I85PREP
⌘ K
Fortinet OT Security Architect study materials
Fortinet OT Security Architect study resources

Fortinet OT Security Architect practice questions

One question at a time. Build your Fortinet OT Security Architect understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1OT Security Fundamentals and Architecture

In the Purdue Enterprise Reference Architecture model, which level contains the safety instrumented systems and basic regulatory control loops that directly actuate physical equipment?

  1. Level 2
  2. Level 1 Correct answer.
  3. Level 3
  4. Level 0

Explanation

Purdue Level 1 is the basic control layer, where controllers such as PLCs and DCS run regulatory and safety logic that directly commands actuators and reads sensors. Level 0 is the physical process itself (sensors and final elements), while supervisory and site operations sit above at Levels 2 and 3.

Question 2OT Security Fundamentals and Architecture

A utility wants to allow vendor remote support into a plant DMZ without exposing the control network. Which architectural control best enforces this while preserving an audit trail?

  1. Publish the HMI directly to the internet behind a NAT rule
  2. Rely on the vendor's own endpoint firewall for segmentation
  3. Use a jump host in the DMZ with session recording and MFA Correct answer.
  4. Give the vendor a site-to-site VPN terminating inside Level 1

Explanation

A bastion or jump host placed in the industrial DMZ, protected by multi-factor authentication and recording every session, keeps vendor access brokered and auditable without granting a path into control layers. It is the standard way to satisfy both remote support needs and segmentation policy.

Question 3OT Security Fundamentals and Architecture

Which characteristic most distinguishes OT security priorities from conventional IT security priorities?

  1. Availability and safety of the physical process outrank data confidentiality Correct answer.
  2. Confidentiality of stored records is always the top priority
  3. Identity management is unnecessary because devices are isolated
  4. Patch cadence is faster because downtime is cheap

Explanation

In OT the primary goals are safe, continuous operation of physical processes, so availability and integrity generally take precedence over confidentiality, which dominates much of IT security. This priority inversion drives design choices such as change windows, compensating controls, and passive monitoring.

Question 4OT Security Fundamentals and Architecture

An engineer proposes placing a firewall between the plant control network and the enterprise IT network. Which traffic policy best reflects IEC 62443 zone and conduit guidance?

  1. Allow any traffic that originates from the IT side
  2. Allow all industrial protocols in both directions for simplicity
  3. Deny by default and allow only documented, required flows per conduit Correct answer.
  4. Permit all traffic but log it for later review

Explanation

IEC 62443 treats a conduit as a controlled communication path between zones, and each conduit should carry only the flows that are explicitly required and documented. Default-deny with a minimal allowlist reduces the attack surface and makes the conduit auditable.

Question 5OT Security Fundamentals and Architecture

Which statement correctly describes the role of a unidirectional gateway (data diode) in an OT architecture?

  1. It replaces the need for any firewall between zones
  2. It provides bidirectional replication with encryption for control traffic
  3. It enforces one-way data flow from a lower-trust to a higher-trust network
  4. It enforces one-way data flow from the OT network out to IT with no return path Correct answer.

Explanation

A data diode physically permits traffic in only one direction, and in OT it is typically oriented to send telemetry or historian data outward from the control zone to IT with no return channel. This lets IT consume OT data while removing any inbound path into the control network.

Question 6OT Security Fundamentals and Architecture

A plant runs a legacy controller that cannot be patched and has a known remotely exploitable vulnerability. Which compensating control set is most appropriate under a defense-in-depth strategy?

  1. Isolate the controller behind strict conduit rules and add passive monitoring for anomalous commands Correct answer.
  2. Connect it to the internet so the vendor can patch it remotely
  3. Rely on antivirus installed on the controller's real-time operating system
  4. Disable the controller and accept production loss until a patch exists

Explanation

When a device cannot be patched, the accepted approach is to reduce exposure through tight segmentation and to add detection so exploitation attempts are visible. This layers preventive and detective controls around an otherwise unpatchable asset.

