NSEI_OTS_AR-7.6 Sample Questions Answers

The verified answer is C. The Fabric settings . The study guide ties FortiAnalyzer-triggered actions to the Security Fabric relationship with FortiGate, not to playbook tasks or standalone event handlers alone. It explains that “within the Security Fabric environment, FortiAnalyzer is a key element in the creation of automation stitches” and shows the flow where a downstream FortiGate sends logs to FortiAnalyzer, then FortiAnalyzer parses the logs and notifies the root FortiGate , after which the root FortiGate triggers the action . This shows that FortiAnalyzer must be configured so it can communicate with FortiGate through the Security Fabric.

The guide also states that FortiAnalyzer is the foundation of the Security Fabric , providing logging, reporting, analytics, and automation for Fabric devices and endpoints. It further explains that the FortiAnalyzer Fabric connector consolidates the traffic logs within the Security Fabric. This confirms that the automation workflow depends on proper Security Fabric integration. A playbook task is used for automated SOC actions, and an event handler is used to generate events from logs, but neither one alone establishes the direct communication path needed between FortiAnalyzer and FortiGate. Therefore, the required configuration on FortiAnalyzer is the Fabric settings .

The correct answers are A and C .

Option C is correct because the profile clearly contains the Operational Technology category and specific OT application signatures such as Modbus and IEC.60870.5.104 . The study guide says “You can use application control signatures to detect OT protocols” and “You can filter to a specific OT protocol.” That means OT application signatures are active in this sensor profile.

Option A is correct because the guide explains that application control works at different levels: “Detection of protocol (one detection per session)” and “Message level (one detection per protocol message).” It also says you can use application signatures for “granular message type identification.” In the exhibit, IEC.60870.5.104.Control.Functions is explicitly configured, which is a granular IEC message/control-level signature rather than only a protocol-level match. That means logging and control can occur at the IEC command level.

Option B is not correct because the profile shows Modbus configured at the parent protocol level as Monitor , while the guide states that the “parent signature takes precedence over the child signature.” Since protocol-level detection is one detection per session , that does not mean FortiGate will necessarily log each Modbus command individually.

Option D is incorrect because even though the broader Operational Technology category is set to block, the profile includes specific application and filter overrides for Modbus and IEC 104 behavior. So the resulting effect is not simply that all OT protocols are blocked .

The correct answers are C and E . Fortinet states that the SOC Dashboard provides an effective visualization of reported incidents and events and, through Security Fabric integration, enables administrators to gain complete visibility of the entire attack surface . The MITRE ATT & CK Attack view complements this by presenting incident and event information according to ATT & CK-defined attack tactics and techniques, allowing analysts to understand where observed activity maps into known adversary behavior. The MITRE Coverage view has a different purpose—it measures event-handler coverage—while the Attack view focuses on actual incidents and events. Risk Summary and Resources Reports are associated primarily with FortiSIEM reporting functions, and Analytics Search is a query and investigation mechanism rather than a consolidated attack-surface view. Therefore, the required FortiAnalyzer views are MITRE ATT & CK Attack and SOC Dashboard .

================

The correct answers are B and C . The exhibit ' s Top Threat section identifies the IPS threats as Blocked , directly confirming that the attacks were prevented rather than merely detected. The OT Traffic table also shows destination port 502 . Modbus/TCP conventionally operates on TCP port 502, and the OT Security 7.6 study guide identifies Modbus as an industrial protocol supported and inspected by Fortinet OT security controls. The report does not cover only one day; its displayed timeline spans multiple dates, from approximately October 30 through November 3. Option D is also inconsistent with the report because the visible OT destination addresses are associated with the 192.168.x.x networks rather than 10.1.5.1. FortiAnalyzer reports summarize logged information into charts and tables specifically to expose traffic patterns, threats, and OT activity such as this.

================

The correct answer is D. You can configure forward domain IDs for each network .

The study guide explains that in FortiGate transparent mode, all interfaces belong to the same broadcast domain, even interfaces with different VLAN IDs , and then states that you can “subdivide into multiple broadcast domains” by configuring set forward-domain < domain_ID > . It also states that “interfaces with the same domain ID belong to the same broadcast domain” and, with multiple forward domains, “traffic arriving on one interface is broadcast only to interfaces in the same forward domain ID.” That is the mechanism used to separate internal networks and confine traffic between network segments.

