2026 Updated Fortinet NSE6_OTS_AR-7.6 Certification Study Guide Pass NSE6_OTS_AR-7.6 Fast [Q87-Q108]

Rate this post

2026 Updated Fortinet NSE6_OTS_AR-7.6 Certification Study Guide Pass NSE6_OTS_AR-7.6 Fast

NSE6_OTS_AR-7.6 Dumps PDF 2026 Program Your Preparation EXAM SUCCESS

Fortinet NSE6_OTS_AR-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Asset management: Covers understanding OT standards and how Fortinet aligns with compliance requirements in industrial environments. It also includes using the Fortinet Security Fabric to manage assets and implementing device detection using FortiGate and FortiNAC.
Topic 2	Network access control: Focuses on OT Ethernet fundamentals and designing secure network segmentation strategies. It also includes configuring authentication methods to control and verify access to the OT network.
Topic 3	Monitoring and risk assessment: Covers creating event handlers in FortiAnalyzer to monitor network activity and detect threats. It also includes performing risk assessments and analyzing security reports to support ongoing risk management.
Topic 4	Network security: Explains how to apply security inspections specifically for industrial protocols and implement virtual patching to protect vulnerable systems. It also includes configuring automation to enhance threat response and operational efficiency.

Q87. Which two statements about FortiSIEM are true? (Choose two.)

FortiSIEM can receive data from certain devices in SQL format.

FortiSIEM can receive and collect data from network devices and applications.

FortiSIEM can receive data from any network device and application.

FortiSIEM cannot receive data from a Windows server without an agent.

Q88. Refer to the exhibit.

Based on the information provided on the partial Event Monitor page shown in the exhibit, how was the attack detected? (Choose one answer)

Automatically by a stitch

Manually by an administrator

Automatically by a playbook

Automatically by an event handler

Q89. Refer to the exhibit.

A partial Application Sensor profile is shown. When you apply this profile in firewall policy, which two statements are correct? (Choose two answers)

OT signatures are enabled.

All OT protocols are monitored.

Modbus write commands are blocked.

A log is provided for each Modbus read holding registers command.

Q90. Refer to the exhibit.

A partial OT network is shown. You have configured the FortiGate device with VLANs to segment the OT network. The supervisor now wants to connect to the PLC from the Engineering Workstation. How can you allow access from the Engineering Workstation to the PLC? (Choose one answer)

You must configure intra-switch-policy as explicit.

You must configure intra-switch-policy as implicit.

You must configure forward domain IDs.

You must configure a layer 3 switch.

Q91. You want to automate some tasks in your OT network. Which three configurations are directly available in a new basic event handler on FortiAnalyzer? (Choose three answers)

Create a report

Automatically create an incident

Automation stitch

Send alert email

Quarantine an attacker

Q92. In the Purdue model, at which level are physical assets like the Industrial Internet of Things (IIoT) placed?

At Level 5 only

At Level 1 only

Above Level 4

Below Level 3.5

Q93. Refer to the exhibit.

A partial OT network is shown. You must improve the security of this OT network and implement internal segmentation between network 1 and network 2. How can you achieve the segmentation? (Choose one answer)

You can configure universal ZTNA.

You can configure one traffic VDOM.

You can configure an explicit software switch.

You can configure forward domain IDs for each network.

Q94. Which three protocols are used as industrial Ethernet protocols? (Choose three.)

M12

EtherCAT

RJ45

PROFINET

EtherNet/IP

Q95. Which three criteria can a FortiGate device use to look for a matching firewall policy to process traffic? (Choose three.)

Services defined in the firewall policy.

Source defined as internet services in the firewall policy

Lowest to highest policy ID number

Destination defined as internet services in the firewall policy

Highest to lowest priority defined in the firewall policy

Q96. To increase security protection in an OT network, how does application control on ForliGate detect industrial traffic?

By inspecting software and software-based vulnerabilities

By inspecting applications only on nonprotected traffic

By inspecting applications with more granularity by inspecting subapplication traffic

By inspecting protocols used in the application traffic

Q97. Refer to the exhibit.

