Fortinet NSEI_OTS_AR-7.6 - Fortinet NSE I - OT Security 7.6 Architect

The correct answer is C. You can implement parallel redundancy protocol . The study guide explains that media redundancy involves creating a backup path that can be used when part of the network fails and specifically states that “Parallel Redundancy Protocol (PRP) can be used for a star topology.” Since the problem described is many disconnections in the links , the issue is link availability, which is a media redundancy problem rather than a firewall virtualization or policy separation problem. PRP is designed to provide a backup communication path with low recovery time when links fail.

The other options do not fit this scenario as well. HA clusters are described in the guide as a solution for network node redundancy , where a backup firewall or switch takes over when the primary device fails. SD-WAN is recommended for remote site access across multiple WAN links, not for the local floor links shown in this topology. VDOMs provide logical segmentation, not link redundancy or higher link availability. Because the question is specifically about repeated link disconnections , the best action is to implement PRP .

According to the OT Security 7.6 Architect study guide regarding IEC 62443 Security Levels :

Security Level 4 (SL 4) Definition : This level provides " Protection against intentional violation using sophisticated means with extended resources, specific skills, and high motivation " .

Real-World Application : The study guide specifically notes: " If you are facing a syndicate of cyber extortionists with extensive resources and capabilities, then you should strive for security level 4 " .

Comparison to other levels :

SL 1 : Protection against " casual or unintentional system violation " .

SL 2 : Protection against " intentional violation using simple means with low resources " .

SL 3 : Protection against " intentional violation using sophisticated means with moderate resources " .

The correct answer is C . This scenario is the precise use case for virtual patching . The OT Security 7.6 study guide states that virtual patching protects OT devices that have not yet been updated against vulnerability exploits . FortiGate identifies the vulnerable asset, queries FortiGuard for device-specific vulnerabilities and mitigation rules, receives applicable OT virtual-patching signatures, and maps those rules to the device. When traffic associated with the vulnerable asset reaches FortiGate, the firewall policy containing the virtual-patching profile applies the protection. In the topology, FortiGate_Level2 is the enforcement point immediately protecting PLC-1 and the control-network assets. IPS at Level 5 provides broader perimeter protection, but it is not the device-specific compensating control requested here. Application Control primarily regulates industrial protocols and commands. Therefore, Virtual patching on FortiGate_Level2 is required.

================

The correct answer is C. Application sensor set to monitor on all the FortiGate devices .

The study guide clearly explains that application control is the feature used to identify OT protocols. It states that “application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages” and also says “You can use application control signatures to detect OT protocols.” It further shows an example where a Modbus application control profile is enabled on a firewall policy “for OT protocol visibility in the monitor status.” This directly matches the requirement in the question, which is to detect OT protocols and increase traffic visibility .

The other options do not fit the requirement as precisely. Device detection is for identifying devices and collecting endpoint information, not for detecting industrial protocols. Inline IDS and IPS are focused more on detecting or blocking attacks, exploits, protocol abnormalities, and known vulnerabilities. While IPS can inspect some OT traffic, the study guide distinguishes it from application control by stating that IPS signatures tend to detect exploits, whereas application control signatures tend to provide protocol detection at various levels . Therefore, the required security sensor for OT protocol detection and traffic visibility is the application sensor in monitor mode .

The correct answers are A and C . The study guide explains that “You can use application control signatures to detect OT protocols” and that application control provides “granular message type identification.” In the exhibit, the Operational Technology application category is included in the Application Sensor profile, so OT application signatures are enabled in this profile.

Option C is also correct because the override table shows Modbus_Read.Holding.Registers = Allow and Modbus = Block . The study guide states that you can use specific granular application control signatures to allow a specific Modbus command and block all others , and it also shows that application control can identify read and write commands separately at message level. Therefore, Modbus write commands are blocked by this profile.

Option B is incorrect because the profile is not simply monitoring all OT protocols; it contains a Block action for Modbus. Option D is incorrect because the study guide links OT protocol visibility specifically to the monitor status , while in the exhibit Modbus_Read.Holding.Registers is set to Allow , not Monitor .

ï‚· The study guide says playbooks are used to automate tasks such as running reports and creating/updating incidents . It also says that after a playbook is triggered, it flows through its configured tasks.

ï‚· It further shows a sample playbook sequence where an event is detected, an incident is created , a report runs , and details are attached to the incident . That is exactly the kind of workflow shown in the incident analysis view.

ï‚· By contrast, the study guide says event handlers generate events when logs match configured rules. Event handlers are for detection, not for attaching reports to incidents.

The correct answers are C and E . Fortinet states that the SOC Dashboard provides an effective visualization of reported incidents and events and, through Security Fabric integration, enables administrators to gain complete visibility of the entire attack surface . The MITRE ATT & CK Attack view complements this by presenting incident and event information according to ATT & CK-defined attack tactics and techniques, allowing analysts to understand where observed activity maps into known adversary behavior. The MITRE Coverage view has a different purpose—it measures event-handler coverage—while the Attack view focuses on actual incidents and events. Risk Summary and Resources Reports are associated primarily with FortiSIEM reporting functions, and Analytics Search is a query and investigation mechanism rather than a consolidated attack-surface view. Therefore, the required FortiAnalyzer views are MITRE ATT & CK Attack and SOC Dashboard .

================

The correct answers are C. Vendor OUI and D. Network traffic .

The study guide explicitly separates active/direct profiling methods from passive/non-direct methods and states that “In OT environments, passive methods are preferred over active methods.” It then lists the methods that do not require FortiNAC to interact directly with the device being profiled. Among those methods are “Network traffic: gathered from the infrastructure” and “Vendor OUI: determined by the MAC address gathered from the infrastructure.” That directly matches options C and D .

Options A and B are incorrect because SSH and SNMP are shown in the guide under the direct/active profiling methods. The guide’s point is that passive detection avoids directly scanning or interacting with OT endpoints, since that can negatively affect performance in industrial environments. Because the question specifically asks for passive detection methods, the correct pair is Vendor OUI and Network traffic .

The correct answers are B and D .

Option B is correct because the profile has Medium , High , and Critical selected, while Low severity is not selected. That means low-severity virtual patching signatures are not enforced by this profile. So for the device with MAC address 12:12:12:12:12 , low-severity signatures are not blocked. The study guide explains virtual patching as device-specific protection where “FortiGate caches the signatures and mitigation rules that apply to each device” and applies them when the related traffic matches the firewall policy.

Option D is correct because the Virtual Patching Exemptions table shows a row with the MAC address 11:11:11:11:11 and no specific signature listed. The study guide states that in the Virtual Patching profile you can “Exempt a specific device with the MAC address or a specific signature.” A MAC-only exemption means that specific device is excluded from virtual patching enforcement, so in practical terms it is treated as having no applicable vulnerabilities in this profile.

Option C is incorrect because the profile does not block critical signatures for all devices. The exemptions list proves that at least one device can be excluded by MAC address, and a specific signature can also be exempted. Therefore, enforcement is not universal across all devices.

Option A is incorrect because the entry Schneider.Electric.ClearSCADA.HTTP.Interface.XSS appears as a specific signature exemption , not as the only remaining vulnerability. The profile display is showing exemptions, not a statement that only one vulnerability is still present.