Fortinet NSEI_OTS_AR-7.6 Practice Exam Questions & Answers

According to the OT Security 7.6 Architect study guide section on Asset Management, specifically regarding FortiNAC Visibility:

Layer 2 Polling Data: Because each physical address is unique, FortiNAC identifies hosts as they connect to the network. The information gathered during this process fills in the physical address and location information in the database.

Visibility Components: The guide states that the physical address learned, the time it was learned, and where it was learned from provide the foundation of endpoint visibility in the form of 'what, where, and when' information. This confirms that Where it was learned (Option A) and The time it was learned (Option D) are correct.

Exclusions:

Layer 3 Polling: The MAC-to-IP correlation (Option B) is explicitly defined as a function of Layer 3 polling, where the correlated IP address is added to the database record for the corresponding MAC address.

DHCP Fingerprinting: The host name or system name (Option C) and the operating system are gathered via DHCP fingerprinting, not layer 2 polling.

The correct answer is C. The output of the CLI command get rule otvp status. In the Virtual Patching section, the study guide shows the workflow where FortiGate queries FortiGuard for device-specific vulnerabilities, receives OT virtual patching signatures, maps them to the device MAC address, and then explicitly displays the CLI verification command get rule otvp status together with fields such as Rule-name, Vuln_type, and Cve. This is the direct confirmation mechanism shown in the guide for checking whether OT devices have virtual patching rules associated with them.

The other options are less accurate for confirmation. The OT View page is for Purdue-level visualization, and the Asset Identity List page shows device and asset information, but neither is presented in the guide as the command or control used to verify virtual patching status. The study guide specifically uses get rule otvp status as the status check tied to virtual patching behavior.

The study guide says playbooks are used to automate tasks such as running reports and creating/updating incidents. It also says that after a playbook is triggered, it flows through its configured tasks.

It further shows a sample playbook sequence where an event is detected, an incident is created, a report runs, and details are attached to the incident. That is exactly the kind of workflow shown in the incident analysis view.

By contrast, the study guide says event handlers generate events when logs match configured rules. Event handlers are for detection, not for attaching reports to incidents.

The correct answers are C and D.

Option D is correct because the Playbook Monitor clearly shows the starter as On_Demand and the trigger as user(admin). The study guide states that ''ON_DEMAND: The playbook runs when an administrator manually starts it'' and also notes that to run it manually, you select the playbook and click Run. This exactly matches the exhibit, so the playbook was manually triggered.

Option C is also correct. The study guide explains that ''tasks run one after another'' and that ''if needed, the output of one task can be used by the tasks that follow it.'' It also gives an example where workflow logic matters, such as creating an incident and then attaching details to it. In the exhibit, the sequence shown is Attach_report, then Run_report, then Create_Incident, while the incident analysis shows no report attached. Since the report must exist and the incident must already be available before it can be attached properly, the task order is wrong and must be reordered.

Option B is incorrect because the monitor shows multiple tasks completed successfully, not only Create_Incident. Option A is not the best answer because the main problem demonstrated by the exhibits is not simply waiting time, but the incorrect workflow order. The playbook completed successfully, yet the report is still not attached, which indicates a design issue in the task sequence rather than just a delay.

The verified answer is C. The Fabric settings. The study guide ties FortiAnalyzer-triggered actions to the Security Fabric relationship with FortiGate, not to playbook tasks or standalone event handlers alone. It explains that ''within the Security Fabric environment, FortiAnalyzer is a key element in the creation of automation stitches'' and shows the flow where a downstream FortiGate sends logs to FortiAnalyzer, then FortiAnalyzer parses the logs and notifies the root FortiGate, after which the root FortiGate triggers the action. This shows that FortiAnalyzer must be configured so it can communicate with FortiGate through the Security Fabric.

The guide also states that FortiAnalyzer is the foundation of the Security Fabric, providing logging, reporting, analytics, and automation for Fabric devices and endpoints. It further explains that the FortiAnalyzer Fabric connector consolidates the traffic logs within the Security Fabric. This confirms that the automation workflow depends on proper Security Fabric integration. A playbook task is used for automated SOC actions, and an event handler is used to generate events from logs, but neither one alone establishes the direct communication path needed between FortiAnalyzer and FortiGate. Therefore, the required configuration on FortiAnalyzer is the Fabric settings.

According to the OT Security 7.6 Architect study guide regarding IEC 62443 Security Levels:

Security Level 4 (SL 4) Definition: This level provides 'Protection against intentional violation using sophisticated means with extended resources, specific skills, and high motivation'.

Real-World Application: The study guide specifically notes: 'If you are facing a syndicate of cyber extortionists with extensive resources and capabilities, then you should strive for security level 4'.

Comparison to other levels:

SL 1: Protection against 'casual or unintentional system violation'.

SL 2: Protection against 'intentional violation using simple means with low resources'.

SL 3: Protection against 'intentional violation using sophisticated means with moderate resources'.

According to the OT Security 7.6 Architect study guide regarding the Purdue Model:

Asset Location: The study guide states that 'All critical physical assets are located on the plant floor and equipped with IIoT sensors.'

Level Classification: The 'plant floor' is further defined as the 'control area zone,' which consists of Levels 0, 1, and 2.

Hierarchy: The 'Operations & Control' zone is identified as Level 3 and Level 3.5.

Direct Answer: In the 'Introduction' lesson's Knowledge Check, the specific question