Free NSE7_OTS-7.2: Fortinet NSE 7 - OT Security 7.2 Exam Questions and Answers

A FortiGate runs two VDOMs, Line-A and Line-B, connected by the inter-VDOM link vlink1. A PLC in Line-A cannot reach a historian in Line-B. The flow debug in Line-B shows: "Denied by forward policy check (policy 0)" for traffic arriving on vlink11. Exhibit: VDOM Line-A config firewall policy edit 1 set srcintf "port3" set dstintf "vlink10" set srcaddr "PLC-net" set dstaddr "Historian" set action accept set schedule "always" set service "ALL" next end VDOM Line-B config firewall policy edit 1 set srcintf "port3" set dstintf "port4" set srcaddr "PLC-net" set dstaddr "Historian" set action accept set schedule "always" set service "ALL" next end What is the cause of the problem?

• AA. Inter-VDOM links can only connect a non-root VDOM to the root VDOM, so Line-A cannot reach Line-B
• BB. The vlink11 interface must be assigned to the Line-A VDOM before Line-B can apply a policy to it
• CC. The Line-A policy needs NAT enabled before its traffic is accepted across the inter-VDOM link
• DD. Line-B has no policy with vlink11 as the incoming interface, so the traffic matches the implicit deny

In FortiSIEM, which configuration object defines the email, SMS or ticketing action taken when an incident is triggered?

• AA. Notification policy that is linked to the triggering rule
• BB. Watchlist that groups the devices involved in the incident
• CC. Rule subpattern with a time window and an aggregation condition
• DD. Report bundle that is scheduled to run against incident data

In FortiAnalyzer, what defines the SQL query that retrieves log data for a report chart?

• AA. Output profile that sets the format and delivery method
• BB. Log group that collects the logs from several devices
• CC. Dataset that holds the SELECT statement for the chart
• DD. Report layout that arranges the charts on the pages

Refer to the exhibit. An OT administrator reviews the Security Rating results for two FortiGate devices in the Security Fabric. Exhibit: Device Check Result FGT-L2-02 Firmware Version Fail (running 7.0.5, recommended 7.2.x) FGT-L2-02 Admin Password Policy Fail FGT-L2-02 FortiAnalyzer Logging Pass FGT-L3-01 Firmware Version Pass FGT-L3-01 Unused Policies Fail (4 policies) FGT-L3-01 FortiAnalyzer Logging Pass The administrator can only change FGT-L2-02 during the maintenance window. Which two actions address failed checks on that device? (Choose two.)

Select 2 answers.

• AA. Delete the four unused firewall policies
• BB. Upgrade the firmware to the recommended 7.2 release
• CC. Enable an administrator password policy
• DD. Enable FortiAnalyzer logging for all traffic

Which two statements about virtual patching of a legacy controller with a FortiGate are true? (Choose two.)

Select 2 answers.

• AA. It modifies the controller firmware so that the vulnerable function is disabled until the vendor releases a fix
• BB. It stops exploit attempts between two controllers that are connected to the same unmanaged switch
• CC. It depends on a current FortiGuard IPS signature that covers the vulnerability being exploited
• DD. It protects the controller only from exploit traffic that crosses a firewall policy with the IPS sensor applied

An OT administrator wants each hit on an IPS signature for DNP3 traffic to store the offending packets with the IPS log entry for later forensic review. What should the administrator configure?

• AA. Run diagnose sniffer packet on the ingress interface with a filter for the DNP3 port
• BB. Set Log Allowed Traffic to All Sessions on the firewall policy that matches the DNP3 traffic
• CC. Set the IPS sensor entry action to Quarantine attacker with a 30 minute expiry
• DD. Enable Packet Logging on the IPS sensor entry that matches the signature

Refer to the exhibit. Exhibit: Level 1 FortiGate (downstream): config system csf set status enable set upstream-ip 10.30.1.1 set upstream-port 8013 set group-name "PlantFabric" end Level 3 root FortiGate: config system interface edit "port3" set ip 10.30.1.1 255.255.255.0 set allowaccess ping https ssh next end An administrator is adding the Level 1 FortiGate to the Security Fabric rooted at the Level 3 FortiGate. The Level 1 device can ping 10.30.1.1, but it does not appear in the Fabric topology, and the group name is identical on both devices. What should the administrator do?

• AA. Add fabric to allowaccess on port3 of the Level 3 FortiGate
• BB. Set the group-name on the Level 3 FortiGate to its own hostname
• CC. Change upstream-port on the Level 1 FortiGate to 443
• DD. Change upstream-ip on the Level 1 FortiGate to the management address of the Level 3 FortiGate

An OT administrator runs a single FortiGate in multi-VDOM mode. The VDOM named L2-Cell serves Purdue Level 2 and the VDOM named L3-Ops serves Level 3. Historian data must flow from L2-Cell to L3-Ops, and no physical cable is available between the two groups of interfaces. What should the administrator configure?

• AA. An inter-VDOM link, with a firewall policy and a route in each VDOM
• BB. A static route in the root VDOM only, pointing to the L3-Ops gateway
• CC. A VLAN interface with the same VLAN ID in both VDOMs, linked to one parent interface
• DD. A software switch that contains one interface from each VDOM

An OT administrator is creating VLAN subinterfaces on a FortiGate to separate PLC traffic at Purdue Level 1. Which two statements are true? (Choose two.)

Select 2 answers.

• AA. Traffic between two VLAN subinterfaces is allowed by default without a firewall policy.
• BB. A VLAN subinterface inherits the IP address of its parent interface.
• CC. The switch port connected to the parent interface must be a trunk that allows the VLAN IDs in use.
• DD. Two VLAN subinterfaces on the same parent interface cannot use the same VLAN ID.

An OT team plans to divide one FortiGate into several VDOMs, one for each plant area. Which two statements about VDOMs are true? (Choose two.)

Select 2 answers.

• AA. An administrator account can be restricted to a single VDOM through its access profile and VDOM assignment.
• BB. Each VDOM maintains its own routing table and firewall policy set.
• CC. A physical interface can be assigned to several VDOMs at the same time.
• DD. A firewall policy in one VDOM can reference an interface that belongs to another VDOM.