NSE7-OTS-7-2 Sample Questions & Answers

FortiGate's Application Control, when used with the Industrial Security Service, provides granular signatures for many OT protocols, including Modbus. It can differentiate between various function codes. An administrator can create a profile that explicitly allows signatures like Modbus.Write.Coil, Modbus.Write.Single.Register, etc., while blocking Modbus.Read.Coil, Modbus.Read.Holding.Register, etc. This provides the required granular control over protocol commands.

This scenario requires orchestration between the monitoring tool (FortiSIEM) and the access control tool (FortiNAC). FortiSIEM can be configured with a correlation rule to detect the anomalous behavior. The rule's action can be set to execute a remediation script or API call to FortiNAC. FortiNAC, as the network access control solution, has the capability to quarantine a device by its MAC address, effectively isolating it at the switch level regardless of its IP address. This provides a direct and effective quarantine mechanism.

While Active-Passive HA provides the necessary redundancy, combining it with link aggregation (LACP/802.3ad) on the monitored interfaces provides superior physical link redundancy and potentially higher throughput. By creating an LACP bundle of physical ports on the FortiGate and connecting them to an LACP-configured switch, the HA cluster can survive a single link failure without triggering a full device failover. This is a robust design for critical OT environments where both device and link uptime are paramount.

In a Zero Trust model, nothing is trusted by default. The foundational step is to verify every access attempt. FortiNAC's core function is to provide network visibility by discovering and profiling every device (the 'who' and 'what'), and then enforcing access control policies (the 'where' and 'when'). This ensures that only authorized and compliant devices are granted the least-privilege access they require, which is a cornerstone of Zero Trust.

Managed switches like FortiSwitch are required to implement port-based security features like 802.1X and MAB, and to integrate with a NAC solution for enforcement.

FortiNAC is the central brain for discovering, profiling, and applying access policies to devices. It is essential for managing a mixed-device environment.

This combination addresses the mixed-device environment. Modern devices can authenticate using the more secure 802.1X, while legacy devices that do not support it can be authenticated via their MAC address using MAB, ensuring all devices are subject to an authentication check.

FortiAnalyzer can only report on data it receives. For it to be aware of specific application commands like Modbus.Write.Single.Register, the FortiGate must first inspect the traffic using an Application Control profile that has the appropriate signatures enabled. Furthermore, logging must be enabled within that firewall policy and security profile so that the detected application events are sent to FortiAnalyzer for analysis and reporting.

Fortinet's custom IPS signatures use a specific syntax. F-SBID is the header. The --service keyword is used to specify the protocol (TCP, UDP, ICMP, IP). The --dport keyword specifies the destination port. The --pattern keyword is used to define the specific payload to match, with the payload typically enclosed in | characters as a hex string.

Engineering Workstations (EWS) are specialized computers used to configure, program, and maintain devices at Level 1 (like PLCs) and Level 2 (like HMIs). Therefore, they are typically located at Level 2, the Area Supervisory Control level, where they can interact with the control systems they manage. Sometimes they may also be found at Level 3, but their primary operational context is with the supervisory and control devices.

FortiSIEM supports multiple discovery methods. For sensitive OT environments where active scanning can disrupt operations, FortiSIEM can be configured to discover assets passively by analyzing network flows (like NetFlow, sFlow) or by directly monitoring traffic from a SPAN/mirror port. This allows it to identify devices, protocols, and communication patterns without sending any packets to the OT devices themselves.

This approach directly addresses both requirements. Deploying the FortiGates in Transparent Mode allows them to be inserted into the network for segmentation without requiring any IP address changes or introducing routing complexity, which is ideal for a sensitive DCS. The Intrusion Prevention System (IPS) is the Fortinet feature designed for virtual patching; by applying an IPS profile with signatures that block exploits for the known vulnerabilities, the FortiGate can protect the operator stations without altering the underlying OS. This combination provides effective security with the lowest possible performance impact.