practice Questions and Answers

What are two benefits of a Nozomi integration with FortiNAC? (Choose two.)

A. Enhanced point of connection details

B. Direct VLAN assignment

C. Adapter consolidation for multi-adapter hosts

D. Importation and classification of hosts

Refer to the exhibit.

In the topology shown in the exhibit, both PLCs can communicate directly with each other, without going through the firewall.

Which statement about the topology is true?

A. PLCs use IEEE802.1Q protocol to communicate each other.

B. An administrator can create firewall policies in the switch to secure between PLCs.

C. This integration solution expands VLAN capabilities from Layer 2 to Layer 3.

D. There is no micro-segmentation in this topology.

In a wireless network integration, how does FortiNAC obtain connecting MAC address information?

A. RADIUS

B. Link traps

C. End station traffic monitoring

D. MAC notification traps

Refer to the exhibit.

You are navigating through FortiSIEM in an OT network.

How do you view information presented in the exhibit and what does the FortiGate device security status tell you?

A. In the PCI logging dashboard and there are one or more high-severity security incidents for the FortiGate device.

B. In the summary dashboard and there are one or more high-severity security incidents for the FortiGate device.

C. In the widget dashboard and there are one or more high-severity incidents for the FortiGate device.

D. In the business service dashboard and there are one or more high-severity security incidents for the FortiGate device.

Refer to the exhibit.

An OT administrator ran a report to identify device inventory in an OT network. Based on the report results, which report was run?

A. A FortiSIEM CMDB report

B. A FortiAnalyzer device report

C. A FortiSIEM incident report

D. A FortiSIEM analytics report

Refer to the exhibit.

Based on the topology designed by the OT architect, which two statements about implementing OT security are true? (Choose two.)

A. Firewall policies should be configured on FortiGate-3 and FortiGate-4 with industrial protocol sensors.

B. Micro-segmentation can be achieved only by replacing FortiGate-3 and FortiGate-4 with a pair of FortiSwitch devices.

C. IT and OT networks are separated by segmentation.

D. FortiGate-3 and FortiGate-4 devices must be in a transparent mode.

An OT architect has deployed a Layer 2 switch in the OT network at Level 1 the Purdue model-process control. The purpose of the Layer 2 switch is to segment traffic between PLC1 and PLC2 with two VLANs. All the traffic between PLC1 and PLC2 must first flow through the Layer 2 switch and then through the FortiGate device in the Level 2 supervisory control network.

What statement about the traffic between PLC1 and PLC2 is true?

A. The Layer 2 switch rewrites VLAN tags before sending traffic to the FortiGate device.

B. The Layer 2 switches routes any traffic to the FortiGate device through an Ethernet link.

C. PLC1 and PLC2 traffic must flow through the Layer-2 switch trunk link to the FortiGate device.

D. In order to communicate, PLC1 must be in the same VLAN as PLC2.

An OT administrator is defining an incident notification policy using FortiSIEM and would like to configure the system with a notification policy. If an incident occurs, the administrator would like to be able to intervene and block an IP address or disable a user in Active Directory from FortiSIEM.

Which step must the administrator take to achieve this task?

A. Configure a fabric connector with a notification policy on FortiSIEM to connect with FortiGate.

B. Create a notification policy and define a script/remediation on FortiSIEM.

C. Define a script/remediation on FortiManager and enable a notification rule on FortiSIEM.

D. Deploy a mitigation script on Active Directory and create a notification policy on FortiSIEM.

An administrator wants to use FortiSoC and SOAR features on a FortiAnalyzer device to detect and block any unauthorized access to FortiGate devices in an OT network.

Which two statements about FortiSoC and SOAR features on FortiAnalyzer are true? (Choose two.)

A. You must set correct operator in event handler to trigger an event.

B. You can automate SOC tasks through playbooks.

C. Each playbook can include multiple triggers.

D. You cannot use Windows and Linux hosts security events with FortiSoC.

You are investigating a series of incidents that occurred in the OT network over past 24 hours in FortiSIEM.

Which three FortiSIEM options can you use to investigate these incidents? (Choose three.)

A. Security

B. IPS

C. List

D. Risk

E. Overview

What two advantages does FortiNAC provide in the OT network? (Choose two.)

A. It can be used for IoT device detection.

B. It can be used for industrial intrusion detection and prevention.

C. It can be used for network micro-segmentation.

D. It can be used for device profiling.

An OT supervisor needs to protect their network by implementing security with an industrial signature database on the FortiGate device.

Which statement about the industrial signature database on FortiGate is true?

A. A supervisor must purchase an industrial signature database and import it to the FortiGate.

B. An administrator must create their own database using custom signatures.

C. By default, the industrial database is enabled.

D. A supervisor can enable it through the FortiGate CLI.

Refer to the exhibit.

Based on the Purdue model, which three measures can be implemented in the control area zone using the Fortinet Security Fabric? (Choose three.)

A. FortiGate for SD-WAN

B. FortiGate for application control and IPS

C. FortiNAC for network access control

D. FortiSIEM for security incident and event management

E. FortiEDR for endpoint detection

What can be assigned using network access control policies?

A. Layer 3 polling intervals

B. FortiNAC device polling methods

C. Logical networks

D. Profiling rules

As an OT administrator, it is important to understand how industrial protocols work in an OT network. Which communication method is used by the Modbus protocol?

A. It uses OSI Layer 2 and the primary device sends data based on request from secondary device.

B. It uses OSI Layer 2 and both the primary/secondary devices always send data during the communication.

C. It uses OSI Layer 2 and both the primary/secondary devices send data based on a matching token ring.

D. It uses OSI Layer 2 and the secondary device sends data based on request from primary device.