Question 7OT Security Fundamentals and Architecture

Which protocol is inherently insecure for OT because it transmits commands with no authentication or integrity protection, making it a frequent target for manipulation?

  1. IPsec
  2. SNMPv3
  3. HTTPS
  4. Modbus/TCP Correct answer.

Explanation

Modbus/TCP was designed for serial-era determinism and carries no authentication, integrity, or encryption, so any host that can reach the port can issue commands. This is why it is commonly wrapped in segmented conduits and monitored for anomalous function codes.

Question 8OT Security Fundamentals and Architecture

What is the primary security reason to maintain an accurate OT asset inventory that includes firmware versions and communication relationships?

  1. It satisfies software licensing audits only
  2. It removes the need for network segmentation
  3. It enables vulnerability correlation and detection of unauthorized or rogue devices Correct answer.
  4. It guarantees that all devices are patched automatically

Explanation

Knowing which devices exist, what firmware they run, and how they communicate lets defenders map vulnerabilities to actual assets and spot rogue or misconfigured devices. Inventory is foundational because most OT controls, from patching to conduit design, depend on it.

Question 9OT Security Fundamentals and Architecture

A passive OT monitoring sensor is deployed on a SPAN port. What is its principal advantage over active scanning in a live process environment?

  1. It authenticates every device on the network
  2. It eliminates the need for any network taps
  3. It can force firmware updates on discovered devices
  4. It observes traffic without sending packets that could disturb fragile controllers Correct answer.

Explanation

Passive monitoring copies existing traffic, so it identifies assets and behavior without injecting probes that legacy controllers may mishandle. Active scanning can cause faults or communication timeouts on sensitive devices, which is why passive discovery is preferred in live plants.

Question 10OT Security Fundamentals and Architecture

Which control most directly limits the blast radius if an engineering workstation is compromised by malware?

  1. Micro-segmentation restricting the workstation to only its required controller flows Correct answer.
  2. A longer password policy for all plant staff
  3. Encrypting backups of the historian
  4. Increasing the log retention period on the firewall

Explanation

Micro-segmentation constrains what a compromised engineering workstation can reach, so malware cannot pivot freely to other controllers or zones. Limiting allowed flows to the specific devices the workstation must manage directly reduces lateral movement.

Question 11OT Security Fundamentals and Architecture

In the IEC 62443 vocabulary, what is the difference between a zone and a conduit?

  1. A zone is an IT concept only; a conduit applies only to wireless
  2. A zone is a firewall rule; a conduit is a physical cable
  3. A zone is a backup site; a conduit is a failover link
  4. A zone is a group of assets with common security requirements; a conduit is the controlled path between zones Correct answer.

Explanation

A zone groups assets that share security requirements and a target security level, while a conduit is the communication channel connecting zones that must be secured and monitored. Together they define the segmentation model for the industrial automation and control system.

Question 12OT Security Fundamentals and Architecture

An organization wants to detect command injection attempts against PLCs without blocking legitimate traffic. Which capability is most relevant?

  1. A network intrusion detection system with OT protocol-aware signatures deployed passively Correct answer.
  2. A DNS sinkhole for the enterprise network
  3. A host-based antivirus agent installed on each PLC
  4. A web application firewall in front of the historian

Explanation

OT-aware intrusion detection inspects industrial protocol traffic for malicious function codes and parameter anomalies while running passively, so it alerts without interrupting control communications. This matches the requirement for detection without inline blocking.

Question 13OT Security Fundamentals and Architecture

Why is the industrial DMZ a required architectural element between enterprise IT and the plant control network?

  1. It provides physical security for the control room
  2. It replaces the need for endpoint protection on engineering workstations
  3. It terminates and brokers all shared services so no direct IT-to-OT connection exists Correct answer.
  4. It stores the primary process historian for regulatory reporting only

Explanation

The industrial DMZ hosts brokered services such as jump hosts, patch repositories, and replica historians so that IT and OT never connect directly. Traffic terminates in the DMZ and is re-originated, breaking any direct path into the control zone.

