Free NSE7-OTS-7-2 sample questions

Correct answer: The FortiGate interface connected to the SPAN port is not configured as a one-arm sniffer.

In a transparent mode or offline deployment where traffic is received from a SPAN/mirror port, the corresponding FortiGate interface must be configured as a one-arm sniffer. This configuration disables the forwarding of packets and allows the FortiGate to inspect the mirrored traffic for logging and threat detection without being inline. If the interface is configured as a regular network interface, it will not process the promiscuous traffic from the SPAN port correctly for logging purposes.

Correct answers: Configure a FortiGate interface as a one-arm sniffer connected to a SPAN port on the industrial switch.; Enable the FortiGuard Industrial Security Service for IEC 61850 signatures.

Because GOOSE messaging is highly sensitive to latency and operates at Layer 2, an inline device is unsuitable. A one-arm sniffer deployment allows a FortiGate to receive a copy of the traffic from a SPAN (Switched Port Analyzer) or mirror port without introducing any latency or becoming a point of failure.

The FortiGuard Industrial Security Service (ISS) provides the necessary IPS and application control signatures to decode and inspect specific OT protocols, including IEC 61850 GOOSE. Without this service, the FortiGate would lack the intelligence to understand and analyze the specialized traffic for threats.

Correct answer: False

The FortiGuard Industrial Security Service (ISS) provides signature updates for both IPS and Application Control specifically for OT environments. Without this license and service, the FortiGate will not have the updated definitions required to accurately identify and control many industrial applications and protocols.

Correct answer: Use FortiNAC to profile all devices, enforce 802.1X for capable devices, and apply MAC Authentication Bypass (MAB) for legacy PLCs. Leverage FortiNAC's integration with the Security Fabric to dynamically assign devices to appropriate VLANs and apply corresponding FortiGate security policies with EtherNet/IP inspection.

This is the most comprehensive solution. It uses FortiNAC for centralized asset inventory and profiling. It addresses the constraint of legacy devices by using MAB as an alternative to 802.1X. Crucially, it leverages the Security Fabric integration, allowing FortiNAC to dynamically control VLAN assignments on the FortiSwitches and push device information to the FortiGates, which can then apply granular, identity-based policies with deep inspection for the specified EtherNet/IP protocol. This achieves segmentation, access control, and protocol visibility.

Correct answer: Configure a custom device profiling rule that uses the PROFINET DCP protocol to read the device's specific model and vendor information.

FortiNAC uses multiple methods for profiling. While basic methods like DHCP fingerprinting or TCP stack analysis might yield generic results, more advanced methods are needed for specific OT devices. Siemens PLCs use PROFINET, and the Discovery and Configuration Protocol (DCP) within it allows devices to broadcast their identity. Creating a custom profiling rule that leverages PROFINET DCP is the most reliable way for FortiNAC to query the PLC directly and obtain accurate model and vendor details for correct classification.

Correct answer: An Application Control profile with specific Modbus function signatures.

FortiGate's Application Control, when used with the Industrial Security Service, provides granular signatures for many OT protocols, including Modbus. It can differentiate between various function codes. An administrator can create a profile that explicitly allows signatures like `Modbus.Write.Coil`, `Modbus.Write.Single.Register`, etc., while blocking `Modbus.Read.Coil`, `Modbus.Read.Holding.Register`, etc. This provides the required granular control over protocol commands.

Correct answer: A FortiSIEM rule that triggers a notification action, which executes a CLI script on FortiNAC to quarantine the endpoint's MAC address.

This scenario requires orchestration between the monitoring tool (FortiSIEM) and the access control tool (FortiNAC). FortiSIEM can be configured with a correlation rule to detect the anomalous behavior. The rule's action can be set to execute a remediation script or API call to FortiNAC. FortiNAC, as the network access control solution, has the capability to quarantine a device by its MAC address, effectively isolating it at the switch level regardless of its IP address. This provides a direct and effective quarantine mechanism.

Correct answer: Active-Passive with link aggregation (802.3ad) configured for monitored interfaces.

While Active-Passive HA provides the necessary redundancy, combining it with link aggregation (LACP/802.3ad) on the monitored interfaces provides superior physical link redundancy and potentially higher throughput. By creating an LACP bundle of physical ports on the FortiGate and connecting them to an LACP-configured switch, the HA cluster can survive a single link failure without triggering a full device failover. This is a robust design for critical OT environments where both device and link uptime are paramount.

Correct answer: To identify, profile, and control every device seeking access to the network.

In a Zero Trust model, nothing is trusted by default. The foundational step is to verify every access attempt. FortiNAC's core function is to provide network visibility by discovering and profiling every device (the 'who' and 'what'), and then enforcing access control policies (the 'where' and 'when'). This ensures that only authorized and compliant devices are granted the least-privilege access they require, which is a cornerstone of Zero Trust.

Correct answers: Deploy FortiSwitch devices to replace unmanaged switches.; Deploy FortiNAC to manage network access control policies.; Enable both 802.1X and MAC Authentication Bypass (MAB) on FortiSwitch ports.

Managed switches like FortiSwitch are required to implement port-based security features like 802.1X and MAB, and to integrate with a NAC solution for enforcement.

FortiNAC is the central brain for discovering, profiling, and applying access policies to devices. It is essential for managing a mixed-device environment.

This combination addresses the mixed-device environment. Modern devices can authenticate using the more secure 802.1X, while legacy devices that do not support it can be authenticated via their MAC address using MAB, ensuring all devices are subject to an authentication check.