NSEI_OTS_AR-7.6 Fortinet NSE I - OT Security 7.6 Architect Free Practice Exam Questions (2026 Updated)

The correct answer is B. A firewall policy has a Virtual Patching security profile applied to it .

The decisive clue in the exhibit is the Vulnerabilities column showing KEVs and device-specific vulnerability counts. The study guide explains the virtual patching workflow in this exact way: “FortiGate performs a lookup for device-specific vulnerabilities and mitigation rules in FortiGuard,” then “FortiGuard returns specific OT virtual patching signatures,” and “FortiGate caches the signatures and mitigation rules that apply to each device.” That is the same behavior reflected by the Asset Identity List showing vulnerability information per detected device.

The guide then states that “When traffic related to the vulnerable device reaches FortiGate, the firewall policy with the virtual patching profile applies.” It also says “A virtual patching profile can be applied to firewall policies in any direction, protecting traffic from or to the vulnerable OT device.” This directly links the per-device vulnerability visibility to a Virtual Patching profile enforced through firewall policy.

The other options do not match the exhibit. Antivirus is not described in the study guide as building a device-by-device vulnerability list, Application Control is used for OT protocol and message visibility, and IPS focuses on exploit detection and prevention. The Vulnerabilities/KEVs display is the indicator that FortiGate is using Virtual Patching logic for those OT devices.

The correct answer is A . The study guide states that “The OT view is not available by default. You must enable it in the Feature Visibility section of the GUI or using the CLI command shown on this slide” and shows config system settings → set gui-ot enable . It also says that “After you enable the feature, the Asset Identity Center contains an Asset Identity List tab and an OT View tab.” This directly explains why the OT View tab is missing: the feature that enables the Purdue-style OT display has not been enabled yet.

The OT View is the view that displays devices in a Purdue diagram , and the Asset Identity List also shows the current Purdue level for each device. Because the answer options do not explicitly say enable OT View in Feature Visibility , option A is the intended match, since it refers to enabling the Purdue-related OT display feature. Option B is incorrect because device detection affects visibility of devices, not whether the OT View tab exists. Option C is not supported by the study guide, and option D is also not given as the requirement for showing the OT View tab.

The correct answers are C and D .

Option D is correct because the Playbook Monitor clearly shows the starter as On_Demand and the trigger as user(admin) . The study guide states that “ON_DEMAND: The playbook runs when an administrator manually starts it” and also notes that to run it manually, you select the playbook and click Run . This exactly matches the exhibit, so the playbook was manually triggered.

Option C is also correct. The study guide explains that “tasks run one after another” and that “if needed, the output of one task can be used by the tasks that follow it.” It also gives an example where workflow logic matters, such as creating an incident and then attaching details to it. In the exhibit, the sequence shown is Attach_report , then Run_report , then Create_Incident , while the incident analysis shows no report attached . Since the report must exist and the incident must already be available before it can be attached properly, the task order is wrong and must be reordered.

Option B is incorrect because the monitor shows multiple tasks completed successfully, not only Create_Incident . Option A is not the best answer because the main problem demonstrated by the exhibits is not simply waiting time, but the incorrect workflow order. The playbook completed successfully, yet the report is still not attached, which indicates a design issue in the task sequence rather than just a delay.

The correct answer is B . A historically flat OT network permits excessive east-west communication, allowing a compromised host to move laterally toward other controllers, HMIs, and critical systems. Fortinet recommends microsegmentation to control these communication paths. The study guide explains that microsegmentation controls intra-VLAN traffic through firewall policies , prevents hosts in the same segment from directly seeing or communicating with each other, and forces permitted communication through an enforcement point such as FortiGate. This provides granular host isolation and increased traffic visibility for monitoring and threat hunting. A normal hardware switch does not inherently impose the required security policies and therefore does not adequately restrict lateral movement. SD-WAN addresses WAN path selection and resilience, while two-factor authentication strengthens user authentication but does not control device-to-device traffic inside a flat process or control network. Therefore, firewall-based microsegmentation is the required architectural control.

================

According to the OT Security 7.6 Architect study guide regarding FortiAnalyzer Event Management :

Notification Options : When configuring a new event handler, FortiAnalyzer provides several built-in notification methods to alert administrators when specific log criteria are met. The most common and direct method is Send alert email (Option A).

Incident Management : To streamline the SOC workflow, an event handler can be configured to Automatically create an incident (Option D) based on the triggered event. This moves the event into the Incident Manager for further analysis.

Security Fabric Integration : In the 7.6 architecture, event handlers can directly trigger an Automation stitch (Option E). This allows the FortiAnalyzer to notify the root FortiGate to take action (like running a CLI script or changing a policy) across the Security Fabric.

Exclusions : Create a report (Option B) is typically a task performed by a Playbook or a scheduled report job, not a direct setting inside the basic event handler configuration. Quarantine an attacker (Option C) is an action that results from an automation stitch or playbook, but it is not a direct configuration toggle within the event handler itself.

