Fortinet NSE6_OTS_AR-7.6 Exam Dumps

The correct answers are A and C.

Option C is correct because the profile clearly contains the Operational Technology category and specific OT application signatures such as Modbus and IEC.60870.5.104. The study guide says ''You can use application control signatures to detect OT protocols'' and ''You can filter to a specific OT protocol.'' That means OT application signatures are active in this sensor profile.

Option A is correct because the guide explains that application control works at different levels: ''Detection of protocol (one detection per session)'' and ''Message level (one detection per protocol message).'' It also says you can use application signatures for ''granular message type identification.'' In the exhibit, IEC.60870.5.104.Control.Functions is explicitly configured, which is a granular IEC message/control-level signature rather than only a protocol-level match. That means logging and control can occur at the IEC command level.

Option B is not correct because the profile shows Modbus configured at the parent protocol level as Monitor, while the guide states that the ''parent signature takes precedence over the child signature.'' Since protocol-level detection is one detection per session, that does not mean FortiGate will necessarily log each Modbus command individually.

Option D is incorrect because even though the broader Operational Technology category is set to block, the profile includes specific application and filter overrides for Modbus and IEC 104 behavior. So the resulting effect is not simply that all OT protocols are blocked.

According to the OT Security 7.6 Architect study guide section on Asset Management, specifically regarding FortiNAC Visibility:

Layer 2 Polling Data: Because each physical address is unique, FortiNAC identifies hosts as they connect to the network. The information gathered during this process fills in the physical address and location information in the database.

Visibility Components: The guide states that the physical address learned, the time it was learned, and where it was learned from provide the foundation of endpoint visibility in the form of 'what, where, and when' information. This confirms that Where it was learned (Option A) and The time it was learned (Option D) are correct.

Exclusions:

Layer 3 Polling: The MAC-to-IP correlation (Option B) is explicitly defined as a function of Layer 3 polling, where the correlated IP address is added to the database record for the corresponding MAC address.

DHCP Fingerprinting: The host name or system name (Option C) and the operating system are gathered via DHCP fingerprinting, not layer 2 polling.

Based on the provided exhibit and the OT Security 7.6 Architect curriculum regarding the Fortinet Security Fabric:

Fabric Role: The exhibit clearly shows that FortiGate-2 has the role set to Join Fabric. This confirms it is a downstream device and not the Fabric Root (eliminating Option A).

Upstream Connection: The device is configured to point to an Upstream FortiGate at IP address 10.1.2.254.

Fabric Status: The status is currently displayed as Not Connected. In a standard Fortinet Security Fabric deployment, once a downstream device is configured to join the fabric, it sends a request to the upstream root device. The root FortiGate must then explicitly authorize the downstream unit before the connection is established and the status changes to 'Connected.'

Authorization Requirement: The 'Not Connected' status, while having the upstream IP correctly configured, is the classic indicator that the authorization step is pending on the root FortiGate. Furthermore, under the LAN Edge Devices section, it shows another downstream FortiGate requiring authorization on this specific unit, highlighting that authorization is a manual security requirement for all stages of the Fabric hierarchy.

FortiAnalyzer Status: While the Logging & Analytics section shows FortiAnalyzer is Disabled, this is a configuration choice and does not prevent the Security Fabric from connecting; therefore, configuring it is not the solution to the connectivity status shown (eliminating Option C).

In summary, FortiGate-2 cannot join the fabric until an administrator logs into the Root FortiGate (10.1.2.254) and authorizes the join request from FortiGate-2.

The correct answers are A and B.

Option B is correct because the study guide states that ''When a handler generates an event with the automation stitch option enabled, FortiAnalyzer sends a notification'' to FortiGate. If Automation Stitch is not enabled in the FortiAnalyzer event handler, that handler will not be usable for the FortiGate automation-stitch workflow. The guide also explains that the configuration of each event handler can include ''Automation stitches'' and ''Rules,'' showing that this is a required part of the FortiAnalyzer-to-FortiGate automation path.

Option A is also correct. The study guide explains the automation flow in the Security Fabric: ''FortiAnalyzer parses the logs and notifies the root FortiGate'' and then ''The root FortiGate triggers the action.'' That means FortiGate must have the FortiAnalyzer connection configured through the Security Fabric side before it can consume FortiAnalyzer event handlers. The warning in the exhibit about configuring a FortiAnalyzer connection also points directly to that requirement.

Option C is incorrect because + Create is not the reason the existing event handler is missing; it is only an interface control. Option D is not the best answer for this item because the question is about why the event handler name list on FortiGate is empty for FortiAnalyzer-triggered automation. The study guide's verified requirements for that workflow are the FortiAnalyzer-to-FortiGate Fabric connection and enabling Automation Stitch on the FortiAnalyzer event handler.

The correct answers are B and C. The study guide states that ''You can use application control signatures to detect OT protocols'' and that ''Application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages''. It also shows that a Modbus application control profile can be enabled on a firewall policy ''for OT protocol visibility in the monitor status.'' This directly supports B, because application control is the feature used to identify and monitor OT protocols on FortiGate.

The guide also explains under IPS that ''By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI'' using config ips global and set exclude-signatures none. Once enabled, FortiGate can use those OT signatures for OT-aware inspection and protection. That supports C as the second required configuration. A is related to device discovery, not protocol identification, and D is focused on exploit and vulnerability detection rather than the first-step goal of identifying OT protocols.