Updated Oct-2024 Exam Engine for NSE7_OTS-7.2 Exam Free Demo & 365 Day Updates

Exam Passing Guarantee NSE7_OTS-7.2 Exam with Accurate Quastions!

Fortinet NSE7_OTS-7.2 certification exam is a rigorous exam that requires candidates to demonstrate their knowledge and skills in a variety of areas. Candidates are required to pass a written exam and a practical lab exam to obtain the certification. The written exam consists of multiple choice questions, while the lab exam requires candidates to complete hands-on exercises in a simulated OT network environment.

 

NEW QUESTION # 21
An OT network consists of multiple FortiGate devices. The edge FortiGate device is deployed as the secure gateway and is only allowing remote operators to access the ICS networks on site.
Management hires a third-party company to conduct health and safety on site. The third-party company must have outbound access to external resources.
As the OT network administrator, what is the best scenario to provide external access to the third-party company while continuing to secure the ICS networks?

• A. Split the edge FortiGate device into multiple logical devices to allocate an independent VDOM for the third-party company.
• B. Configure outbound security policies with limited active authentication users of the third-party company.
• C. Create VPN tunnels between downstream FortiGate devices and the edge FortiGate to protect ICS network traffic.
• D. Implement an additional firewall using an additional upstream link to the internet.

Answer: A

NEW QUESTION # 22
Which two statements about FortiSIEM are true? (Choose two.)

• A. FortiSIEM can receive and collect data from network devices and applications.
• B. FortiSIEM can receive data from any network device and application.
• C. FortiSIEM cannot receive data from a Windows server without an agent.
• D. FortiSIEM can receive data from certain devices in SQL format.

Answer: A,C

NEW QUESTION # 23
Refer to the exhibit. An OT network security audit concluded that the application sensor requires changes to ensure the correct security action is committed against the overrides filters.
Which change must the OT network administrator make?

• A. Set the priority of the C.BO.NA.1 signature override to 1.
• B. Set all application categories to apply default actions.
• C. Change the security action of the industrial category to monitor.
• D. Remove IEC.60870.5.104 Information.Transfer from the first filter override.

Answer: A

Explanation:
The application sensor settings allow you to configure the security action for each application category and network protocol override. The security action determines how the FortiGate unit handles traffic that matches the application category or network protocol override. The security action can be one of the following:
Allow: The FortiGate unit allows the traffic without any further inspection. Monitor: The FortiGate unit allows the traffic and logs it for monitoring purposes.
Block: The FortiGate unit blocks the traffic and logs it as an attack. The priority of the network protocol override determines the order in which the FortiGate unit applies the security action to the traffic. The lower the priority number, the higher the priority. For example, a priority of 1 is higher than a priority of 10. In the exhibit, the application sensor has the following settings:
The industrial category has a security action of allow, which means that the FortiGate unit will not inspect or log any traffic that belongs to this category. The IEC.60870.5.104 Information.Transfer network protocol override has a security action of block, which means that the FortiGate unit will block and log any traffic that matches this protocol. The IEC.60870.5.104 Control.Functions network protocol override has a security action of monitor, which means that the FortiGate unit will allow and log any traffic that matches this protocol. The IEC.60870.5.104 Start/Stop network protocol override has a security action of allow, which means that the FortiGate unit will not inspect or log any traffic that matches this protocol. The IEC.60870.5.104 Transfer.C.BO.NA.1 network protocol override has a security action of block, which means that the FortiGate unit will block and log any traffic that matches this protocol. The problem with these settings is that the IEC.60870.5.104 Transfer.C.BO.NA.1 network protocol override has a lower priority than the IEC.60870.5.104 Information.Transfer network protocol override. This means that if the traffic matches both protocols, the FortiGate unit will apply the security action of the higher priority override, which is block. However, the IEC.60870.5.104 Transfer.C.BO.NA.1 protocol is used to transfer binary outputs, which are essential for controlling OT devices. Therefore, blocking this protocol could have negative consequences for the OT network. To fix this issue, the OT network administrator must set the priority of the IEC.60870.5.104 Transfer.C.BO.NA.1 network protocol override to 1, which is higher than the priority of the IEC.60870.5.104 Information.Transfer network protocol override. This way, the FortiGate unit will apply the security action of the lower priority override, which is allow, to the traffic that matches both protocols. This will ensure that the FortiGate unit does not block the traffic that is used to transfer binary outputs, while still blocking the traffic that is used to transfer information.

NEW QUESTION # 24
Refer to the exhibits. Which statement is true about the traffic passing through to PLC-2?

• A. IEC 104 signatures are all allowed except the C.BO.NA 1 signature.
• B. IPS must be enabled to inspect application signatures.
• C. SSL Inspection must be set to deep-inspection to correctly apply application control.
• D. The application filter overrides the default action of some IEC 104 signatures.

