View Full Fortinet NSE6_OTS_AR-7.6 Exam Dumps and Practice Test Dumps.

 

Question 141

Which FortiGate feature can be used to restrict access to specific network services?

1. NTP
2. DHCP
3. Firewall policy
4. FortiAnalyzer

Correct Answer: 3

Explanation

FortiGate firewall policies can restrict access to specific network services by defining permitted services such as HTTP, HTTPS, SSH, or other protocols. In an OT environment, this allows administrators to limit communication to only the services required by industrial applications. Restricting unnecessary services reduces the available attack surface and helps enforce segmentation between different security zones. Policies can combine source and destination addresses with service definitions and additional security controls. Administrators should identify legitimate communication requirements before implementing restrictions because blocking a required industrial service could affect operations. Regular policy reviews are also important as systems and communication requirements change over time.

Question 142

What is the primary purpose of an OT asset discovery process?

1. Identify devices and their characteristics
2. Increase network bandwidth
3. Disable industrial protocols
4. Replace firewall policies

Correct Answer: 1

Explanation

OT asset discovery helps organizations identify the devices operating within their industrial environment and understand their characteristics. This may include PLCs, HMIs, engineering workstations, servers, network devices, sensors, and other specialized equipment. Information such as device type, IP address, communication behavior, and location can support security planning. Asset discovery is especially important in OT because some legacy devices may not be included in traditional IT inventories. Passive discovery methods can be useful because they observe network activity without aggressively probing sensitive equipment. Accurate asset information supports segmentation, monitoring, vulnerability management, incident response, and appropriate security policy development.

Question 143

Which authentication method provides an additional verification factor beyond a password?

1. Static routing
2. Multifactor authentication
3. VLAN tagging
4. Traffic shaping

Correct Answer: 2

Explanation

Multifactor authentication requires more than one type of authentication factor before access is granted. For example, a user may provide a password and then verify their identity using a security token or authentication application. This reduces reliance on passwords alone and can help protect privileged and remote access accounts. In OT environments, MFA should be implemented carefully because some legacy applications and industrial devices may not support it directly. It can often be applied at remote-access gateways or administrative entry points instead. MFA is most effective when combined with least privilege, secure network segmentation, strong account management, and monitoring of authentication events.

Question 144

Which security control can help prevent unauthorized communication from an OT zone to the Internet?

1. Firewall policy
2. Screen lock
3. NTP synchronization
4. Asset naming

Correct Answer: 1

Explanation

Firewall policies can restrict outbound communication from OT zones to the Internet by defining approved destinations, services, and applications. Industrial systems generally should not have unrestricted Internet access unless there is a documented operational requirement. Restricting unnecessary outbound connectivity reduces opportunities for unauthorized data transfer, malicious command-and-control communication, and exploitation of external services. Administrators can create specific policies that permit required communication while denying other traffic. Logging denied connections can provide additional visibility into attempted communication. Firewall restrictions should be tested carefully because some industrial systems may depend on specific external services for updates, licensing, monitoring, or vendor support.

Question 145

Which OT device commonly executes programmed instructions to control physical equipment?

1. Historian
2. HMI
3. PLC
4. Firewall

Correct Answer: 3

Explanation

A Programmable Logic Controller, or PLC, commonly executes programmed control logic used to operate industrial equipment. PLCs can process information received from sensors and produce outputs that control motors, valves, actuators, and other machinery. Because PLCs can directly affect physical processes, unauthorized access to their configurations or control logic presents an important security concern. Organizations should restrict PLC communication to authorized systems and monitor relevant network activity. Engineering access should also be carefully controlled because changes to PLC logic can affect production and potentially safety-related processes. Segmentation, authentication, secure configuration, backups, and monitoring can provide multiple layers of protection around PLCs.

Question 146

What is the main benefit of maintaining a known-good configuration baseline?

1. It increases Internet speed
2. It provides a reference for detecting unauthorized changes
3. It eliminates all vulnerabilities
4. It replaces authentication

Correct Answer: 2

Explanation

A known-good configuration baseline provides a reference against which current system configurations can be compared. In an OT environment, this can help identify unauthorized or unexpected changes to firewalls, network devices, servers, engineering workstations, and other systems. If a configuration differs from the approved baseline, administrators can investigate whether the change was intentional, accidental, or potentially malicious. Baselines should be updated when approved changes are made so that legitimate modifications do not continually generate false alerts. Maintaining backups of known-good configurations also supports recovery. Configuration baselines therefore contribute to change management, monitoring, incident response, and overall security governance.

Question 147

Which Fortinet solution is designed to provide centralized security event logging and analysis?

1. FortiAnalyzer
2. FortiAP
3. FortiSwitch
4. FortiToken

Correct Answer: 1

Explanation

FortiAnalyzer is designed to collect, store, analyze, and report on logs from supported Fortinet security devices. In an OT environment, centralized logging can provide valuable visibility into firewall decisions, security events, administrative activity, and other network behavior. Instead of examining individual devices separately, security teams can use centralized information to investigate events and identify patterns across the environment. Historical logs can also support incident investigations and compliance requirements. FortiAP focuses on wireless access, FortiSwitch provides switching capabilities, and FortiToken supports authentication functions. Centralized log management should be combined with appropriate retention, access controls, and monitoring procedures.