Question 14OT Security Fundamentals and Architecture

A safety instrumented system shares a network switch with the basic process control system. Which action best aligns with IEC 62443 guidance for safety systems?

  1. Place the SIS in its own zone with a dedicated conduit and restrict its communications to the BPCS Correct answer.
  2. Allow the SIS to be reached from the enterprise network for remote diagnostics
  3. Merge them into one zone to simplify firewall rules
  4. Connect the SIS to the same flat network as the corporate wireless

Explanation

Safety systems warrant their own zone because their security requirements and target security level typically exceed those of the BPCS, and any communication between them should be a tightly restricted conduit. This preserves the independence that safety analysis assumes.

Question 15OT Security Fundamentals and Architecture

Which practice best supports secure remote engineering changes to PLC logic across a segmented architecture?

  1. Using a managed jump host with MFA, approval workflow, and recorded sessions in the DMZ Correct answer.
  2. Sharing a single administrative account among the engineering team
  3. Emailing project files to a contractor who uploads them from home
  4. Editing logic directly over an open VPN into the control zone from any laptop

Explanation

Brokered access through a managed jump host with multi-factor authentication, change approval, and session recording keeps engineering changes controlled and attributable. It also keeps the change path inside the DMZ rather than opening direct tunnels into the control zone.

Question 16OT Security Fundamentals and Architecture

What is the security significance of the Purdue Level 3 to Level 3.5 boundary?

  1. It separates site operations from the industrial DMZ, where IT and OT services are brokered Correct answer.
  2. It is where safety loops are wired
  3. It separates field devices from controllers
  4. It marks the boundary between sensor and actuator

Explanation

Level 3 covers site operations such as historians and management systems, and Level 3.5 is the industrial DMZ where shared IT/OT services are brokered. Enforcing policy at this boundary prevents direct enterprise reach into site operations.

Question 17OT Security Fundamentals and Architecture

An architect must choose between inline blocking and passive detection for a fragile legacy segment. Which reasoning is most sound?

  1. Inline blocking is always preferred because prevention is better than detection
  2. Passive detection is safer where inline devices could add latency or fail closed and disrupt the process Correct answer.
  3. Inline blocking is required by IEC 62443 for all conduits
  4. Passive detection should be used everywhere because blocking is never appropriate in OT

Explanation

On fragile legacy segments, an inline device introduces latency and a fail-closed risk that can interrupt the process, so passive detection is often the safer first step. Blocking can later be introduced where the process tolerates it and where the risk justifies it.

Question 18OT Security Fundamentals and Architecture

Which element of a defense-in-depth OT architecture primarily addresses the risk of unauthorized removable media introducing malware?

  1. Increasing the historian's storage capacity
  2. Rotating SNMP community strings
  3. Endpoint control with device allowlisting and scanned media transfer stations Correct answer.
  4. Segmenting the enterprise wireless network

Explanation

Removable media risk is mitigated by controlling which devices may mount and by scanning media at a dedicated transfer station before it enters the control zone. This targets the actual infection vector rather than unrelated infrastructure.

Question 19OT Security Fundamentals and Architecture

A vendor states a controller supports only a proprietary protocol over TCP port 5000. How should the architect treat this in the conduit design?

  1. Allow the specific source-destination pair on port 5000 and document the business justification Correct answer.
  2. Deny the flow and require replacement of the controller
  3. Permit all high ports because the protocol is proprietary
  4. Open the entire subnet between zones to avoid troubleshooting

Explanation

Conduit design should permit only the required source, destination, and service, with the justification recorded so the rule can be reviewed and audited. Narrow allowlists preserve least privilege even for proprietary protocols.

Question 20OT Security Fundamentals and Architecture

Which statement about the CIA triad in OT is most accurate?

