Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
You want FortiAnalyzer to trigger an automation stitch on a FortiGate device automatically. What must you configure on FortiAnalyzer to enable direct communication with FortiGate? (Choose one answer)
The verified answer is C. The Fabric settings. The study guide ties FortiAnalyzer-triggered actions to the Security Fabric relationship with FortiGate, not to playbook tasks or standalone event handlers alone. It explains that ''within the Security Fabric environment, FortiAnalyzer is a key element in the creation of automation stitches'' and shows the flow where a downstream FortiGate sends logs to FortiAnalyzer, then FortiAnalyzer parses the logs and notifies the root FortiGate, after which the root FortiGate triggers the action. This shows that FortiAnalyzer must be configured so it can communicate with FortiGate through the Security Fabric.
The guide also states that FortiAnalyzer is the foundation of the Security Fabric, providing logging, reporting, analytics, and automation for Fabric devices and endpoints. It further explains that the FortiAnalyzer Fabric connector consolidates the traffic logs within the Security Fabric. This confirms that the automation workflow depends on proper Security Fabric integration. A playbook task is used for automated SOC actions, and an event handler is used to generate events from logs, but neither one alone establishes the direct communication path needed between FortiAnalyzer and FortiGate. Therefore, the required configuration on FortiAnalyzer is the Fabric settings.
Refer to the exhibit.
The Core Network Security Connectors page of a FortiGate device is shown. You are configuring the Security Fabric in your OT network. One of the devices is not sending logs to FortiAnalyzer. When you check the status of the FortiGate device, it is Disabled as shown in the exhibit. Which two actions must you perform to enable this FortiGate device to send logs to FortiAnalyzer? (Choose two answers)
Comprehensive and Detailed Explanation From Exact Extract of OT Security 7.6 Study guides:
The correct answers are A and C.
A is correct because the exhibit explicitly shows Logging & Analytics FortiAnalyzer: Disabled on this FortiGate. The FortiGate must therefore have its FortiAnalyzer logging destination enabled and configured. The study guide explains that the FortiAnalyzer Fabric connector consolidates traffic logs and, importantly, that ''each FortiGate in the Security Fabric logs traffic to FortiAnalyzer independent of the root or other leaf devices.'' This means each FortiGate requires its own functioning logging connection to FortiAnalyzer; being a Security Fabric member alone does not cause its logs to pass through the root FortiGate.
C is correct because FortiAnalyzer must accept and authorize the FortiGate as a managed/logging device before the FortiGate can establish the normal logging relationship. This complements the FortiGate-side Logging & Analytics configuration. The study guide's Security Fabric logging architecture shows individual FortiGate devices maintaining FortiAnalyzer log connections, with FortiAnalyzer receiving and correlating their traffic and UTM logs. It specifically states that if the root FortiGate is unavailable, logging from leaf FortiGate devices to FortiAnalyzer continues to function, confirming that the FortiGate-to-FortiAnalyzer logging relationship is direct.
B is incorrect because configuring Fabric settings on FortiAnalyzer is not the missing step indicated by the exhibit. The problem shown is that FortiAnalyzer logging is Disabled on the FortiGate.
D is incorrect because authorization on the root FortiGate concerns joining and trusting a FortiGate as a Security Fabric member. It does not authorize that FortiGate as a logging device on FortiAnalyzer. The study guide explicitly distinguishes the architecture by stating that every FortiGate logs to FortiAnalyzer independently of the root.
Refer to the exhibit.
A Virtual Patching profile is shown. You have recently updated your SCADA system and would like to apply the SCADA virtual patching profile. Which two statements about this profile are correct? (Choose two answers)
The correct answers are B and D.
Option B is correct because the profile has Medium, High, and Critical selected, while Low severity is not selected. That means low-severity virtual patching signatures are not enforced by this profile. So for the device with MAC address 12:12:12:12:12, low-severity signatures are not blocked. The study guide explains virtual patching as device-specific protection where ''FortiGate caches the signatures and mitigation rules that apply to each device'' and applies them when the related traffic matches the firewall policy.
Option D is correct because the Virtual Patching Exemptions table shows a row with the MAC address 11:11:11:11:11 and no specific signature listed. The study guide states that in the Virtual Patching profile you can ''Exempt a specific device with the MAC address or a specific signature.'' A MAC-only exemption means that specific device is excluded from virtual patching enforcement, so in practical terms it is treated as having no applicable vulnerabilities in this profile.
Option C is incorrect because the profile does not block critical signatures for all devices. The exemptions list proves that at least one device can be excluded by MAC address, and a specific signature can also be exempted. Therefore, enforcement is not universal across all devices.
Option A is incorrect because the entry Schneider.Electric.ClearSCADA.HTTP.Interface.XSS appears as a specific signature exemption, not as the only remaining vulnerability. The profile display is showing exemptions, not a statement that only one vulnerability is still present.
Refer to the exhibit.
