NSEI_OTS_AR-7.6 Certification Exam Guide + Practice Questions Updated 2026

Explanation:
Deploying a FortiGate in offline IDS (also known as one-arm sniffer mode) is a common strategy in OT environments for several reasons found in the study guide:

Explanation:
The correct answer is A. Fortinet Single-Sign On (FSSO). The study guide states under Active and Passive Authentication that for passive authentication, “User does not receive a login prompt from FortiGate”, “Credentials are determined automatically”, and specifically “FSSO, RSSO, and NTLM can be used.” It then explains that passive authentication occurs with the single sign-on method and explicitly identifies Fortinet SSO (FSSO) as one of those methods. The guide also says: “For passive authentication, you can implement FSSO. FSSO allows users who have already authenticated on the network through another system to be transparently identified. After initial login to any system on the network, users can access allowed resources without being prompted for credentials.” That is exactly what the question asks for: improving access control in a large OT network using passive authentication.
The other options do not match passive authentication. Local users are part of local authentication, two-factor authentication adds an extra security factor but still uses active authentication, and FortiAuthenticator as a remote server supports centralized authentication for mid-to-large networks, but by itself it is not the specific passive-authentication method being asked here. The study guide is explicit that the FortiGate configuration for passive authentication is FSSO.

Explanation:
Based on the provided exhibits from the FortiAnalyzer playbook engine: Therefore, the Run_Report task was triggered (as part of the playbook) by an IPS_Attack_Handling event.

Explanation:
The correct answers are B. Real-time control and D. Determinism. The study guide defines industrial Ethernet as the “use of Ethernet and TCP/IP as transport mechanisms for industrial protocols” and states that it provides “real-time control,” “low latency,” and “determinism (meaning reliable and predictable data delivery)” in harsh environments. It further explains that industrial Ethernet “provides deterministic communication between machine controllers , actuators, sensors, and other units.” These statements directly confirm that the two key advantages are real-time control and determinism.
The other options are not supported by the study guide as core advantages of industrial Ethernet. Encryption is not listed as one of the benefits in this section, and remote access is discussed elsewhere in the OT architecture but not as a defining advantage of industrial Ethernet itself. The guide is explicit that the main benefits here are predictable delivery and real-time communication, which are essential in industrial control environments where timing and reliability matter.

Explanation:
The correct answers are B and D.
Option B is correct because the profile has Medium, High, and Critical selected, while Low severity is not selected. That means low-severity virtual patching signatures are not enforced by this profile. So for the device with MAC address 12:12:12:12:12, low-severity signatures are not blocked. The study guide explains virtual patching as device-specific protection where “FortiGate caches the signatures and mitigation rules that apply to each device” and applies them when the related traffic matches the firewall policy.
Option D is correct because the Virtual Patching Exemptions table shows a row with the MAC address 11:11:11:11:11 and no specific signature listed. The study guide states that in the Virtual Patching profile you can “Exempt a specific device with the MAC address or a specific signature.” A MAC-only exemption means that specific device is excluded from virtual patching enforcement, so in practical terms it is treated as having no applicable vulnerabilities in this profile.
Option C is incorrect because the profile does not block critical signatures for all devices. The exemptions list proves that at least one device can be excluded by MAC address, and a specific signature can also be exempted. Therefore, enforcement is not universal across all devices.
Option A is incorrect because the entry Schneider.Electric.ClearSCADA.HTTP.Interface.XSS appears as a specific signature exemption, not as the only remaining vulnerability. The profile display is showing exemptions, not a statement that only one vulnerability is still present.