Unique Top-selling NSE7_OTS-7.2 Exams - New 2024 Fortinet Pratice Exam
NSE 7 Network Security Architect Dumps NSE7_OTS-7.2 Exam for Full Questions - Exam Study Guide
The NSE7_OTS-7.2 certification exam covers a wide range of topics related to OT security, including ICS and SCADA security, network segmentation, access control, threat detection and mitigation, incident response, and compliance. NSE7_OTS-7.2 exam consists of 60 multiple-choice questions, and the candidates have 120 minutes to complete it. The passing score for the exam is 70%, and the exam is available in English and Japanese.
Fortinet NSE7_OTS-7.2 exam covers a broad range of topics related to OT security. NSE7_OTS-7.2 exam comprises of 60 multiple-choice questions, and the candidate has 120 minutes to complete the test. NSE7_OTS-7.2 exam content includes OT security concepts, OT network design, OT security policies, OT security products, and OT security management.
NEW QUESTION # 22
What are two benefits of a Nozomi integration with FortiNAC? (Choose two.)
- A. Adapter consolidation for multi-adapter hosts
- B. Direct VLAN assignment
- C. Enhanced point of connection details
- D. Importation and classification of hosts
Answer: C,D
NEW QUESTION # 23
An administrator wants to use FortiSoC and SOAR features on a FortiAnalyzer device to detect and block any unauthorized access to FortiGate devices in an OT network.
Which two statements about FortiSoC and SOAR features on FortiAnalyzer are true? (Choose two.)
- A. You can automate SOC tasks through playbooks.
- B. Each playbook can include multiple triggers.
- C. You must set correct operator in event handler to trigger an event.
- D. You cannot use Windows and Linux hosts security events with FortiSoC.
Answer: A,C
Explanation:
Explanation
Ref: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/268882/fortisoc
NEW QUESTION # 24
When device profiling rules are enabled, which devices connected on the network are evaluated by the device profiling rules?
- A. All connected devices, each time they connect
- B. Rogue devices, only when they connect for the first time
- C. Known trusted devices, each time they change location
- D. Rogue devices, each time they connect
Answer: B
NEW QUESTION # 25
Which two frameworks are common to secure ICS industrial processes, including SCADA and DCS? (Choose two.)
- A. IEC104
- B. Modbus
- C. NIST Cybersecurity
- D. IEC 62443
Answer: A,D
NEW QUESTION # 26
As an OT network administrator, you are managing three FortiGate devices that each protect different levels on the Purdue model. To increase traffic visibility, you are required to implement additional security measures to detect exploits that affect PLCs.
Which security sensor must implement to detect these types of industrial exploits?
- A. Deep packet inspection (DPI)
- B. Application control
- C. Antivirus inspection
- D. Intrusion prevention system (IPS)
Answer: A
NEW QUESTION # 27
Refer to the exhibit.
Which statement about the interfaces shown in the exhibit is true?
- A. port1, port1-vlan10, and port1-vlan1 are in different broadcast domains
- B. port2, port2-vlan10, and port2-vlan1 are part of the software switch interface.
- C. port1-vlan10 and port2-vlan10 are part of the same broadcast domain
- D. The VLAN ID of port1-vlan1 can be changed to the VLAN ID 10.
Answer: A
NEW QUESTION # 28
What triggers Layer 2 polling of infrastructure devices connected in the network?
- A. A failed Layer 3 poll
- B. A matched security policy
- C. A linkup or linkdown trap
- D. A matched profiling rule
Answer: C
NEW QUESTION # 29
An OT network administrator is trying to implement active authentication.
Which two methods should the administrator use to achieve this? (Choose two.)
- A. Local authentication on FortiGate
- B. Two-factor authentication on FortiAuthenticator
- C. FSSO authentication on FortiGate
- D. Role-based authentication on FortiNAC
Answer: A,B
NEW QUESTION # 30
An OT network consists of multiple FortiGate devices. The edge FortiGate device is deployed as the secure gateway and is only allowing remote operators to access the ICS networks on site.
Management hires a third-party company to conduct health and safety on site. The third-party company must have outbound access to external resources.
As the OT network administrator, what is the best scenario to provide external access to the third-party company while continuing to secure the ICS networks?
- A. Configure outbound security policies with limited active authentication users of the third-party company.
- B. Implement an additional firewall using an additional upstream link to the internet.
- C. Create VPN tunnels between downstream FortiGate devices and the edge FortiGate to protect ICS network traffic.
- D. Split the edge FortiGate device into multiple logical devices to allocate an independent VDOM for the third-party company.
Answer: D
NEW QUESTION # 31
An OT supervisor has configured LDAP and FSSO for the authentication. The goal is that all the users be authenticated against passive authentication first and, if passive authentication is not successful, then users should be challenged with active authentication.
What should the OT supervisor do to achieve this on FortiGate?
- A. Under config user settings configure set auth-on-demand implicit.
- B. Enable two-factor authentication with FSSO.
- C. Configure a firewall policy with LDAP users and place it on the top of list of firewall policies.
- D. Configure a firewall policy with FSSO users and place it on the top of list of firewall policies.
Answer: D
Explanation:
Explanation
The OT supervisor should configure a firewall policy with FSSO users and place it on the top of list of firewall policies in order to achieve the goal of authenticating users against passive authentication first and, if passive authentication is not successful, then challenging them with active authentication.
