NSE7_OTS-7.2 Fortinet NSE 7 - OT Security 7.2 Questions and Answers

Planning a threat hunting strategy

Implementing strategies to automatically bring PLCs offline

Creating disaster recovery plans to switch operations to a backup plant

Evaluating what can go wrong before it happens

You must set correct operator in event handler to trigger an event.

You can automate SOC tasks through playbooks.

Each playbook can include multiple triggers.

You cannot use Windows and Linux hosts security events with FortiSoC.

Enable transparent mode on the edge FortiGate device.

Enable security profiles on all interfaces connected in the control area zone.

Set up VPN tunnels between downstream and edge FortiGate devices.

Create a software switch on each downstream FortiGate device.

Two-factor authentication on FortiAuthenticator

Role-based authentication on FortiNAC

FSSO authentication on FortiGate

Local authentication on FortiGate

The first condition on the SubPattern filter must use the OR logical operator.

The attributes in the Group By section must match the ones in Fitters section.

The Aggregate attribute COUNT expression is incompatible with the filters.

The SubPattern is missing the filter to match the Modbus protocol.

Set a unique forward domain on each interface on the network.

Set FortiGate to operate in transparent mode.

Set a software switch on FortiGate to handle inter-VLAN traffic.

Set a FortiGate interface with the switch to operate as an 802.1 q trunk.

In the PCI logging dashboard and there are one or more high-severity security incidents for the FortiGate device.

In the summary dashboard and there are one or more high-severity security incidents for the FortiGate device.

In the widget dashboard and there are one or more high-severity incidents for the FortiGate device.

In the business service dashboard and there are one or more high-severity security incidents for the FortiGate device.

Modbus uses UDP frames to transport MBAP and function codes.

Most of the PLC brands come with a built-in Modbus module.

You can implement Modbus networking settings on internetworking devices.

Modbus is used to establish communication between intelligent devices.

A failed Layer 3 poll

A matched security policy

A matched profiling rule

A linkup or linkdown trap

A FortiSIEM CMDB report

A FortiAnalyzer device report

A FortiSIEM incident report

A FortiSIEM analytics report

FortiGate determined the user by passive authentication

The user was determined by Security Fabric

Two-factor authentication is not configured with RADIUS authentication method

FortiNAC determined the user by DHCP fingerprint method

This is a sample of a FortiAnalyzer system interface event log.

This is a sample of an SNMP temperature control event log.

This is a sample of a PAM event type.

This is a sample of FortiGate interface statistics.

FortiGate has no IPS industrial signature database enabled.

The listed IPS signatures are classified as SCADAapphcat nns

All IPS signatures are overridden and must block traffic match signature patterns.

The IPS profile inspects only traffic originating from SCADA equipment.

You must use a FortiAuthenticator.

You must register the same FortiToken on more than one FortiGate.

You must use the user self-registration server.

You must use a third-party RADIUS OTP server.

PLCs use IEEE802.1Q protocol to communicate each other.

An administrator can create firewall policies in the switch to secure between PLCs.

This integration solution expands VLAN capabilities from Layer 2 to Layer 3.

There is no micro-segmentation in this topology.