Which statement about this partial Asset Identity List page is correct? (Choose one answer)
The correct answer is B. A firewall policy has a Virtual Patching security profile applied to it.
The decisive clue in the exhibit is the Vulnerabilities column showing KEVs and device-specific vulnerability counts. The study guide explains the virtual patching workflow in this exact way: ''FortiGate performs a lookup for device-specific vulnerabilities and mitigation rules in FortiGuard,'' then ''FortiGuard returns specific OT virtual patching signatures,'' and ''FortiGate caches the signatures and mitigation rules that apply to each device.'' That is the same behavior reflected by the Asset Identity List showing vulnerability information per detected device.
The guide then states that ''When traffic related to the vulnerable device reaches FortiGate, the firewall policy with the virtual patching profile applies.'' It also says ''A virtual patching profile can be applied to firewall policies in any direction, protecting traffic from or to the vulnerable OT device.'' This directly links the per-device vulnerability visibility to a Virtual Patching profile enforced through firewall policy.
Refer to the exhibit.
The Core Network Security Connectors page of the FortiGate-2 device is shown. Which statement is correct? (Choose one answer)
Based on the provided exhibit and the OT Security 7.6 Architect curriculum regarding the Fortinet Security Fabric:
Fabric Role: The exhibit clearly shows that FortiGate-2 has the role set to Join Fabric. This confirms it is a downstream device and not the Fabric Root (eliminating Option A).
Upstream Connection: The device is configured to point to an Upstream FortiGate at IP address 10.1.2.254.
Fabric Status: The status is currently displayed as Not Connected. In a standard Fortinet Security Fabric deployment, once a downstream device is configured to join the fabric, it sends a request to the upstream root device. The root FortiGate must then explicitly authorize the downstream unit before the connection is established and the status changes to 'Connected.'
Authorization Requirement: The 'Not Connected' status, while having the upstream IP correctly configured, is the classic indicator that the authorization step is pending on the root FortiGate. Furthermore, under the LAN Edge Devices section, it shows another downstream FortiGate requiring authorization on this specific unit, highlighting that authorization is a manual security requirement for all stages of the Fabric hierarchy.
FortiAnalyzer Status: While the Logging & Analytics section shows FortiAnalyzer is Disabled, this is a configuration choice and does not prevent the Security Fabric from connecting; therefore, configuring it is not the solution to the connectivity status shown (eliminating Option C).
In summary, FortiGate-2 cannot join the fabric until an administrator logs into the Root FortiGate (10.1.2.254) and authorizes the join request from FortiGate-2.
Refer to the exhibit.
Which statement about this partial Asset Identity List page is correct? (Choose one answer)
Based on the OT Security 7.6 Architect study guide regarding the Asset Identity Center and Asset Management:
Vulnerability Visibility: The Asset Identity List tab displays key metadata for IT and OT devices, including detected addresses, users, and a specific column for Vulnerabilities.
Virtual Patching Feature: In the OT Security 7.6 architecture, the 'Vulnerabilities' column is populated through the OT Security Service license, which includes 'OT vulnerability correlation definitions & virtual patching signatures'.
Correlation Mechanism: FortiGate extracts metadata from OT traffic and uses these signatures to identify known vulnerabilities on the assets. For these vulnerabilities to be identified and correlated in the Asset Identity Center as shown in the exhibit (displaying a count of 8 vulnerabilities), the Virtual Patching feature must be active.
Architectural Implementation: Virtual patching is a critical component of the 'Protection' layer in OT networks, allowing administrators to secure legacy or unpatchable PLCs and RTUs by blocking exploit attempts at the network level using IPS-based virtual patching signatures.
Exhibit Analysis: The presence of identified vulnerabilities (the number '8' in the red shield) in the Asset Identity List confirms that the FortiGate is actively performing vulnerability correlation, which is the operational result of having a Virtual Patching security profile applied to the relevant firewall policy.
Exam domains verified against: Official Fortinet NSEI_OTS_AR-7.6 exam guide, last checked September 2026.
Explain OT standards and Fortinet compliance such as IEC 62443 zones and conduits. Deploy the Fortinet Security Fabric in an OT network and implement device detection on FortiGate and FortiNAC to build a complete, non-intrusive asset visibility baseline.
Explain OT Ethernet concepts and OSI layers specific to operational technology environments. Configure network segmentation schemas based on the Purdue Model and implement network access authentication to control which devices can join the OT network.
Configure security inspections for industrial protocols such as Modbus, Profibus and OPC UA using protocol-aware firewalling. Configure virtual patching to mitigate known vulnerabilities and set up automation rules to respond to security events in real time.
Create FortiAnalyzer event handlers to trigger automated responses to security incidents. Perform risk assessment and management by analyzing asset vulnerabilities and network exposure, then analyze security reports from FortiAnalyzer to track compliance and identify trends.
Sample question from this domain above: Q1
Common questions about the exam itself