  1. Integrity of process data and commands is critical because corrupted values can cause physical harm Correct answer.
  2. Confidentiality always outweighs integrity in control networks
  3. The triad does not apply to industrial environments
  4. Availability is irrelevant because plants run continuously anyway

Explanation

In OT, integrity of commands and process values is paramount because manipulated data can drive equipment into unsafe states with physical consequences. Availability is also critical, but the point is that the triad is reordered rather than ignored.

Question 21OT Security Fundamentals and Architecture

An attacker gains access to an HMI at Level 2. Which architectural weakness would most enable lateral movement to controllers at Level 1?

  1. Session recording on the jump host
  2. Encrypted backups of the HMI configuration
  3. Use of multi-factor authentication on the HMI
  4. A flat network where the HMI and controllers share a broadcast domain with no internal filtering Correct answer.

Explanation

If the HMI and controllers share a flat segment with no internal filtering, a compromised HMI can reach controllers directly, enabling lateral movement. Segmentation with internal conduits is what contains such a compromise.

Question 22OT Security Fundamentals and Architecture

Which is the most defensible reason to deploy an OT asset discovery tool that uses both passive traffic analysis and carefully rate-limited active queries?

  1. Active scanning is always safe in OT and should be the only method
  2. Passive alone may miss devices that never communicate, while active alone risks disturbing them Correct answer.
  3. Passive monitoring cannot identify any device
  4. Rate limiting is only relevant to enterprise IT networks

Explanation

Silent or rarely communicating devices can be invisible to passive monitoring, while unthrottled active probing can upset sensitive controllers. A hybrid approach with rate-limited queries balances completeness against process safety.

Question 23OT Security Fundamentals and Architecture

What does the IEC 62443 concept of a target security level (SL-T) express for a zone?

  1. The security level the asset owner intends the zone to achieve against defined threat levels Correct answer.
  2. The maximum number of devices allowed in the zone
  3. The physical access level of the control room
  4. The encryption algorithm mandated for the zone

Explanation

The target security level states the protection the asset owner requires for a zone against defined threat categories. Achieved security level is then assessed against that target to drive remediation.

Question 24OT Security Fundamentals and Architecture

A plant wants to allow IT to query a read-only replica historian in the DMZ while preventing any access to the source historian in Level 3. Which design achieves this?

  1. Place the Level 3 historian on the corporate domain for easier access
  2. Allow IT to reach Level 3 directly but log the sessions
  3. Replicate data one-way from Level 3 to the DMZ replica and permit IT to query only the replica Correct answer.
  4. Give IT read-only credentials to the Level 3 historian

Explanation

A one-way replication into a DMZ replica lets IT consume data while keeping the source historian unreachable from IT, preserving the zone boundary. IT access is then confined to the replica, which holds no control functions.

Question 25OT Security Fundamentals and Architecture

Which practice best reduces the risk posed by default credentials on OT network devices such as switches and gateways?

  1. Store credentials in a shared spreadsheet on the engineering workstation
  2. Disable logging so credential use is not recorded
  3. Leave defaults so field technicians can always log in
  4. Change defaults at commissioning and manage credentials in a controlled vault Correct answer.

Explanation

Default credentials are widely known and should be replaced during commissioning, with the new secrets held in a controlled vault to preserve accountability. This removes an easy entry point while keeping credentials retrievable by authorized staff.

Question 26OT Security Fundamentals and Architecture

Under the Purdue Enterprise Reference Architecture, at which level does the site-level manufacturing operations management and historian aggregation typically reside, sitting between the plant control zone and the enterprise?

  1. Level 3 Correct answer.
  2. Level 0
  3. Level 1
  4. Level 4

Explanation

Purdue Level 3 is the site operations layer where manufacturing execution, plant historians, and operations management functions aggregate data from lower control levels. Level 4 is the enterprise/business network, and Levels 0-1 are physical process and basic control. The Level 3 to Level 3.5 boundary is a key segmentation point because it separates plant operations from enterprise services.

Question 27OT Security Fundamentals and Architecture

An OT architect is documenting the trust boundaries in a plant. Which statement best describes how IEC 62443 zones and conduits relate to the Purdue model?

