NSE6_OTS_AR-7.6 Exam Dumps - Try Best NSE6_OTS_AR-7.6 Exam Questions from Training Expert PassSureExam
Practice Examples and Dumps & Tips for 2026 Latest NSE6_OTS_AR-7.6 Valid Tests Dumps
Fortinet NSE6_OTS_AR-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 32
An OT administrator is defining an incident notification policy using FortiSIEM and would like to configure the system with a notification policy. If an incident occurs, the administrator would like to be able to intervene and block an IP address or disable a user in Active Directory from FortiSIEM. Which step must the administrator take to achieve this task?
- A. Deploy a mitigation script on Active Directory and create a notification policy on FortiSIEM.
- B. Configure a fabric connector with a notification policy on FortiSIEM to connect with FortiGate.
- C. Create a notification policy and define a script/remediation on FortiSIEM.
- D. Define a script/remediation on FortiManager and enable a notification rule on FortiSIEM.
Answer: C
Explanation:
https://fusecommunity.fortinet.com/blogs/silviu/2022/04/12/fortisiempublishingscript
NEW QUESTION # 33
Refer to the exhibit.
You have configured event handlers on FortiAnalyzer to monitor your OT network.
Based on the partial Event Monitor page shown in the exhibit, which statement is correct?
- A. The corresponding IPS log has a quarantine action.
- B. The Web.Client event is unhandled.
- C. The corresponding IPS log has a block or drop action.
- D. The Web.Client event is contained.
Answer: C
Explanation:
The IPS event status is shown as Mitigated, which indicates the threat was successfully stopped by the security control. For IPS logs, this corresponds to traffic being blocked or dropped rather than merely detected.
NEW QUESTION # 34
An OT administrator deployed many devices to secure the OT network. However, the SOC team is reporting that there are too many alerts, and that many of the alerts are false positive. The OT administrator would like to find a solution that eliminates repetitive tasks, improves efficiency, saves time, and saves resources.
Which products should the administrator deploy to address these issues and automate most of the manual tasks done by the SOC team?
- A. FortiSIEM and FortiManager
- B. FortiSOAR and FortiSIEM
- C. FortiSandbox and FortiSIEM
- D. A syslog server and FortiSIEM
Answer: B
Explanation:
The OT administrator should deploy FortiSOAR and FortiSIEM (Option C) to automate manual tasks, reduce false positives, and improve SOC efficiency, because FortiSIEM consolidates and analyzes logs for comprehensive security visibility, while FortiSOAR provides the automation and orchestration to respond to alerts with playbooks, effectively streamlining workflows and freeing up SOC resources.
NEW QUESTION # 35
Refer to the exhibit.
The Core Network Security Connectors page of the FortiGate-2 device is shown. Which statement is correct? (Choose one answer)
- A. You must enable Security Fabric Connection on the FortiGate-2 interface.
- B. You must configure the FortiAnalyzer settings on FortiGate-2.
- C. FortiGate-2 serves as Fabric Root.
- D. FortiGate-2 is not authorized on the root FortiGate.
Answer: D
Explanation:
Based on the provided exhibit and the OT Security 7.6 Architect curriculum regarding the Fortinet Security Fabric:
Fabric Role: The exhibit clearly shows that FortiGate-2 has the role set to Join Fabric. This confirms it is a downstream device and not the Fabric Root (eliminating Option A).
Upstream Connection: The device is configured to point to an Upstream FortiGate at IP address 10.1.2.254.
Fabric Status: The status is currently displayed as Not Connected. In a standard Fortinet Security Fabric deployment, once a downstream device is configured to join the fabric, it sends a request to the upstream root device. The root FortiGate must then explicitly authorize the downstream unit before the connection is established and the status changes to "Connected." Authorization Requirement: The "Not Connected" status, while having the upstream IP correctly configured, is the classic indicator that the authorization step is pending on the root FortiGate. Furthermore, under the LAN Edge Devices section, it shows another downstream FortiGate requiring authorization on this specific unit, highlighting that authorization is a manual security requirement for all stages of the Fabric hierarchy.
FortiAnalyzer Status: While the Logging & Analytics section shows FortiAnalyzer is Disabled, this is a configuration choice and does not prevent the Security Fabric from connecting; therefore, configuring it is not the solution to the connectivity status shown (eliminating Option C).
