168試験解答はNSE6_OTS_AR-7.6最新版テストエンジン [Q20-Q40]

20、Refer to the exhibits.

A partial view of the Playbook Monitor page and the corresponding playbook configuration are shown. Based on the monitor page and the configuration of the playbook, what has triggered the Run_Report task? (Choose one answer)

An IPS_Attack_Handling event

An IPS incident creation

An Event_Trigger log

An IPS_Attack_Incident log

21、Refer to the exhibit. You need to configure VPN user access for supervisors at the breach and HQ sites using the same soft FortiToken. Each site has a FortiGate VPN gateway.
What must you do to achieve this objective?

You must use a FortiAuthenticator.

You must register the same FortiToken on more than one FortiGate.

You must use the user self-registration server.

You must use a third-party RADIUS OTP server.

22、Refer to the exhibit.

A partial OT network is shown.
You have configured the FortiGate device with VLANs to segment the OT network. The supervisor now wants to connect to the PLC from the Engineering Workstation.
How can you allow access from the Engineering Workstation to the PLC?

You must configure intra-switch-policy as explicit.

You must configure intra-switch-policy as implicit.

You must configure forward domain IDs.

You must configure a layer 3 switch.

23、For the installation of your first FortiGate device, you want to minimize the impact in your OT network. Therefore, you deploy it initially as an offline IDS. Which two statements about this deployment are correct? (Choose two answers)

The FortiGate device acts as a network sensor.

The cybersecurity visibility increases with the security profiles.

Attacks, including zero-day attacks, are blocked.

OT traffic flows through the FortiGate device.

24、Which statemenl about the IEC 104 protocol is true?

IEC 104 is used for telecontrol SCADA in electrical engineering applications.

IEC 104 is IEC 101 compliant in old SCADA systems.

IEC 104 protects data transmission between OT devices and services.

IEC 104 uses non-TCP/IP standards.

25、Which three Fortinet products can you use for device identification in an OT industrial control system (ICS)? (Choose three.)

FortiSIEM

FortiManager

FortiAnalyzer

FortiGate

FortiNAC

26、Refer to the exhibit.

A partial Application Sensor profile is shown. When you apply this profile in firewall policy, which two statements are correct? (Choose two answers)

OT signatures are enabled.

All OT protocols are monitored.

Modbus write commands are blocked.

A log is provided for each Modbus read holding registers command.

27、Refer to the exhibit. Based on the topology designed by the OT architect, which two statements about implementing OT security are true? (Choose two.)

Firewall policies should be configured on FortiGate-3 and FortiGate-4 with industrial protocol sensors.

Micro-segmentation can be achieved only by replacing FortiGate-3 and FortiGate-4 with a pair of FortiSwitch devices.

IT and OT networks are separated by segmentation.

FortiGate-3 and FortiGate-4 devices must be in a transparent mode.

28、When device profiling rules are enabled, which devices connected on the network are evaluated by the device profiling rules?

Known trusted devices, each time they change location

All connected devices, each time they connect

Rogue devices, only when they connect for the first time

Rogue devices, each time they connect

29、Refer to the exhibit. You need to configure VPN user access for supervisors at the branch and HQ sites using the same soft FortiToken. Each site has a FortiGate VPN gateway.
What must you do to achieve this objective?

Direct users to the self-registration server portal.

Import the FortiToken on each FortiGate.

Deploy FortiAuthenticator.

Use a RADIUS OTP server.

30、Refer to the exhibits. Which statement about some of the generated report elements from FortiAnalyzer is true?

The report confirms Modbus and IEC 104 are the key applications crossing the network.

FortiGate collects the logs and generates the report to FortiAnalyzer.

The file types confirm the infected applications on the PLCs.

This report is predefined and is not available for customization.

31、Refer to the exhibit. A Security Fabric logical topology view is shown. Which two statements are correct? (Choose two.)

Edge-FortiGate, FortiGate-1, and FortiGate-2 have the Security Fabric configured.

Device detection is enabled on port5 of the Edge-FortiGate device.

FortiAnalyzer is connected only to Edge-FortiGate.

FortiAnalyzer has the Security Fabric configured.

32、Refer to the exhibit. The OT devices behind the ruggedized FortiGate have vulnerabilities and you want to apply a virtual patching profile in the firewall policy.

Why is Virtual Patching not available in the Security Profiles section? (Choose one answer)

You must enable Virtual Patching in the Feature Visibility section.

You must have a ruggedized FortiGate allowing the virtual patching feature.

You must enable OT signatures.

You must have a valid OT security service license.

33、Refer to the exhibit.A new operational technology rule is being created to monitor Modbus protocol traffic on FortiSIEM.
Which action will ensure all Modbus messages on the network match the rule?

Set the Aggregate attribute value to equal to or greater than zero.

Add a new condition to filter Modbus traffic based on the Source TCP/UDP port.

This rule is valid and requires no additional changes.

Remove attributes in the Group By section that are not configured in the Filter section.

34、Refer to the exhibit, which shows a nonprotected OT environment. An administrator needs to implement appropriate protection on the OT network.
Which three steps should an administrator take to protect the OT network? (Choose three.)

Use segmentation.

Configure firewall policies with web filtering to protect the different ICS networks.

Deploy a FortiGate device within each ICS network.

Configure firewall policies with industrial protocol sensors.

Deploy an edge FortiGate between the internet and the OT network as a one-arm sniffer.

35、Refer to the exhibits. Which statement is true about the traffic passing through to PLC-2?

IPS must be enabled to inspect application signatures.

The application filter overrides the default action of some IEC 104 signatures.

IEC 104 signatures are all allowed except the C.BO.NA 1 signature.

SSL Inspection must be set to deep-inspection to correctly apply application control.

36、Refer to the exhibit. A Run_report task is shown.

You want to automate the generation of a newly created report on FortiAnalyzer.
When you configure the Run_report task in Playbook, why is the report not shown in the Report field? (Choose two answers)

You must first configure the connector.

You must first enable Extended Log Filtering in the report.

You must first enable Auto-cache in the report.

You must first configure an event handler.

You must first select Playbook Starter, and then select the newly created report.

37、You want to monitor the performance of your specific OT sensors. Where must you fine-tune the event handling for these sensors on FortiSIEM?

In the Risk Summary section on the Dashboard tab

In the rule on the Resources tab

In the Investigation section on the Analytics tab

In the business services group on the CMDB tab

38、Refer to the exhibits. A partial Basic Event Handler page on FortiAnalyzer and the creation of a trigger in a FortiGate device are shown.

To improve the protection of your OT network, you want to automate the handling of compromised devices notified through FortiAnalyzer.
You have configured an event handler as shown in the exhibit. When you create the trigger on the FortiGate device, the Event handler name field does not provide the Alert_trigger option.
What two actions must you perform to make the Alert_trigger option available? (Choose two answers)

You must click + Create in the Event handler name field.

You must authorize the FortiGate device on FortiAnalyzer

You must configure the FortiAnalyzer setting on the FortiGate device.

You must configure the trigger on the root FortiGate.

39、According to the IEC 62443 standard, your security level is 4. What is your OT environment defending against? (Choose one answer)

Intentional cyberthreats posed by skilled malicious users

An intentional attack with low resources

A syndicate of cyber extortion with extensive resources

A casual exposure

40、As the first step in your OT network protection plan, you must identify the OT protocols that the FortiGate device supports. Which two configurations must you implement on this FortiGate device? (Choose two answers)

You must enable Device detection on all the interfaces.

You must implement an Application Control security profile that monitors OT.

You must enable the OT signatures.

You must implement an Intrusion Prevention security profile that monitors OT.