  1. Each Purdue level must map to exactly one IEC 62443 zone, and conduits exist only at Level 3.5.
  2. Zones are defined by asset grouping and required security level, and conduits are the controlled communication paths between them, independent of strict level boundaries. Correct answer.
  3. Zones apply only to safety systems, while conduits apply only to the enterprise network.
  4. Conduits are physical cable runs, and zones are the switch VLANs that terminate them.

Explanation

IEC 62443 zones are groupings of assets that share security requirements, and conduits are the communication channels that connect zones and are subject to controls. Zones do not have to align one-to-one with Purdue levels, although the model is often used as a starting point. This flexibility lets architects group assets by function and risk rather than by network diagram alone.

Question 28OT Security Fundamentals and Architecture

A plant operator reports that a wireless maintenance tablet can reach a PLC across a network segment that was intended to be isolated. Which architectural control most directly prevents this path while still allowing approved maintenance access?

  1. Increasing the password length on the PLC programming software.
  2. Enabling broadcast storm control on the switch connecting the tablet.
  3. Renaming the PLC to a non-obvious hostname.
  4. Deploying a firewall or conduit policy that permits only the specific maintenance protocol and hosts, and denying all other transit. Correct answer.

Explanation

A conduit control, implemented as a firewall or equivalent policy enforcement point, limits traffic between zones to explicitly approved flows. Restricting the maintenance segment to specific hosts and protocols removes the unintended reachability while preserving approved access. Passwords, storm control, and hostnames do not stop a reachable network path from being used.

Question 29OT Security Fundamentals and Architecture

Which statement best explains why OT architectures often prioritize availability and integrity over confidentiality when allocating security controls?

  1. Integrity matters less than confidentiality because PLC logic is rarely changed.
  2. Loss of process availability can endanger people, environment, and production, so controls must not disrupt real-time control even when that limits encryption or inspection options. Correct answer.
  3. Confidentiality is irrelevant because process data has no commercial value.
  4. OT networks are always air-gapped, so confidentiality controls are unnecessary.

Explanation

In OT, a control action that halts or delays a process can cause physical harm, environmental release, or major production loss. Security designs therefore weigh availability and integrity heavily and avoid controls that introduce unacceptable latency or failure modes. Confidentiality still matters, but it is balanced against those operational consequences.

Question 30OT Security Fundamentals and Architecture

A security team wants to identify every device on a plant floor, including dormant controllers that send no traffic. Which discovery approach best meets this requirement?

  1. Active scanning with aggressive probes during peak production.
  2. Reviewing the enterprise DHCP lease table only.
  3. Passive network traffic analysis only.
  4. A combination of passive traffic monitoring and safe active querying, correlated into a single asset inventory. Correct answer.

Explanation

Passive monitoring reveals devices that communicate, but dormant or quiet devices may never appear. Safe active querying, using protocol-appropriate methods, can reach those devices and confirm identity and firmware. Correlating both sources produces a more complete inventory than either method alone.

Question 31OT Security Fundamentals and Architecture

An engineer must remotely update PLC logic from a corporate workstation. Which combination of controls best supports this while preserving segmentation?

  1. Opening the PLC programming port to the entire corporate subnet during change windows.
  2. Shared administrator credentials distributed to the engineering team for convenience.
  3. A direct VPN tunnel from the workstation into the Level 1 control network.
  4. A jump host in the industrial DMZ with multi-factor authentication, session recording, and protocol-specific allowlisting to the target PLC. Correct answer.

Explanation

A brokered jump host in the DMZ keeps the control network segmented while providing an auditable, authenticated path for engineering changes. MFA, session recording, and narrow protocol allowlisting reduce the chance that the access path becomes a general-purpose bridge. Direct tunnels and broad port openings collapse the segmentation the architecture is meant to preserve.

Question 32OT Security Fundamentals and Architecture

A legacy controller cannot be patched and has a known remotely exploitable flaw. Which compensating control set is most defensible?