The other options do not fit this requirement. Universal ZTNA is for application access control, not segmentation between two OT networks. One traffic VDOM does not create segmentation by itself; multiple VDOMs would be needed for that type of isolation. An explicit software switch controls intraswitch traffic inside the same software-switch domain, not segmentation between separate networks like network 1 and network 2. Therefore, the correct way to implement the internal segmentation asked in the question is to assign different forward domain IDs to each network.

Based on the OT Security 7.6 Architect study guide regarding the Asset Identity Center and Asset Management :

Vulnerability Visibility : The Asset Identity List tab displays key metadata for IT and OT devices, including detected addresses, users, and a specific column for Vulnerabilities .

Virtual Patching Feature : In the OT Security 7.6 architecture, the " Vulnerabilities " column is populated through the OT Security Service license, which includes " OT vulnerability correlation definitions & virtual patching signatures " .

Correlation Mechanism : FortiGate extracts metadata from OT traffic and uses these signatures to identify known vulnerabilities on the assets. For these vulnerabilities to be identified and correlated in the Asset Identity Center as shown in the exhibit (displaying a count of 8 vulnerabilities), the Virtual Patching feature must be active.

Architectural Implementation : Virtual patching is a critical component of the " Protection " layer in OT networks, allowing administrators to secure legacy or unpatchable PLCs and RTUs by blocking exploit attempts at the network level using IPS-based virtual patching signatures.

Exhibit Analysis : The presence of identified vulnerabilities (the number " 8 " in the red shield) in the Asset Identity List confirms that the FortiGate is actively performing vulnerability correlation, which is the operational result of having a Virtual Patching security profile applied to the relevant firewall policy.

The correct answer is C . This scenario is the precise use case for virtual patching . The OT Security 7.6 study guide states that virtual patching protects OT devices that have not yet been updated against vulnerability exploits . FortiGate identifies the vulnerable asset, queries FortiGuard for device-specific vulnerabilities and mitigation rules, receives applicable OT virtual-patching signatures, and maps those rules to the device. When traffic associated with the vulnerable asset reaches FortiGate, the firewall policy containing the virtual-patching profile applies the protection. In the topology, FortiGate_Level2 is the enforcement point immediately protecting PLC-1 and the control-network assets. IPS at Level 5 provides broader perimeter protection, but it is not the device-specific compensating control requested here. Application Control primarily regulates industrial protocols and commands. Therefore, Virtual patching on FortiGate_Level2 is required.

================

Comprehensive and Detailed Explanation From Exact Extract of OT Security 7.6 Study guides:

The correct answers are A and C .

A is correct because the exhibit explicitly shows Logging & Analytics → FortiAnalyzer: Disabled on this FortiGate. The FortiGate must therefore have its FortiAnalyzer logging destination enabled and configured. The study guide explains that the FortiAnalyzer Fabric connector consolidates traffic logs and, importantly, that “each FortiGate in the Security Fabric logs traffic to FortiAnalyzer independent of the root or other leaf devices.” This means each FortiGate requires its own functioning logging connection to FortiAnalyzer; being a Security Fabric member alone does not cause its logs to pass through the root FortiGate.

C is correct because FortiAnalyzer must accept and authorize the FortiGate as a managed/logging device before the FortiGate can establish the normal logging relationship. This complements the FortiGate-side Logging & Analytics configuration. The study guide ' s Security Fabric logging architecture shows individual FortiGate devices maintaining FortiAnalyzer log connections , with FortiAnalyzer receiving and correlating their traffic and UTM logs. It specifically states that if the root FortiGate is unavailable, logging from leaf FortiGate devices to FortiAnalyzer continues to function , confirming that the FortiGate-to-FortiAnalyzer logging relationship is direct.

B is incorrect because configuring Fabric settings on FortiAnalyzer is not the missing step indicated by the exhibit. The problem shown is that FortiAnalyzer logging is Disabled on the FortiGate .

D is incorrect because authorization on the root FortiGate concerns joining and trusting a FortiGate as a Security Fabric member. It does not authorize that FortiGate as a logging device on FortiAnalyzer. The study guide explicitly distinguishes the architecture by stating that every FortiGate logs to FortiAnalyzer independently of the root .

The correct answer is A. FortiGate queries FortiGuard servers . The study guide explains the device detection process very clearly: “First, FortiGate attempts to detect the devices based on the information in the local device database (CIDB). If FortiGate cannot detect the devices locally, it queries the FortiGuard servers by sending data about the unknown devices to the FortiGuard servers. In response, the FortiGuard servers provide additional information about those devices.” This directly answers the question and shows that querying FortiGuard is the next step after local detection fails.