Question 148

Why should unnecessary administrative services be disabled on OT devices?

1. To increase screen resolution
2. To improve wireless coverage
3. To reduce the available attack surface
4. To eliminate backups

Correct Answer: 3

Explanation

Disabling unnecessary administrative services reduces the number of network-accessible functions that attackers could potentially exploit. OT devices may contain legacy management services that are not required for normal operation. Leaving such services enabled can create additional entry points and increase the complexity of security management. Administrators should first confirm that a service is genuinely unnecessary before disabling it because some industrial systems depend on specific management functions. Secure alternatives should be used where available, and required administrative services should be restricted to trusted networks. Reducing unnecessary services is one element of hardening and should be combined with segmentation, authentication, monitoring, and regular configuration reviews.

Question 149

What does network segmentation primarily limit?

1. The number of employees
2. The physical size of a facility
3. The storage capacity of servers
4. Unnecessary communication between systems

Correct Answer: 4

Explanation

Network segmentation primarily limits unnecessary communication between systems or groups of systems. In an OT environment, segmentation can separate enterprise IT, industrial DMZs, supervisory networks, control networks, and other zones. Security policies can then determine exactly which communication paths are permitted between those areas. If one system is compromised, segmentation can make it more difficult for an attacker to reach other critical systems. Segmentation does not guarantee that an attack cannot spread, but it can reduce available paths and limit the potential impact. Effective segmentation requires an understanding of legitimate communication dependencies and should be reviewed as the industrial environment changes.

Question 150

Which security practice helps maintain accountability for administrative actions?

1. Using individual administrator accounts
2. Sharing one administrator password
3. Allowing anonymous access
4. Disabling audit logs

Correct Answer: 1

Explanation

Individual administrator accounts help maintain accountability because administrative actions can be associated with specific users. This allows security teams to determine who performed a configuration change, accessed a management interface, or modified a security policy. Shared administrator credentials make attribution difficult and can prevent effective investigation when something goes wrong. Individual accounts should be combined with appropriate privileges, strong authentication, and administrative logging. In OT environments, accountability is especially important because configuration changes can influence critical communication paths and industrial operations. Regularly reviewing privileged accounts can also help identify unnecessary access and ensure that former or inactive accounts are removed or disabled.

Question 151

Which technology can help detect malicious activity by inspecting network traffic against security signatures?

1. DHCP
2. IPS
3. NTP
4. DNS

Correct Answer: 2

Explanation

An Intrusion Prevention System, or IPS, inspects applicable network traffic and compares it with known attack signatures and other detection mechanisms. When suspicious traffic matches a relevant signature, the system can generate an alert or block the communication depending on the configured policy. In OT environments, IPS requires careful tuning because industrial protocols and applications may have specialized communication patterns. Security teams should understand the traffic requirements of critical systems and validate IPS configurations before applying them broadly. IPS is not a replacement for segmentation or access control. Instead, it provides an additional inspection layer that can help identify and prevent certain network-based attacks.

Question 152

What is the main purpose of an industrial firewall between two OT security zones?

1. Increase PLC memory
2. Provide email services
3. Enforce controlled communication
4. Store historical process data

Correct Answer: 3

Explanation

An industrial firewall between OT security zones enforces controlled communication between systems with different security requirements. Administrators can create policies that allow only the required sources, destinations, services, and applications. This helps prevent unnecessary connectivity and reduces the potential for unauthorized movement between zones. For example, communication between a supervisory network and a control network can be restricted to documented operational requirements. Firewalls should be carefully configured because overly restrictive policies can interrupt legitimate processes, while overly permissive rules can create security gaps. Regular policy review, logging, and change management help maintain effective controls as the industrial environment evolves.

Question 153

Which protocol is commonly associated with secure remote command-line administration?

1. FTP
2. HTTP
3. SSH
4. TFTP

Correct Answer: 3

Explanation

Secure Shell, or SSH, provides encrypted remote command-line access to supported systems and network devices. Encryption helps protect administrative credentials and commands from interception during a management session. SSH is generally preferred over older protocols such as Telnet when secure remote administration is required. In an OT environment, administrative access should still be restricted to authorized users and trusted management networks. Strong authentication and logging should also be enabled where supported. SSH does not by itself secure the entire OT environment; it is one component of secure administration. Network segmentation and access-control policies should limit where and by whom SSH management connections can be initiated.

Question 154

Which activity is most useful for identifying unusual communication from an OT asset?

