Free Access to Fortinet.NSEI_OTS_AR-7.6.v2026-10-30.q30 with Valid Practice Test (Page 3)

Question 6

Refer to the exhibit.

The OT devices behind the ruggedized FortiGate have vulnerabilities and you want to apply a virtual patching profile in the firewall policy. Why is Virtual Patching not available in the Security Profiles section? (Choose one answer)

A.You must enable Virtual Patching in the Feature Visibility section.
B.You must have a ruggedized FortiGate allowing the virtual patching feature.
C.You must enable OT signatures.
D.You must have a valid OT security service license.

Question 7

Refer to the exhibit.

A basic event handler is shown. You have enabled Automation Stitch to automate the handling of an alert.
Which two steps must you take to use this automation stitch? (Choose two answers)

A.You must configure Action on FortiAnalyzer.
B.You must configure a Playbook task on FortiAnalyzer.
C.You must configure a FortiAnalyzer event handler trigger on FortiGate.
D.You must configure Rules on FortiAnalyzer.

Question 8

What is the next step if FortiGate cannot detect a device locally? (Choose one answer)

A.FortiGate queries the local device database (CIDB).
B.FortiGate queries FortiGuard servers.
C.FortiGate queries OT servers through service connectors.
D.FortiGate queries the profiling rules.

Question 9

Refer to the exhibit. A partial OT network is shown. You must improve the security of this OT network and implement internal segmentation between network 1 and network 2. How can you achieve the segmentation?
(Choose one answer)

A.You can configure universal ZTNA.
B.You can configure one traffic VDOM.
C.You can configure an explicit software switch.
D.You can configure forward domain IDs for each network.

Question 10

Refer to the exhibits.

A partial Incident Analysis page and the log details related to the event are shown. An attack is reported on your OT network. You analyze the corresponding incident. Based on the information provided on the Incident Analysis page and the log details, which two statements are correct? (Choose two answers)

A.The attack uses the Modbus protocol.
B.The attack is mitigated.
C.The attack uses the IEC 104 protocol.
D.The event severity is high.
E.The target device IP address is 10.1.5.20.

Correct Answer: A,B

Based on the technical data provided in the exhibits and the OT Security 7.6 Architect curriculum:
* Industrial Protocol Identification (Statement A) : The log details exhibit clearly shows that the Destination Port used in the attack is 502 . According to the study guide ' s section on Industrial Protocol Protection , the standard port used by the Modbus TCP protocol is 502 . Furthermore, the attack name identifies a " Triangle.Research.Nano-10.PLC, " which are industrial controllers commonly utilizing Modbus for communications.
* Attack Mitigation (Statement B) : The log details specify that the Action taken by the FortiGate (Edge-FortiGate) was dropped . In cybersecurity and Fortinet fabric operations, dropping a packet associated with an IPS signature means the traffic was blocked from reaching its target, thereby mitigating the attack.
* Target IP Address (Statement E) : The log detail explicitly lists the Destination IP as 192.168.2.3 .
The Incident Analysis page also titles the incident with dstip:192.168.2.3. While the " Affected Endpoint " is shown as 10.1.5.20 , in an " outgoing " attack direction (as shown in the log), this likely refers to the internal source/attacker IP, whereas the target is the destination IP (192.168.2.3). Thus, Statement E is incorrect.
* Protocol Conflict (Statement C) : The IEC 104 protocol typically utilizes port 2404 . Since the log specifies port 502, Statement C is incorrect.
* Severity Distinction (Statement D) : While the Incident severity is marked as High , the question specifically asks about event severity. The " Events " table at the bottom of the Incident Analysis page shows a " User login/logout failed " event with a medium severity. Because there is a distinction in the management console between the severity of individual events and the aggregated incident, and Statement A and B are technically definitive based on port and action, A and B are the correct architectural choices.

Question 6

Question 7

Question 8

Question 9

Question 10

Download PDF File