  1. Restrict reachability to the controller with a conduit policy, monitor for exploit attempts, and isolate it in a tightly scoped zone. Correct answer.
  2. Rely on the vendor to release a patch and take no interim action.
  3. Move the controller to the enterprise network so IT security tools can protect it.
  4. Disable all logging on the controller to reduce performance impact.

Explanation

When patching is not possible, reducing exposure is the primary compensating strategy: limit who can reach the device, watch for exploitation attempts, and contain it within a small zone. These controls lower the likelihood and blast radius of exploitation without requiring a firmware change. Waiting for a patch or relocating the device increases risk.

Question 33OT Security Fundamentals and Architecture

What does a target security level (SL-T) express for an IEC 62443 zone?

  1. The maximum security level any vendor product can support.
  2. The security level the asset owner requires the zone to achieve against the identified threat environment. Correct answer.
  3. The security level the zone is currently assessed to achieve.
  4. The number of firewalls that must protect the zone.

Explanation

SL-T is the required security level that the asset owner sets for a zone based on risk and threat environment. It is distinct from the achieved security level (SL-A) and from the capability of individual products (SL-C). Comparing SL-T with SL-A shows where additional controls are needed.

Question 34OT Security Fundamentals and Architecture

Which risk is most specifically introduced by allowing engineering laptops to connect to both the corporate Wi-Fi and the plant control network?

  1. The laptop becomes a bridge that can carry malware or unauthorized traffic between IT and OT zones. Correct answer.
  2. Increased electricity consumption in the control cabinets.
  3. The laptop will consume more PLC program memory.
  4. The PLC clock may drift out of synchronization.

Explanation

A device with simultaneous or sequential connectivity to two zones can act as an unintended bridge, bypassing the conduit controls between them. This is a common path for malware to cross from IT into OT. Architecture should either prevent dual-homing or tightly control and monitor it.

Question 35OT Security Fundamentals and Architecture

A plant wants enterprise users to query a read-only historian replica in the DMZ while preventing any access to the source historian in the control network. Which design best achieves this?

  1. Allow enterprise access to the source historian only during business hours.
  2. Replicate data one-way from the control-network historian to a DMZ replica, and allow enterprise queries only to the replica. Correct answer.
  3. Place the source historian on the enterprise network and replicate back into the plant.
  4. Allow the enterprise to reach the source historian directly, relying on database read-only accounts.

Explanation

A one-way replication into the DMZ creates a data diode-like path that lets enterprise users read data without any route into the control network. Access controls on the replica then limit enterprise queries. Direct access, even read-only, keeps a live path into the control zone that can be abused.

Question 36OT Security Fundamentals and Architecture

Which protocol characteristic makes Modbus/TCP inherently weak for protecting command integrity on an OT network?

  1. It operates only over serial links and cannot be routed.
  2. It transmits function codes and register writes without authentication or integrity protection. Correct answer.
  3. It requires mutual TLS before any read is allowed.
  4. It encrypts payloads but uses weak key lengths.

Explanation

Modbus/TCP carries commands and data in clear form with no built-in authentication or integrity checks. Anyone with network reachability can craft valid-looking writes to registers. This is why conduit controls, monitoring, and compensating measures are essential around Modbus devices.

Question 37OT Security Fundamentals and Architecture

An architect is deciding where to place an inline OT intrusion prevention system on a segment carrying safety-related traffic. Which consideration should dominate the decision?

  1. The IPS should never be used in OT under any circumstances.
  2. The IPS should be evaluated for fail-open behavior, latency, and the consequence of a false positive before being placed inline on safety traffic. Correct answer.
  3. The IPS should be placed inline only if it can decrypt all traffic.
  4. The IPS should be placed inline because blocking is always preferable in OT.

Explanation

Inline prevention on safety or fragile segments can cause harm if the device fails closed or blocks legitimate traffic. The architect must confirm fail-open design, acceptable latency, and tested behavior under false positives before inline placement. Where those cannot be assured, passive detection with out-of-band response is safer.