Comprehensive and Detailed Explanation From Exact Extract of OT Security 7.6 Study guides:

The correct answers are A and C .

A is correct because the exhibit explicitly shows Logging & Analytics → FortiAnalyzer: Disabled on this FortiGate. The FortiGate must therefore have its FortiAnalyzer logging destination enabled and configured. The study guide explains that the FortiAnalyzer Fabric connector consolidates traffic logs and, importantly, that “each FortiGate in the Security Fabric logs traffic to FortiAnalyzer independent of the root or other leaf devices.” This means each FortiGate requires its own functioning logging connection to FortiAnalyzer; being a Security Fabric member alone does not cause its logs to pass through the root FortiGate.

C is correct because FortiAnalyzer must accept and authorize the FortiGate as a managed/logging device before the FortiGate can establish the normal logging relationship. This complements the FortiGate-side Logging & Analytics configuration. The study guide ' s Security Fabric logging architecture shows individual FortiGate devices maintaining FortiAnalyzer log connections , with FortiAnalyzer receiving and correlating their traffic and UTM logs. It specifically states that if the root FortiGate is unavailable, logging from leaf FortiGate devices to FortiAnalyzer continues to function , confirming that the FortiGate-to-FortiAnalyzer logging relationship is direct.

B is incorrect because configuring Fabric settings on FortiAnalyzer is not the missing step indicated by the exhibit. The problem shown is that FortiAnalyzer logging is Disabled on the FortiGate .

D is incorrect because authorization on the root FortiGate concerns joining and trusting a FortiGate as a Security Fabric member. It does not authorize that FortiGate as a logging device on FortiAnalyzer. The study guide explicitly distinguishes the architecture by stating that every FortiGate logs to FortiAnalyzer independently of the root .

Industrial Protocol

Correct Characteristic

POWERLINK

Mainly used for the transmission of process data

EtherCAT

Offers real-time data transmission in a primary-secondary configuration

Modbus

Uses client/server communication

Ethernet/IP

Based entirely on Ethernet standards

The correct mappings follow the industrial Ethernet characteristics defined in the OT Security 7.6 curriculum. Ethernet/IP is the industrial protocol based entirely on Ethernet standards and adapts to the standard Ethernet/TCP-IP architecture. EtherCAT is designed for deterministic real-time communication and specifically operates in a primary-secondary configuration while bypassing OSI layers 3 through 6. POWERLINK is an open real-time industrial Ethernet protocol that uses OSI layers 2 and 7 and is mainly intended for transmitting process data. Modbus , by contrast, uses a client/server communication model in which the server responds only after receiving a request from a client; it is not considered a real-time transmission protocol. These distinctions uniquely determine all four drag-and-drop placements.

The correct answer is A . The study guide describes all three protocols as supporting deterministic or real-time industrial communication. Ethernet/IP uses standard Ethernet and TCP/IP with an application-layer mechanism that can provide real-time communication when deployed within an appropriate limited range. EtherCAT explicitly provides real-time communication in a primary-secondary architecture and achieves its performance by skipping OSI layers 3 through 6. POWERLINK is also explicitly defined as a real-time communication protocol used mainly for transmitting process data. They do not all follow the complete OSI model because EtherCAT bypasses several layers and POWERLINK primarily uses layers 2 and 7. Client-server behavior is specifically associated with Modbus , and star/ring topology characteristics relate to redundancy mechanisms such as PRP, MRP, and HSR rather than these three industrial protocols collectively.

================

Based on the provided exhibits from the FortiAnalyzer playbook engine:

Playbook Trigger Condition : The Partial Playbook configuration exhibit shows that the playbook is set to trigger based on a condition where the Basic Handler Name is Equal To IPS_Attack_Handling.

Event vs. Log : In FortiAnalyzer, the field Basic Handler Name is a property of an Event record, indicating the specific Event Handler that generated it. A playbook configured with this condition is triggered by an Event , not directly by a raw log.

Playbook Execution Flow : The Partial Playbook Monitor view shows the execution sequence:

Event_Trigger (Starter) : This is the entry point of the playbook, which matches the condition defined in the configuration.

IPS_Attack_Incident : The first task executed after the trigger.

Run_Report : The task in question, which is executed as part of the automated workflow initiated by the starter.

Conclusion : Since the playbook ' s " Starter " is defined by the IPS_Attack_Handling handler name, an event produced by that handler is the root trigger for the entire playbook execution, including the Run_Report task.

Therefore, the Run_Report task was triggered (as part of the playbook) by an IPS_Attack_Handling event .

The correct answer is D . The exhibit shows the IPS event with the status Mitigated . Fortinet defines a Mitigated event as one where the security risk has been blocked or dropped ; an IPS log whose action is block or drop is the explicit example given in the OT Security 7.6 study guide. A Contained status instead indicates that the risk source has been isolated, such as an antivirus quarantine action. An Unhandled status indicates that the risk remains open—for example, an IPS event where the action is pass. The Web.Client application-control entry in the exhibit has a blank status, so it cannot correctly be described as either Unhandled or Contained based solely on the displayed information. Therefore, the definitive conclusion from the Event Monitor is that the corresponding IPS action was block or drop .