Answer: D

NEW QUESTION # 25
Which two frameworks are common to secure ICS industrial processes, including SCADA and DCS? (Choose two.)

• A. IEC104
• B. NIST Cybersecurity
• C. IEC 62443
• D. Modbus

Answer: A,C

NEW QUESTION # 26
Refer to the exhibit. Based on the Purdue model, which three measures can be implemented in the control area zone using the Fortinet Security Fabric? (Choose three.)

• A. FortiSIEM for security incident and event management
• B. FortiNAC for network access control
• C. FortiEDR for endpoint detection
• D. FortiGate for SD-WAN
• E. FortiGate for application control and IPS

Answer: B,C,E

NEW QUESTION # 27
What triggers Layer 2 polling of infrastructure devices connected in the network?

• A. A failed Layer 3 poll
• B. A matched profiling rule
• C. A matched security policy
• D. A linkup or linkdown trap

Answer: D

NEW QUESTION # 28
An OT administrator is defining an incident notification policy using FortiSIEM and would like to configure the system with a notification policy. If an incident occurs, the administrator would like to be able to intervene and block an IP address or disable a user in Active Directory from FortiSIEM.
Which step must the administrator take to achieve this task?

• A. Define a script/remediation on FortiManager and enable a notification rule on FortiSIEM.
• B. Deploy a mitigation script on Active Directory and create a notification policy on FortiSIEM.
• C. Create a notification policy and define a script/remediation on FortiSIEM.
• D. Configure a fabric connector with a notification policy on FortiSIEM to connect with FortiGate.

Answer: C

Explanation:
https://fusecommunity.fortinet.com/blogs/silviu/2022/04/12/fortisiempublishingscript

NEW QUESTION # 29
An administrator wants to use FortiSoC and SOAR features on a FortiAnalyzer device to detect and block any unauthorized access to FortiGate devices in an OT network. Which two statements about FortiSoC and SOAR features on FortiAnalyzer are true? (Choose two.)

• A. You can automate SOC tasks through playbooks.
• B. You cannot use Windows and Linux hosts security events with FortiSoC.
• C. Each playbook can include multiple triggers.
• D. You must set correct operator in event handler to trigger an event.

Answer: A,D

Explanation:
Ref: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/268882/fortisoc

NEW QUESTION # 30
As an OT network administrator, you are managing three FortiGate devices that each protect different levels on the Purdue model. To increase traffic visibility, you are required to implement additional security measures to detect exploits that affect PLCs. Which security sensor must implement to detect these types of industrial exploits?

• A. Application control
• B. Intrusion prevention system (IPS)
• C. Antivirus inspection
• D. Deep packet inspection (DPI)

Answer: D

NEW QUESTION # 31
The OT network analyst runs different level of reports to quickly explore threats that exploit the network. Such reports can be run on all routers, switches, and firewalls. Which FortiSIEM reporting method helps to identify these type of exploits of image firmware files?

• A. Threat hunting reports
• B. OT/loT reports
• C. CMDB reports
• D. Compliance reports

Answer: A

NEW QUESTION # 32
Refer to the exhibit, which shows a non-protected OT environment.

An administrator needs to implement proper protection on the OT network.
Which three steps should an administrator take to protect the OT network? (Choose three.)

• A. Deploy an edge FortiGate between the internet and an OT network as a one-arm sniffer.
• B. Configure firewall policies with web filter to protect the different ICS networks.
• C. Deploy a FortiGate device within each ICS network.
• D. Configure firewall policies with industrial protocol sensors
• E. Use segmentation

Answer: A,B,D

NEW QUESTION # 33
When you create a user or host profile, which three criteria can you use? (Choose three.)

• A. Administrative group membership
• B. Host or user attributes
• C. An existing access control policy
• D. Host or user group memberships
• E. Location

Answer: B,D,E

Explanation:
Explanation
https://docs.fortinet.com/document/fortinac/9.2.0/administration-guide/15797/user-host-profiles

NEW QUESTION # 34
An administrator wants to use FortiSoC and SOAR features on a FortiAnalyzer device to detect and block any unauthorized access to FortiGate devices in an OT network.
Which two statements about FortiSoC and SOAR features on FortiAnalyzer are true? (Choose two.)

• A. You can automate SOC tasks through playbooks.
• B. You cannot use Windows and Linux hosts security events with FortiSoC.
• C. Each playbook can include multiple triggers.
• D. You must set correct operator in event handler to trigger an event.

Answer: A,D

Explanation:
Ref: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/268882/fortisoc

NEW QUESTION # 35
An OT supervisor has configured LDAP and FSSO for the authentication. The goal is that all the users be authenticated against passive authentication first and, if passive authentication is not successful, then users should be challenged with active authentication. What should the OT supervisor do to achieve this on FortiGate?