In summary, FortiGate-2 cannot join the fabric until an administrator logs into the Root FortiGate (10.1.2.254) and authorizes the join request from FortiGate-2.
NEW QUESTION # 36
Refer to the exhibit. PLC-3 and CLIENT can send traffic to PLC-1 and PLC-2. FGT-2 has only one software switch (SSW-2) connecting both PLC-3 and CLIENT. PLC-3 and CLIENT can send traffic to each other at the layer 2 level.
What must the operational technology (OT) admin do to prevent layer 2-level communication between PLC-3 and CLIENT?
- A. Implement policy routes on FGT-2 to control traffic between devices.
- B. Set a unique forward domain for each interface of the software switch.
- C. Enable explicit intra-switch policy to require firewall policies on FGT-2.
- D. Create a VLAN for each device and replace the current FGT-2 software switch members.
Answer: C
Explanation:
Set the software switch to explicit intra-switch policy so traffic between its member ports must pass through FortiGate policies instead of being bridged at Layer 2. This stops PLC‑3 and CLIENT from communicating directly at L2.
NEW QUESTION # 37
Which three Fortinet products can you use for device identification in an OT industrial control system (ICS)? (Choose three.)
- A. FortiNAC
- B. FortiGate
- C. FortiManager
- D. FortiSIEM
- E. FortiAnalyzer
Answer: A,B,D
Explanation:
FortiNAC continuously collects identity records, profiles, and classifies devices in OT networks using a variety of methods including active and passive scanning.
FortiGate contributes by providing session and flow data that helps in device identification and classification.
FortiSIEM aggregates security and operational data from various sources including FortiGate and FortiNAC to provide comprehensive visibility and identification.
NEW QUESTION # 38
You want FortiAnalyzer to trigger an automation stitch on a FortiGate device automatically. What must you configure on FortiAnalyzer to enable direct communication with FortiGate? (Choose one answer)
- A. The Fabric settings
- B. A Fabric connector
- C. A playbook task
- D. An event handler
Answer: A
Explanation:
The verified answer is C. The Fabric settings. The study guide ties FortiAnalyzer-triggered actions to the Security Fabric relationship with FortiGate, not to playbook tasks or standalone event handlers alone. It explains that "within the Security Fabric environment, FortiAnalyzer is a key element in the creation of automation stitches" and shows the flow where a downstream FortiGate sends logs to FortiAnalyzer, then FortiAnalyzer parses the logs and notifies the root FortiGate, after which the root FortiGate triggers the action. This shows that FortiAnalyzer must be configured so it can communicate with FortiGate through the Security Fabric.
The guide also states that FortiAnalyzer is the foundation of the Security Fabric, providing logging, reporting, analytics, and automation for Fabric devices and endpoints. It further explains that the FortiAnalyzer Fabric connector consolidates the traffic logs within the Security Fabric. This confirms that the automation workflow depends on proper Security Fabric integration. A playbook task is used for automated SOC actions, and an event handler is used to generate events from logs, but neither one alone establishes the direct communication path needed between FortiAnalyzer and FortiGate. Therefore, the required configuration on FortiAnalyzer is the Fabric settings.
NEW QUESTION # 39
Refer to the exhibit, which shows a non-protected OT environment.
An administrator needs to implement proper protection on the OT network. Which three steps should an administrator take to protect the OT network? (Choose three.)
- A. Deploy a FortiGate device within each ICS network.
- B. Configure firewall policies with web filter to protect the different ICS networks.
- C. Deploy an edge FortiGate between the internet and an OT network as a one-arm sniffer.
- D. Use segmentation
- E. Configure firewall policies with industrial protocol sensors
Answer: A,D,E
NEW QUESTION # 40
Which three criteria can a FortiGate device use to look for a matching firewall policy to process traffic? (Choose three.)
- A. Source defined as internet services in the firewall policy
- B. Services defined in the firewall policy.
- C. Destination defined as internet services in the firewall policy
- D. Highest to lowest priority defined in the firewall policy
- E. Lowest to highest policy ID number
Answer: A,B,C
Explanation:
When a packet arrives, how does FortiGate find a matching policy?