NEW QUESTION # 32
Refer to the exhibit.
You need to configure VPN user access for supervisors at the breach and HQ sites using the same soft FortiToken. Each site has a FortiGate VPN gateway.
What must you do to achieve this objective?
- A. You must use a FortiAuthenticator.
- B. You must use a third-party RADIUS OTP server.
- C. You must use the user self-registration server.
- D. You must register the same FortiToken on more than one FortiGate.
Answer: A
NEW QUESTION # 33
An OT administrator has configured FSSO and local firewall authentication. A user who is part of a user group is not prompted from credentials during authentication.
What is a possible reason?
- A. FortiGate determined the user by passive authentication
- B. The user was determined by Security Fabric
- C. Two-factor authentication is not configured with RADIUS authentication method
- D. FortiNAC determined the user by DHCP fingerprint method
Answer: A
NEW QUESTION # 34
Which three criteria can a FortiGate device use to look for a matching firewall policy to process traffic?
(Choose three.)
- A. Destination defined as internet services in the firewall policy
- B. Source defined as internet services in the firewall policy
- C. Highest to lowest priority defined in the firewall policy
- D. Services defined in the firewall policy.
- E. Lowest to highest policy ID number
Answer: A,C,D
Explanation:
Explanation
The three criteria that a FortiGate device can use to look for a matching firewall policy to process traffic are:
A: Services defined in the firewall policy - FortiGate devices can match firewall policies based on the services defined in the policy, such as HTTP, FTP, or DNS.
D: Destination defined as internet services in the firewall policy - FortiGate devices can also match firewall policies based on the destination of the traffic, including destination IP address, interface, or internet services.
E: Highest to lowest priority defined in the firewall policy - FortiGate devices can prioritize firewall policies based on the priority defined in the policy. The device will process traffic against the policy with the highest priority first and move down the list until it finds a matching policy.
NEW QUESTION # 35
Refer to the exhibit, which shows a non-protected OT environment.
An administrator needs to implement proper protection on the OT network.
Which three steps should an administrator take to protect the OT network? (Choose three.)
- A. Use segmentation
- B. Deploy a FortiGate device within each ICS network.
- C. Configure firewall policies with web filter to protect the different ICS networks.
- D. Deploy an edge FortiGate between the internet and an OT network as a one-arm sniffer.
- E. Configure firewall policies with industrial protocol sensors
Answer: C,D,E
NEW QUESTION # 36
An OT network architect must deploy a solution to protect fuel pumps in an industrial remote network. All the fuel pumps must be closely monitored from the corporate network for any temperature fluctuations.
How can the OT network architect achieve this goal?
- A. Configure a fuel server on the remote network, and deploy a FortiSIEM with a single pattern temperature performance rule on the corporate network.
- B. Configure a fuel server on the corporate network, and deploy a FortiSIEM with a single pattern temperature performance rule on the remote network.
- C. Configure a fuel server on the remote network, and deploy a FortiSIEM with a single pattern temperature security rule on the corporate network.
- D. Configure both fuel server and FortiSIEM with a single-pattern temperature performance rule on the corporate network.
Answer: A
Explanation:
Explanation
This way, FortiSIEM can discover and monitor everything attached to the remote network and provide security visibility to the corporate network
NEW QUESTION # 37
An OT network architect needs to secure control area zones with a single network access policy to provision devices to any number of different networks.
On which device can this be accomplished?
- A. FortiGate
- B. FortiSwitch
- C. FortiNAC
- D. FortiEDR
Answer: A
Explanation:
Explanation
An OT network architect can accomplish the goal of securing control area zones with a single network access policy to provision devices to any number of different networks on a FortiGate device.
NEW QUESTION # 38
Refer to the exhibits.
Which statement is true about the traffic passing through to PLC-2?
- A. IEC 104 signatures are all allowed except the C.BO.NA 1 signature.
- B. SSL Inspection must be set to deep-inspection to correctly apply application control.
- C. The application filter overrides the default action of some IEC 104 signatures.
- D. IPS must be enabled to inspect application signatures.
Answer: C
NEW QUESTION # 39
Which three Fortinet products can be used for device identification in an OT industrial control system (ICS)?
(Choose three.)
- A. FortiSIEM
- B. FortiGate
- C. FortiAnalyzer
- D. FortiManager
- E. FortiNAC
Answer: A,B,E
Explanation:
Explanation
A: FortiNAC - FortiNAC is a network access control solution that provides visibility and control over network devices. It can identify devices, enforce access policies, and automate threat response.
D: FortiSIEM - FortiSIEM is a security information and event management solution that can collect and analyze data from multiple sources, including network devices and servers. It can help identify potential security threats, as well as monitor compliance with security policies and regulations.
E: FortiAnalyzer - FortiAnalyzer is a central logging and reporting solution that collects and analyzes data from multiple sources, including FortiNAC and FortiSIEM. It can provide insights into network activity and help identify anomalies or security threats.
NEW QUESTION # 40
......
Best way to practice test for Fortinet NSE7_OTS-7.2: https://www.fast2test.com/NSE7_OTS-7.2-premium-file.html
NSE7_OTS-7.2 Dump Ready - Exam Questions and Answers: https://drive.google.com/open?id=1lVc8jET4jc6cCxahG7Fzjk6xpoS29ALj