1. Network traffic monitoring
2. Changing the device wallpaper
3. Increasing storage capacity
4. Disabling firewall logs

Correct Answer: 1

Explanation

Network traffic monitoring provides visibility into how OT assets communicate with other systems. By establishing normal communication patterns, security teams can identify unusual destinations, unexpected protocols, abnormal traffic volumes, or newly observed connections. This can provide an early indication of malware activity, unauthorized access, configuration errors, or other security concerns. Passive monitoring can be particularly valuable in OT environments because it observes traffic without necessarily interacting directly with sensitive industrial devices. Monitoring should be combined with asset inventories and appropriate alerting so that security teams can understand whether unusual activity is legitimate. Regular baseline updates are also important as industrial processes and network architectures change.

Question 155

What should be used to control communication between an OT network and an industrial DMZ?

1. Unrestricted routing
2. Firewall policies
3. Shared passwords
4. Screen locks

Correct Answer: 2

Explanation

Firewall policies can control communication between an OT network and an industrial DMZ by defining the specific traffic that is permitted or denied. The DMZ can host services that need carefully controlled communication with both enterprise and industrial environments. Firewall rules should specify appropriate source and destination systems, services, and applications rather than allowing broad connectivity. Logging can provide visibility into permitted and denied communication. Because OT systems may have strict operational requirements, changes should be tested and documented before deployment. Properly configured firewall policies help maintain the security boundary while still allowing legitimate data exchange and approved services to operate between the DMZ and OT network.

Question 156

Which security principle recommends removing unnecessary permissions from users and devices?

1. Least privilege
2. High availability
3. Load balancing
4. Redundancy

Correct Answer: 1

Explanation

Least privilege recommends giving users, applications, and devices only the permissions necessary to perform their approved functions. Removing unnecessary permissions reduces the potential impact if an account or device is compromised. In OT environments, excessive privileges could allow unauthorized users to modify configurations, access sensitive systems, or move between network zones. Administrators should review permissions periodically and adjust them when responsibilities change. Individual accounts and role-based access controls can help enforce this principle. Least privilege does not mean denying legitimate operational access; rather, it ensures that access is narrowly aligned with actual requirements. This approach strengthens security while maintaining necessary industrial functionality.

Question 157

Which control can help protect configuration backups from unauthorized modification?

1. Public access
2. Unrestricted administrator permissions
3. Secure storage with access controls
4. Anonymous file sharing

Correct Answer: 3

Explanation

Configuration backups should be stored securely and protected by appropriate access controls. If attackers can modify or delete backup files, recovery may become more difficult after a security incident or device failure. Restricting access to authorized personnel helps preserve the integrity of backup data. Organizations should also consider maintaining multiple copies and periodically testing restoration procedures. In OT environments, known-good configurations can be valuable for quickly restoring firewalls and network devices after accidental or malicious changes. Backup protection should therefore include secure storage, authentication, authorization, monitoring, and appropriate retention. These measures help ensure that recovery resources remain trustworthy when they are needed.

Question 158

What is one reason to monitor failed authentication attempts on OT systems?

1. To identify possible unauthorized access attempts
2. To increase network bandwidth
3. To replace asset inventories
4. To disable security controls

Correct Answer: 1

Explanation

Monitoring failed authentication attempts can help identify possible unauthorized access attempts, password attacks, misconfigured applications, or other authentication-related problems. A high number of failures from a particular source may indicate repeated attempts to obtain access to an account or service. In OT environments, authentication monitoring should be correlated with other security information because failed attempts can also result from legitimate operational issues. Administrators can establish appropriate alert thresholds and investigate unusual patterns. Strong authentication, account lockout policies where appropriate, restricted management access, and least privilege provide additional protection. Authentication logs therefore provide useful evidence for both security monitoring and troubleshooting.

Question 159

Which action best supports secure decommissioning of an obsolete OT device?

1. Leave all accounts active
2. Remove or disable its network access
3. Publish its management interface
4. Keep unnecessary firewall rules

Correct Answer: 2

Explanation

When an OT device is decommissioned, its network access should be removed or disabled so that it cannot become an unnecessary entry point into the environment. Related accounts, firewall rules, credentials, and monitoring configurations should also be reviewed and removed when they are no longer required. Asset inventories should be updated so security teams know that the device is no longer operational. Simply disconnecting a device without documenting the change may leave obsolete access paths elsewhere in the network. Proper decommissioning reduces the attack surface and prevents old systems, credentials, and policies from remaining active after the equipment has been removed from service.

Question 160

Which approach provides the strongest basis for securing communications between critical OT systems?

1. Allow all protocols by default
2. Use documented requirements and explicitly permit necessary traffic
3. Disable all monitoring
4. Provide unrestricted administrator access

Correct Answer: 2

Explanation

Using documented communication requirements and explicitly permitting necessary traffic provides a strong foundation for securing communications between critical OT systems. Administrators can identify which systems need to communicate, which protocols are required, and which services should be restricted. Firewall policies can then be designed around these documented requirements using a least-privilege approach. This reduces unnecessary connectivity while maintaining essential industrial operations. Monitoring and logging can provide additional visibility into deviations from the expected communication model. The approach should be validated before deployment because incorrect restrictions can affect production. Regular reviews are also necessary to keep policies aligned with changes in equipment, applications, and operational requirements.