NSE6_OTS_AR-7.6 Exam Questions & Answers

The correct answer is A. You must enable Virtual Patching in the Feature Visibility section.

The study guide states clearly that ''By default, virtual patching profiles are hidden on the GUI, and you must enable them through System > Feature Visibility.'' That exactly matches the situation in the exhibit, where Virtual Patching does not appear under Security Profiles. So the issue is not that the feature is unsupported, but that it is simply hidden in the GUI until it is enabled.

The other options do not answer the question being asked. A valid OT security service license is required for virtual patching signatures and protection workflow, and OT signatures are relevant to IPS-based OT protection, but those do not explain why the menu item itself is missing from the Security Profiles section. The guide specifically identifies Feature Visibility as the reason the Virtual Patching profile is not shown in the GUI. Therefore, the required action is to enable Virtual Patching in System > Feature Visibility.

The correct answer is C. Application sensor set to monitor on all the FortiGate devices.

The study guide clearly explains that application control is the feature used to identify OT protocols. It states that ''application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages'' and also says ''You can use application control signatures to detect OT protocols.'' It further shows an example where a Modbus application control profile is enabled on a firewall policy ''for OT protocol visibility in the monitor status.'' This directly matches the requirement in the question, which is to detect OT protocols and increase traffic visibility.

The other options do not fit the requirement as precisely. Device detection is for identifying devices and collecting endpoint information, not for detecting industrial protocols. Inline IDS and IPS are focused more on detecting or blocking attacks, exploits, protocol abnormalities, and known vulnerabilities. While IPS can inspect some OT traffic, the study guide distinguishes it from application control by stating that IPS signatures tend to detect exploits, whereas application control signatures tend to provide protocol detection at various levels. Therefore, the required security sensor for OT protocol detection and traffic visibility is the application sensor in monitor mode.

Based on the OT Security 7.6 Architect study guide regarding the Asset Identity Center and Asset Management:

Vulnerability Visibility: The Asset Identity List tab displays key metadata for IT and OT devices, including detected addresses, users, and a specific column for Vulnerabilities.

Virtual Patching Feature: In the OT Security 7.6 architecture, the 'Vulnerabilities' column is populated through the OT Security Service license, which includes 'OT vulnerability correlation definitions & virtual patching signatures'.

Correlation Mechanism: FortiGate extracts metadata from OT traffic and uses these signatures to identify known vulnerabilities on the assets. For these vulnerabilities to be identified and correlated in the Asset Identity Center as shown in the exhibit (displaying a count of 8 vulnerabilities), the Virtual Patching feature must be active.

Architectural Implementation: Virtual patching is a critical component of the 'Protection' layer in OT networks, allowing administrators to secure legacy or unpatchable PLCs and RTUs by blocking exploit attempts at the network level using IPS-based virtual patching signatures.

Exhibit Analysis: The presence of identified vulnerabilities (the number '8' in the red shield) in the Asset Identity List confirms that the FortiGate is actively performing vulnerability correlation, which is the operational result of having a Virtual Patching security profile applied to the relevant firewall policy.

According to the OT Security 7.6 Architect study guide section on Asset Management, specifically regarding FortiNAC Visibility:

Layer 2 Polling Data: Because each physical address is unique, FortiNAC identifies hosts as they connect to the network. The information gathered during this process fills in the physical address and location information in the database.

Visibility Components: The guide states that the physical address learned, the time it was learned, and where it was learned from provide the foundation of endpoint visibility in the form of 'what, where, and when' information. This confirms that Where it was learned (Option A) and The time it was learned (Option D) are correct.

Exclusions:

Layer 3 Polling: The MAC-to-IP correlation (Option B) is explicitly defined as a function of Layer 3 polling, where the correlated IP address is added to the database record for the corresponding MAC address.

DHCP Fingerprinting: The host name or system name (Option C) and the operating system are gathered via DHCP fingerprinting, not layer 2 polling.

The correct answers are B. Real-time control and D. Determinism. The study guide defines industrial Ethernet as the ''use of Ethernet and TCP/IP as transport mechanisms for industrial protocols'' and states that it provides ''real-time control,'' ''low latency,'' and ''determinism (meaning reliable and predictable data delivery)'' in harsh environments. It further explains that industrial Ethernet ''provides deterministic communication between machine controllers, actuators, sensors, and other units.'' These statements directly confirm that the two key advantages are real-time control and determinism.

The other options are not supported by the study guide as core advantages of industrial Ethernet. Encryption is not listed as one of the benefits in this section, and remote access is discussed elsewhere in the OT architecture but not as a defining advantage of industrial Ethernet itself. The guide is explicit that the main benefits here are predictable delivery and real-time communication, which are essential in industrial control environments where timing and reliability matter.