• A. Configure a firewall policy with LDAP users and place it on the top of list of firewall policies.
• B. Under config user settings configure set auth-on-demand implicit.
• C. Configure a firewall policy with FSSO users and place it on the top of list of firewall policies.
• D. Enable two-factor authentication with FSSO.

Answer: C

Explanation:
The OT supervisor should configure a firewall policy with FSSO users and place it on the top of list of firewall policies in order to achieve the goal of authenticating users against passive authentication first and, if passive authentication is not successful, then challenging them with active authentication.

NEW QUESTION # 36
An administrator wants to use FortiSoC and SOAR features on a FortiAnalyzer device to detect and block any unauthorized access to FortiGate devices in an OT network.
Which two statements about FortiSoC and SOAR features on FortiAnalyzer are true? (Choose two.)

• A. You can automate SOC tasks through playbooks.
• B. You cannot use Windows and Linux hosts security events with FortiSoC.
• C. Each playbook can include multiple triggers.
• D. You must set correct operator in event handler to trigger an event.

Answer: A,D

Explanation:
Explanation
Ref: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/268882/fortisoc

NEW QUESTION # 37
Refer to the exhibit. The IPS profile is added on all of the security policies on FortiGate. For an OT network, which statement of the IPS profile is true?

• A. FortiGate has no IPS industrial signature database enabled.
• B. The listed IPS signatures are classified as SCADAapphcat nns
• C. The IPS profile inspects only traffic originating from SCADA equipment.
• D. All IPS signatures are overridden and must block traffic match signature patterns.

Answer: B

NEW QUESTION # 38
Refer to the exhibits.

Which statement about some of the generated report elements from FortiAnalyzer is true?

• A. FortiGate collects the logs and generates the report to FortiAnalyzer.
• B. This report is predefined and is not available for customization.
• C. The file types confirm the infected applications on the PLCs.
• D. The report confirms Modbus and IEC 104 are the key applications crossing the network.

Answer: D

NEW QUESTION # 39
Refer to the exhibit. In order for a FortiGate device to act as router on a stick, what configuration must an OT network architect implement on FortiGate to achieve inter-VLAN routing?

• A. Set a FortiGate interface with the switch to operate as an 802.1 q trunk.
• B. Set a unique forward domain on each interface on the network.
• C. Set FortiGate to operate in transparent mode.
• D. Set a software switch on FortiGate to handle inter-VLAN traffic.

Answer: A

NEW QUESTION # 40
An OT architect has deployed a Layer 2 switch in the OT network at Level 1 the Purdue model-process control. The purpose of the Layer 2 switch is to segment traffic between PLC1 and PLC2 with two VLANs.
All the traffic between PLC1 and PLC2 must first flow through the Layer 2 switch and then through the FortiGate device in the Level 2 supervisory control network.
What statement about the traffic between PLC1 and PLC2 is true?

• A. In order to communicate, PLC1 must be in the same VLAN as PLC2.
• B. The Layer 2 switches routes any traffic to the FortiGate device through an Ethernet link.
• C. The Layer 2 switch rewrites VLAN tags before sending traffic to the FortiGate device.
• D. PLC1 and PLC2 traffic must flow through the Layer-2 switch trunk link to the FortiGate device.

Answer: D

Explanation:
The statement that is true about the traffic between PLC1 and PLC2 is that PLC1 and PLC2 traffic must flow through the Layer-2 switch trunk link to the FortiGate device.

NEW QUESTION # 41
Refer to the exhibit

In the topology shown in the exhibit, both PLCs can communicate directly with each other, without going through the firewall.
Which statement about the topology is true?

• A. This integration solution expands VLAN capabilities from Layer 2 to Layer 3.
• B. An administrator can create firewall policies in the switch to secure between PLCs.
• C. There is no micro-segmentation in this topology.
• D. PLCs use IEEE802.1Q protocol to communicate each other.

Answer: C

NEW QUESTION # 42
......

Fortinet NSE7_OTS-7.2 certification exam is a valuable and respected certification in the field of cybersecurity. It is designed to test an individual's knowledge and skills in the area of OT security and is intended for security professionals who have experience working in OT environments. With the right preparation and study, candidates can successfully pass the exam and earn this valuable certification.

 

Exam Questions for NSE7_OTS-7.2 Updated Versions With Test Engine: https://www.dumptorrent.com/NSE7_OTS-7.2-braindumps-torrent.html

Test Engine to Practice Test for NSE7_OTS-7.2 Valid and Updated Dumps: https://drive.google.com/open?id=16aLoJ5GpnKKQ7Mp-_vYagIGzZ142adEf