================

The correct answers are A and D .

Option A is correct because the study guide states that for OT protocol coverage, “a valid OT security service license is required to receive updates on both intrusion prevention and application control signatures.” It also shows “Valid license required” in the FortiGuard subscriptions section for OT protocol coverage. This confirms that a valid OT security service license is required to use and maintain the OT signatures database correctly.

Option D is also correct because the guide explicitly shows the CLI configuration used “To enable OT signatures” :

config ips global

set exclude-signatures none

end

It then states that “By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI.” This directly confirms that you must set exclude-signatures to none in the CLI to enable OT signatures.

Option B is incorrect because the study guide does not say you manually import the OT signatures database. Instead, it explains that FortiGuard maintains updated OT signatures and that a valid license is required to receive updates. Option C is incorrect because the guide clearly says OT signatures are excluded by default until enabled from the CLI.

The correct answers are B and C . The study guide states that “You can use application control signatures to detect OT protocols” and that “Application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages” . It also shows that a Modbus application control profile can be enabled on a firewall policy “for OT protocol visibility in the monitor status.” This directly supports B , because application control is the feature used to identify and monitor OT protocols on FortiGate.

The guide also explains under IPS that “By default, OT signatures are excluded from the signatures lists on the GUI until you enable them on the CLI” using config ips global and set exclude-signatures none . Once enabled, FortiGate can use those OT signatures for OT-aware inspection and protection. That supports C as the second required configuration. A is related to device discovery, not protocol identification, and D is focused on exploit and vulnerability detection rather than the first-step goal of identifying OT protocols.

The correct answers are B. The Datasets library and D. The Chart library .

The study guide explains that a FortiAnalyzer report is built from charts, and that charts consist of two elements: datasets and format . It states: “A FortiAnalyzer report is a set of data organized in charts” and “Charts consist of two elements: Datasets … and Format.” It then goes further in the Customizing Reports section and explicitly says “By default, the Chart Library contains more than 300 charts” and “By default, the Datasets library contains almost 400 datasets.” It also states that you can clone and edit both charts and datasets, and create new ones , which is exactly how you enhance and customize an existing report.

The other options are not the best answers for this question. FortiView can export a chart into a report chart, and Log View can help build a custom dataset and chart from search results, but the question asks which options you can use to enhance the report itself. The study guide identifies the actual report-customization components as the Chart Library and Datasets library . Dashboard library is not presented as a FortiAnalyzer report customization library in this section.

The correct answer is C. Application sensor set to monitor on all the FortiGate devices .

The study guide clearly explains that application control is the feature used to identify OT protocols. It states that “application control detects the protocols used in applications like Modbus, IEC 104, and the contents of the telecontrol messages” and also says “You can use application control signatures to detect OT protocols.” It further shows an example where a Modbus application control profile is enabled on a firewall policy “for OT protocol visibility in the monitor status.” This directly matches the requirement in the question, which is to detect OT protocols and increase traffic visibility .

The other options do not fit the requirement as precisely. Device detection is for identifying devices and collecting endpoint information, not for detecting industrial protocols. Inline IDS and IPS are focused more on detecting or blocking attacks, exploits, protocol abnormalities, and known vulnerabilities. While IPS can inspect some OT traffic, the study guide distinguishes it from application control by stating that IPS signatures tend to detect exploits, whereas application control signatures tend to provide protocol detection at various levels . Therefore, the required security sensor for OT protocol detection and traffic visibility is the application sensor in monitor mode .

The correct answers are A and B .

Option B is correct because the study guide states that “When a handler generates an event with the automation stitch option enabled, FortiAnalyzer sends a notification” to FortiGate. If Automation Stitch is not enabled in the FortiAnalyzer event handler, that handler will not be usable for the FortiGate automation-stitch workflow. The guide also explains that the configuration of each event handler can include “Automation stitches” and “Rules,” showing that this is a required part of the FortiAnalyzer-to-FortiGate automation path.

Option A is also correct. The study guide explains the automation flow in the Security Fabric: “FortiAnalyzer parses the logs and notifies the root FortiGate” and then “The root FortiGate triggers the action.” That means FortiGate must have the FortiAnalyzer connection configured through the Security Fabric side before it can consume FortiAnalyzer event handlers. The warning in the exhibit about configuring a FortiAnalyzer connection also points directly to that requirement.

Option C is incorrect because + Create is not the reason the existing event handler is missing; it is only an interface control. Option D is not the best answer for this item because the question is about why the event handler name list on FortiGate is empty for FortiAnalyzer-triggered automation. The study guide’s verified requirements for that workflow are the FortiAnalyzer-to-FortiGate Fabric connection and enabling Automation Stitch on the FortiAnalyzer event handler.