Question 38OT Security Fundamentals and Architecture

Which control most directly reduces the risk of malware entering an OT zone through USB drives used to move historian exports and program backups?

  1. A dedicated media transfer station with scanning, allowlisting, and controlled import procedures at the zone boundary. Correct answer.
  2. Requiring users to sign an acceptable use policy.
  3. Disabling USB ports on all corporate laptops.
  4. Increasing the antivirus signature update frequency on engineering workstations.

Explanation

Removable media is a classic crossing point between zones, so a controlled transfer station with scanning and procedural checks directly addresses the risk. Policy alone does not stop an infected drive, and endpoint antivirus on workstations does not cover the media path itself. The transfer station creates a monitored chokepoint at the boundary.

Question 39OT Security Fundamentals and Architecture

An HMI at Level 2 is compromised. Which architectural weakness would most enable the attacker to reach controllers at Level 1?

  1. The HMI has a screensaver timeout configured.
  2. The controllers use static IP addresses.
  3. The HMI and controllers share a flat Layer 2 segment with no internal filtering. Correct answer.
  4. The plant historian stores 90 days of trend data.

Explanation

A flat segment lets a compromised HMI reach controllers directly, since there is no enforcement point between them. Segmentation with internal filtering limits lateral movement even after an endpoint is lost. The other options are operational details that do not create reachability.

Question 40OT Security Fundamentals and Architecture

A vendor states a controller supports only a proprietary protocol over TCP port 5000 and provides no protocol specification. How should the architect treat this in the security design?

  1. Block port 5000 entirely and accept that the controller cannot be used.
  2. Assume the protocol is secure because it is proprietary and undocumented.
  3. Treat port 5000 as an unknown-protocol conduit, restrict it to the minimum required hosts, and monitor it for anomalous behavior. Correct answer.
  4. Open port 5000 to the enterprise so security tools can inspect it.

Explanation

An undocumented proprietary protocol cannot be deeply inspected, so the design should minimize exposure and compensate with monitoring. Restricting the conduit to required hosts limits who can send commands. Assuming security from obscurity or blocking a needed function outright are not balanced engineering choices.

Question 41OT Security Design and Deployment

In a FortiGate-based OT segmentation design, which FortiOS feature is used to enforce deterministic, stateful inspection between Purdue Level 2 control networks and Level 3 site operations without relying on address translation?

  1. Virtual wire pair transparent mode Correct answer.
  2. Policy-based IPsec with NAT traversal
  3. Explicit web proxy with SSL deep inspection
  4. Destination NAT with central SNAT

Explanation

A virtual wire pair lets a FortiGate sit inline as a bump-in-the-wire with two interfaces bound together, forwarding and inspecting traffic while preserving original IP addressing. This suits OT environments where controllers and engineering workstations must keep their addresses and where NAT would break proprietary protocols.

Question 42OT Security Design and Deployment

An OT security architect is designing a FortiNAC deployment to identify and authorize industrial devices on a plant floor. Which capability best supports automated onboarding of unknown OT assets without manual MAC entry?

  1. RADIUS accounting with interim updates
  2. Captive portal with sponsor approval
  3. 802.1X EAP-TLS with certificate pinning
  4. Device profiling using DHCP fingerprinting and SNMP discovery Correct answer.

Explanation

FortiNAC builds device profiles from multiple passive and active sources such as DHCP fingerprints and SNMP polling, which lets it classify unknown OT endpoints and apply policy automatically. Manual MAC registration does not scale to plant floors with many unmanaged devices.

Question 43OT Security Design and Deployment

When deploying a FortiGate in an OT DMZ between the plant control network and enterprise IT, which design principle best aligns with IEC 62443 zone and conduit guidance?

  1. Define conduits that permit only the specific protocols and sessions each zone pair requires Correct answer.
  2. Place the FortiGate only at the enterprise edge and rely on flat plant routing
  3. Use a single shared VLAN for all zones to simplify troubleshooting
  4. Allow all inter-zone traffic but log it for later review

Explanation

IEC 62443 requires zones to be separated by conduits that carry only the traffic each zone pair needs. Least-permission conduits with protocol-aware inspection reduce the attack surface between OT and IT.