Each policy has match criteria, which you can define using the following objects:
* Incoming Interface
* Outgoing Interface
* Source: IP address, user, internet services
* Destination: IP address or internet services
* Service: IP protocol and port number
* Schedule: Applies during configured times
NEW QUESTION # 41
During layer 2 polling, which two pieces of information are gathered by FortiNAC to identify a device? (Choose two answers)
- A. Where it was learned
- B. The time it was learned
- C. The MAC-to-IP correlation learned
- D. The system name learned
Answer: A,B
Explanation:
According to the OT Security 7.6 Architect study guide section on Asset Management, specifically regarding FortiNAC Visibility:
Layer 2 Polling Data: Because each physical address is unique, FortiNAC identifies hosts as they connect to the network. The information gathered during this process fills in the physical address and location information in the database.
Visibility Components: The guide states that the physical address learned, the time it was learned, and where it was learned from provide the foundation of endpoint visibility in the form of "what, where, and when" information. This confirms that Where it was learned (Option A) and The time it was learned (Option D) are correct.
Exclusions:
Layer 3 Polling: The MAC-to-IP correlation (Option B) is explicitly defined as a function of Layer 3 polling, where the correlated IP address is added to the database record for the corresponding MAC address.
DHCP Fingerprinting: The host name or system name (Option C) and the operating system are gathered via DHCP fingerprinting, not layer 2 polling.
NEW QUESTION # 42
Which three protocols are used as industrial Ethernet protocols? (Choose three.)
- A. M12
- B. PROFINET
- C. EtherNet/IP
- D. RJ45
- E. EtherCAT
Answer: B,C,E
NEW QUESTION # 43
Refer to the exhibit. Which statement is true about application control inspection?
- A. The parent signature takes precedence over the child application signature.
- B. The industrial application control inspection process is unique among application categories.
- C. You can control security actions only on the parent-level application signature
- D. Security actions cannot be applied on the lowest level of the hierarchy.
Answer: A
Explanation:
Application control inspection in Fortinet firewalls utilizes a hierarchical structure where applications are categorized and classified. A parent signature encompasses a group of related child applications. If a security action is defined on the parent signature, it will apply to all child applications within that group. Therefore, the parent signature takes precedence over the child application signature, meaning if a child application is allowed access based on its own signature but the parent signature has a blocking rule, the child application will still be blocked.
NEW QUESTION # 44
Which two of the following features do most industrial protocols lack? (Choose two.)
- A. Real-time data exchange
- B. Authentication
- C. TLS encryption
- D. Deterministic timing
Answer: B,C
Explanation:
Most legacy OT/industrial protocols were built for speed and determinism, not security, so they typically omit built-in TLS encryption and authentication mechanisms.
NEW QUESTION # 45
During layer 2 polling , which two pieces of information are gathered by FortiNAC to identify a device?
(Choose two answers)
- A. Where it was learned
- B. The time it was learned
- C. The MAC-to-IP correlation learned
- D. The system name learned
Answer: A,B
Explanation:
According to the OT Security 7.6 Architect study guide section on Asset Management , specifically regarding FortiNAC Visibility :
* Layer 2 Polling Data : Because each physical address is unique, FortiNAC identifies hosts as they connect to the network. The information gathered during this process fills in the physical address and location information in the database.
* Visibility Components : The guide states that the physical address learned , the time it was learned , and where it was learned from provide the foundation of endpoint visibility in the form of " what, where, and when " information. This confirms that Where it was learned (Option A) and The time it was learned (Option D) are correct.
* Exclusions :
* Layer 3 Polling : The MAC-to-IP correlation (Option B) is explicitly defined as a function of Layer 3 polling , where the correlated IP address is added to the database record for the corresponding MAC address.
* DHCP Fingerprinting : The host name or system name (Option C) and the operating system are gathered via DHCP fingerprinting , not layer 2 polling.
NEW QUESTION # 46
Refer to the exhibit. A partial OT network is shown.
In this OT network, you must add additional security measures to detect OT protocols and, therefore, increase the traffic visibility.
Which security sensor must you implement to delect the OT protocols in this network? (Choose one answer)
- A. Device detection on all the FortiGate interfaces
- B. Inline IDS on FortiGate_Level3
- C. IPS sensor on FortiGate Level5
- D. Application sensor set to monitor on all the FortiGate devices
Answer: D
NEW QUESTION # 47
......
Latest 100% Passing Guarantee - Brilliant NSE6_OTS_AR-7.6 Exam Questions PDF: https://actualtests.passsureexam.com/NSE6_OTS_AR-7.6-pass4sure-exam-dumps.html