Option D is incorrect because the guide says FortiGate checks the local device database (CIDB) first, before this next step. Option B refers more to FortiNAC-style profiling logic, not FortiGate’s OT device detection flow. Option C is also incorrect because service connectors are not described here as the immediate follow-up step for unknown local device detection. The study guide specifically identifies FortiGuard servers as the next destination for device identification assistance.

The correct answers are B and C . The study guide states that “You can use application control signatures to detect OT protocols” and that “Application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages” . It also shows that a Modbus application control profile can be enabled on a firewall policy “for OT protocol visibility in the monitor status.” This directly supports B , because application control is the feature used to identify and monitor OT protocols on FortiGate.

The guide also explains under IPS that “By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI” using config ips global and set exclude-signatures none . Once enabled, FortiGate can use those OT signatures for OT-aware inspection and protection. That supports C as the second required configuration. A is related to device discovery, not protocol identification, and D is focused on exploit and vulnerability detection rather than the first-step goal of identifying OT protocols.

Based on the technical data provided in the exhibits and the OT Security 7.6 Architect curriculum:

Industrial Protocol Identification (Statement A) : The log details exhibit clearly shows that the Destination Port used in the attack is 502 . According to the study guide ' s section on Industrial Protocol Protection , the standard port used by the Modbus TCP protocol is 502 . Furthermore, the attack name identifies a " Triangle.Research.Nano-10.PLC, " which are industrial controllers commonly utilizing Modbus for communications.

Attack Mitigation (Statement B) : The log details specify that the Action taken by the FortiGate (Edge-FortiGate) was dropped . In cybersecurity and Fortinet fabric operations, dropping a packet associated with an IPS signature means the traffic was blocked from reaching its target, thereby mitigating the attack.

Target IP Address (Statement E) : The log detail explicitly lists the Destination IP as 192.168.2.3 . The Incident Analysis page also titles the incident with dstip:192.168.2.3. While the " Affected Endpoint " is shown as 10.1.5.20 , in an " outgoing " attack direction (as shown in the log), this likely refers to the internal source/attacker IP, whereas the target is the destination IP (192.168.2.3). Thus, Statement E is incorrect.

Protocol Conflict (Statement C) : The IEC 104 protocol typically utilizes port 2404 . Since the log specifies port 502, Statement C is incorrect.

Severity Distinction (Statement D) : While the Incident severity is marked as High , the question specifically asks about event severity. The " Events " table at the bottom of the Incident Analysis page shows a " User login/logout failed " event with a medium severity. Because there is a distinction in the management console between the severity of individual events and the aggregated incident, and Statement A and B are technically definitive based on port and action, A and B are the correct architectural choices.

The correct answers are A and D .

Option A is correct because the study guide states that for OT protocol coverage, “a valid OT security service license is required to receive updates on both intrusion prevention and application control signatures.” It also shows “Valid license required” in the FortiGuard subscriptions section for OT protocol coverage. This confirms that a valid OT security service license is required to use and maintain the OT signatures database correctly.

Option D is also correct because the guide explicitly shows the CLI configuration used “To enable OT signatures” :

config ips global

set exclude-signatures none

end

It then states that “By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI.” This directly confirms that you must set exclude-signatures to none in the CLI to enable OT signatures.

Option B is incorrect because the study guide does not say you manually import the OT signatures database. Instead, it explains that FortiGuard maintains updated OT signatures and that a valid license is required to receive updates. Option C is incorrect because the guide clearly says OT signatures are excluded by default until enabled from the CLI.

The correct answer is A. You must enable Virtual Patching in the Feature Visibility section .

The study guide states clearly that “By default, virtual patching profiles are hidden on the GUI, and you must enable them through System > Feature Visibility.” That exactly matches the situation in the exhibit, where Virtual Patching does not appear under Security Profiles . So the issue is not that the feature is unsupported, but that it is simply hidden in the GUI until it is enabled.

The other options do not answer the question being asked. A valid OT security service license is required for virtual patching signatures and protection workflow, and OT signatures are relevant to IPS-based OT protection, but those do not explain why the menu item itself is missing from the Security Profiles section . The guide specifically identifies Feature Visibility as the reason the Virtual Patching profile is not shown in the GUI. Therefore, the required action is to enable Virtual Patching in System > Feature Visibility .