Fortinet NSE 7 - OT Security 7.2 Free Sample Questions

In a transparent mode or offline deployment where traffic is received from a SPAN/mirror port, the corresponding FortiGate interface must be configured as a one-arm sniffer. This configuration disables the forwarding of packets and allows the FortiGate to inspect the mirrored traffic for logging and threat detection without being inline. If the interface is configured as a regular network interface, it will not process the promiscuous traffic from the SPAN port correctly for logging purposes.

Because GOOSE messaging is highly sensitive to latency and operates at Layer 2, an inline device is unsuitable. A one-arm sniffer deployment allows a FortiGate to receive a copy of the traffic from a SPAN (Switched Port Analyzer) or mirror port without introducing any latency or becoming a point of failure.

The FortiGuard Industrial Security Service (ISS) provides the necessary IPS and application control signatures to decode and inspect specific OT protocols, including IEC 61850 GOOSE. Without this service, the FortiGate would lack the intelligence to understand and analyze the specialized traffic for threats.

The FortiGuard Industrial Security Service (ISS) provides signature updates for both IPS and Application Control specifically for OT environments. Without this license and service, the FortiGate will not have the updated definitions required to accurately identify and control many industrial applications and protocols.

This is the most comprehensive solution. It uses FortiNAC for centralized asset inventory and profiling. It addresses the constraint of legacy devices by using MAB as an alternative to 802.1X. Crucially, it leverages the Security Fabric integration, allowing FortiNAC to dynamically control VLAN assignments on the FortiSwitches and push device information to the FortiGates, which can then apply granular, identity-based policies with deep inspection for the specified EtherNet/IP protocol. This achieves segmentation, access control, and protocol visibility.

FortiNAC uses multiple methods for profiling. While basic methods like DHCP fingerprinting or TCP stack analysis might yield generic results, more advanced methods are needed for specific OT devices. Siemens PLCs use PROFINET, and the Discovery and Configuration Protocol (DCP) within it allows devices to broadcast their identity. Creating a custom profiling rule that leverages PROFINET DCP is the most reliable way for FortiNAC to query the PLC directly and obtain accurate model and vendor details for correct classification.

FortiGate's Application Control, when used with the Industrial Security Service, provides granular signatures for many OT protocols, including Modbus. It can differentiate between various function codes. An administrator can create a profile that explicitly allows signatures like Modbus.Write.Coil, Modbus.Write.Single.Register, etc., while blocking Modbus.Read.Coil, Modbus.Read.Holding.Register, etc. This provides the required granular control over protocol commands.

This scenario requires orchestration between the monitoring tool (FortiSIEM) and the access control tool (FortiNAC). FortiSIEM can be configured with a correlation rule to detect the anomalous behavior. The rule's action can be set to execute a remediation script or API call to FortiNAC. FortiNAC, as the network access control solution, has the capability to quarantine a device by its MAC address, effectively isolating it at the switch level regardless of its IP address. This provides a direct and effective quarantine mechanism.

While Active-Passive HA provides the necessary redundancy, combining it with link aggregation (LACP/802.3ad) on the monitored interfaces provides superior physical link redundancy and potentially higher throughput. By creating an LACP bundle of physical ports on the FortiGate and connecting them to an LACP-configured switch, the HA cluster can survive a single link failure without triggering a full device failover. This is a robust design for critical OT environments where both device and link uptime are paramount.

In a Zero Trust model, nothing is trusted by default. The foundational step is to verify every access attempt. FortiNAC's core function is to provide network visibility by discovering and profiling every device (the 'who' and 'what'), and then enforcing access control policies (the 'where' and 'when'). This ensures that only authorized and compliant devices are granted the least-privilege access they require, which is a cornerstone of Zero Trust.

Managed switches like FortiSwitch are required to implement port-based security features like 802.1X and MAB, and to integrate with a NAC solution for enforcement.

FortiNAC is the central brain for discovering, profiling, and applying access policies to devices. It is essential for managing a mixed-device environment.

This combination addresses the mixed-device environment. Modern devices can authenticate using the more secure 802.1X, while legacy devices that do not support it can be authenticated via their MAC address using MAB, ensuring all devices are subject to an authentication check.