NSE6_OTS_AR-7.6 Dumps with Practice Exam Questions Answers

The correct answer is B. A firewall policy has a Virtual Patching security profile applied to it .

The decisive clue in the exhibit is the Vulnerabilities column showing KEVs and device-specific vulnerability counts. The study guide explains the virtual patching workflow in this exact way: “FortiGate performs a lookup for device-specific vulnerabilities and mitigation rules in FortiGuard,” then “FortiGuard returns specific OT virtual patching signatures,” and “FortiGate caches the signatures and mitigation rules that apply to each device.” That is the same behavior reflected by the Asset Identity List showing vulnerability information per detected device.

The guide then states that “When traffic related to the vulnerable device reaches FortiGate, the firewall policy with the virtual patching profile applies.” It also says “A virtual patching profile can be applied to firewall policies in any direction, protecting traffic from or to the vulnerable OT device.” This directly links the per-device vulnerability visibility to a Virtual Patching profile enforced through firewall policy.

The other options do not match the exhibit. Antivirus is not described in the study guide as building a device-by-device vulnerability list, Application Control is used for OT protocol and message visibility, and IPS focuses on exploit detection and prevention. The Vulnerabilities/KEVs display is the indicator that FortiGate is using Virtual Patching logic for those OT devices.

The correct answer is C. Industrial Control System (ICS) . The study guide states that “ICS is a main component of OT” and “consists of systems used for monitoring and controlling industrial processes.” It also explains that ICS includes various devices, systems, controls, and networks that manage industrial processes, and that the most common types are SCADA and distributed control systems (DCS) . This makes ICS the primary OT component for monitoring and controlling industrial processes.

The other options are related OT components, but they are not the best answer to this wording. SCADA collects real-time data and helps visualize and control the OT environment, but it is described as a system within the broader ICS structure. PLC devices collect and transmit real-time data and connect sensors and RTUs to SCADA, while IIoT refers to sensors, actuators, and other connected field devices. Therefore, the overarching main OT component for monitoring and controlling industrial processes is ICS .

The correct answers are C and D .

Option D is correct because the Playbook Monitor clearly shows the starter as On_Demand and the trigger as user(admin) . The study guide states that “ON_DEMAND: The playbook runs when an administrator manually starts it” and also notes that to run it manually, you select the playbook and click Run . This exactly matches the exhibit, so the playbook was manually triggered.

Option C is also correct. The study guide explains that “tasks run one after another” and that “if needed, the output of one task can be used by the tasks that follow it.” It also gives an example where workflow logic matters, such as creating an incident and then attaching details to it. In the exhibit, the sequence shown is Attach_report , then Run_report , then Create_Incident , while the incident analysis shows no report attached . Since the report must exist and the incident must already be available before it can be attached properly, the task order is wrong and must be reordered.

Option B is incorrect because the monitor shows multiple tasks completed successfully, not only Create_Incident . Option A is not the best answer because the main problem demonstrated by the exhibits is not simply waiting time, but the incorrect workflow order. The playbook completed successfully, yet the report is still not attached, which indicates a design issue in the task sequence rather than just a delay.

Based on the exhibit and the OT Security 7.6 Architect standards for Secure Remote Access :

Secure Tunneling (Statement A) : The exhibit shows a Remote PC connecting through a VPN Cloud to the Edge-FortiGate . In the Fortinet architecture, IPsec VPN is the primary method for establishing a secure, encrypted tunnel for remote administrators or supervisors to access the internal OT segments (Level 2/3) from an external location.

Multi-Factor Authentication (Statement B) : Secure remote access in OT environments (aligned with IEC 62443 standards) requires strong authentication. The study guide emphasizes the use of FortiToken to provide Two-Factor Authentication (2FA) for VPN users, ensuring that compromised credentials alone are not enough to gain access to critical infrastructure.

FSSO (Statement D) : Fortinet Single Sign-On is generally used for identifying internal users already on the network to apply identity-based policies; it is not the primary mechanism for establishing the remote connection itself.

SD-WAN (Statement C) : While SD-WAN can manage the path of the VPN traffic, it is a WAN optimization and reliability feature, not a " secure remote access " feature for a supervisor in the context of authentication and encryption.

 The study guide says playbooks are used to automate tasks such as running reports and creating/updating incidents . It also says that after a playbook is triggered, it flows through its configured tasks.

 It further shows a sample playbook sequence where an event is detected, an incident is created , a report runs , and details are attached to the incident . That is exactly the kind of workflow shown in the incident analysis view.

 By contrast, the study guide says event handlers generate events when logs match configured rules. Event handlers are for detection, not for attaching reports to incidents.