A partial OT network is shown. You want to provide the supervisor with secure remote access. Which two features can you implement on Edge-FortiGate ? (Choose two answers)

IPsec

FortiToken

SD-WAN

FSSO

Q98. Refer to the exhibits.

A partial OT network and firewall policies configuration are shown.
You added authentication in the firewall policy from Engineering Workstation to RTU to improve the security. When verifying your configuration, you notice that you can still access RTU from Engineering Workstation without an authentication prompt.
What must you do to enforce authentication?

You must add authentication in firewall policy 9.

You must add a local user instead of FortiAuthenticator.

You must reboot FortiGate.

You must enable Fortinet Single Sign-On (FSSO).

Q99. Refer to the exhibit. The FGT-Edge device is a VPN gateway that allows remote administrators access to the local ICS network. Management hires a third-party company to conduct health and safety on site. The third-party company must have outbound access to external resources.
What is the best scenario to provide external access to the third-party company while continuing to secure the ICS networks?

Configure outbound security policies with limited active authentication users of the third-party company.

Create VPN tunnels between downstream FortiGate devices and the edge FortiGate to protect ICS network traffic.

Split the edge FortiGate device into multiple logical devices to allocate an independent VDOM for the third-party company.

Implement an additional firewall using an additional upstream link to the internet.

Q100. What are two advantages provided by industrial Ethernet? (Choose two answers)

Encryption

Real-time control

Remote access

Determinism

Q101. Refer to the exhibit. An OT architect has implemented a Modbus TCP with a simulation server Conpot to identify and control the Modus traffic in the OT network. The FortiGate-Edge device is configured with a software switch interface ssw-01.
Based on the topology shown in the exhibit, which two statements about the successful simulation of traffic between client and server are true? (Choose two.)

The FortiGate-Edge device must be in NAT mode.

NAT is disabled in the FortiGate firewall policy from port3 to ssw-01.

The FortiGate devices is in offline IDS mode.

Port5 is not a member of the software switch.

Q102. As the first step in your OT network protection plan, you must identify the OT protocols that the FortiGate device supports. Which two configurations must you implement on this FortiGate device? (Choose two answers)

You must enable Device detection on all the interfaces.

You must implement an Application Control security profile that monitors OT.

You must enable the OT signatures.

You must implement an Intrusion Prevention security profile that monitors OT.

Q103. What triggers Layer 2 polling of infrastructure devices connected in the network?

A failed Layer 3 poll

A matched security policy

A matched profiling rule

A linkup or linkdown trap

Q104. Refer to the exhibit. Which statement about the interfaces shown in the exhibit is true?

port2, port2-vlan10, and port2-vlan1 are part of the software switch interface.

The VLAN ID of port1-vlan1 can be changed to the VLAN ID 10.

port1-vlan10 and port2-vlan10 are part of the same broadcast domain

port1, port1-vlan10, and port1-vlan1 are in different broadcast domains

Q105. To increase security protection in an OT network, how does application control on ForliGate detect industrial traffic?

By inspecting software and software-based vulnerabilities

By inspecting applications only on nonprotected traffic

By inspecting applications with more granularity by inspecting subapplication traffic

By inspecting protocols used in the application traffic

Q106. Refer to the exhibit. PLC-3 and CLIENT can send traffic to PLC-1 and PLC-2. FGT-2 has only one software switch (SSW-2) connecting both PLC-3 and CLIENT. PLC-3 and CLIENT can send traffic to each other at the layer 2 level.
What must the operational technology (OT) admin do to prevent layer 2-level communication between PLC-3 and CLIENT?

Set a unique forward domain for each interface of the software switch.

Create a VLAN for each device and replace the current FGT-2 software switch members.

Enable explicit intra-switch policy to require firewall policies on FGT-2.

Implement policy routes on FGT-2 to control traffic between devices.

Q107. Refer to the exhibit. A partial Application Sensor profile is shown.

When you apply this profile in a firewall policy, which two statements are correct? (Choose two answers)

OT signatures are enabled.

All OT protocols are monitored.

Modbus write commands are blocked.

A log is provided for each Modbus read holding registers command.

Q108. Refer to the exhibit.

A simplified OT network is shown. You want to optimize the protection of this OT network. Which two controls must you implement? (Choose two answers)