Question 44OT Security Design and Deployment

A FortiGate is protecting a Modbus/TCP segment. Which FortiOS configuration most directly enables protocol-aware control of function codes on that traffic?

  1. SSL inspection profile set to certificate inspection
  2. Web filter profile with industrial categories
  3. IPS sensor with OT protocol signatures Correct answer.
  4. Application control profile with the Modbus category

Explanation

FortiOS IPS sensors include OT protocol signatures that can inspect and block specific Modbus function codes and malformed frames. Application control classifies the protocol but does not enforce function-code-level restrictions.

Question 45OT Security Design and Deployment

Which FortiGate interface mode should be selected when the device must forward OT traffic without changing IP addresses and without participating in routing?

  1. PPPoE client mode
  2. Interface-mode VDOM with dynamic routing
  3. Transparent mode Correct answer.
  4. NAT/route mode

Explanation

Transparent mode forwards frames at Layer 2 while applying security policies, so original addressing is preserved and no routing configuration is required. This is common when inserting inspection between two OT subnets that must keep their IPs.

Question 46OT Security Design and Deployment

An architect must ensure that FortiGate configuration changes affecting OT conduits are reviewed before they take effect. Which FortiOS capability best supports this requirement?

  1. Configuration revision with change control workflow Correct answer.
  2. Session table timeout tuning
  3. Per-policy traffic logging
  4. Automated backup to a TFTP server

Explanation

FortiOS configuration revision and change control allow administrators to stage, review, and approve configuration changes before committing them. This supports the change management controls required in OT environments.

Question 47OT Security Design and Deployment

When selecting a FortiGate model for a plant floor cabinet with high ambient temperature and limited maintenance windows, which requirement is most specific to OT deployment?

  1. Maximum SSL inspection throughput
  2. Number of virtual domains supported
  3. Support for SD-WAN health checks
  4. Extended temperature operating range and fanless or ruggedized design Correct answer.

Explanation

Plant floor cabinets often exceed standard data center temperature ranges and have limited maintenance access, so extended temperature ratings and ruggedized hardware are OT-specific selection criteria. Throughput and VDOM counts are general enterprise metrics.

Question 48OT Security Design and Deployment

A utility wants to monitor OT traffic passively without inline risk. Which FortiGate deployment achieves visibility while avoiding any possibility of blocking production traffic?

  1. One-arm sniffer interface with IPS in monitor mode Correct answer.
  2. Inline transparent mode with IPS blocking enabled
  3. Virtual wire pair with deny-all fallback
  4. Routed interface with central NAT

Explanation

A one-arm sniffer interface copies traffic to the FortiGate for inspection while the device is not inline, so it cannot block production flows. Running IPS in monitor mode provides visibility without enforcement risk.

Question 49OT Security Design and Deployment

Which FortiGate feature allows an OT architect to logically separate the plant control VDOM from the enterprise VDOM while sharing physical interfaces?

  1. Aggregate interfaces
  2. Multiple VDOMs with inter-VDOM links Correct answer.
  3. Virtual wire pairs
  4. Policy routes

Explanation

Multiple VDOMs provide separate routing and policy domains on one physical appliance, and inter-VDOM links carry controlled traffic between them. This supports zone separation on shared hardware.

Question 50OT Security Design and Deployment

An engineer needs FortiGate to inspect Modbus traffic between two OT subnets but must not require changes to the PLC gateway addresses. Which configuration combination satisfies this?

  1. IPsec tunnel with overlapping subnet translation
  2. Interface-mode VDOM with dynamic OSPF
  3. Transparent mode with policies referencing the original subnets Correct answer.
  4. Routed interfaces with SNAT and DNAT

Explanation

Transparent mode forwards traffic at Layer 2 and policies can reference the original subnets, so no address changes are needed on the PLC gateway. NAT or routed designs would require re-addressing.