You want to gain complete visibility of the entire attack surface using FortiAnalyzer. Which two views must you use to achieve this result? (Choose two.)
Correct Answer: C,E
The correct answers are C and E . Fortinet states that the SOC Dashboard provides an effective visualization of reported incidents and events and, through Security Fabric integration, enables administrators to gain complete visibility of the entire attack surface . The MITRE ATT CK Attack view complements this by presenting incident and event information according to ATT & CK-defined attack tactics and techniques, allowing analysts to understand where observed activity maps into known adversary behavior. The MITRE Coverage view has a different purpose-it measures event-handler coverage-while the Attack view focuses on actual incidents and events. Risk Summary and Resources Reports are associated primarily with FortiSIEM reporting functions, and Analytics Search is a query and investigation mechanism rather than a consolidated attack-surface view. Therefore, the required FortiAnalyzer views are MITRE ATT & CK Attack and SOC Dashboard .
Question 2
In your OT environment, you want to detect the devices passively. Which two methods must you implement? (Choose two answers)
Correct Answer: C,D
The correct answers are C. Vendor OUI and D. Network traffic . The study guide explicitly separates active/direct profiling methods from passive/non-direct methods and states that "In OT environments, passive methods are preferred over active methods." It then lists the methods that do not require FortiNAC to interact directly with the device being profiled. Among those methods are "Network traffic: gathered from the infrastructure" and "Vendor OUI: determined by the MAC address gathered from the infrastructure." That directly matches options C and D . Options A and B are incorrect because SSH and SNMP are shown in the guide under the direct/active profiling methods. The guide's point is that passive detection avoids directly scanning or interacting with OT endpoints, since that can negatively affect performance in industrial environments. Because the question specifically asks for passive detection methods, the correct pair is Vendor OUI and Network traffic .
Question 3
Refer to the exhibit. A simplified OT network is shown. You want to optimize the protection of this OT network. Which two controls must you implement? (Choose two answers)
Correct Answer: B,C
The correct answers are B. IPS on FortiGate_Level5 and C. Virtual patching on FortiGate_Level2 . The study guide explains that "the first line of defense is securing the IT side of your network" and that FortiGate should be placed to protect ICS environments and stop threats from propagating from IT into OT. It also states that IPS improves OT security because "today's threat landscape requires IPS to block a wider range of threats and improve OT security" and that in IPS mode, vulnerable devices are protected . This makes FortiGate_Level5 , at the upper boundary near the DMZ and external connectivity, the correct place to implement IPS as a primary protection control. The study guide also states in the Purdue model section that "Level 2 consists of the processes and programs that control the PLCs, RTUs, and IEDs found at Level 1" and that "it is necessary to segment, or even microsegment, these servers with firewall segmentation, along with policies that include application control and virtual patching." In addition, the virtual patching section says "Virtual patching protects OT devices that have not yet been updated against vulnerability exploits" and applies when traffic related to the vulnerable device reaches the firewall policy. Since FortiGate_Level2 sits between the process network and the control network, it is the right enforcement point for virtual patching to protect the PLC-side assets. Option A is not one of the best answers because offline IDS only detects and logs attacks; the guide says "no traffic flows through FortiGate" in offline IDS mode, whereas IPS can actually block threats. Option D is also not the best answer because OT signatures are enabled within the IPS framework, but the stronger control explicitly described for this design is to deploy IPS at the upper boundary and virtual patching closer to vulnerable OT devices .
Question 4
Refer to the exhibit. A Virtual Patching profile is shown. You have recently updated your SCADA system and would like to apply the SCADA virtual patching profile. Which two statements about this profile are correct? (Choose two answers)
Correct Answer: B,D
The correct answers are B and D . Option B is correct because the profile has Medium , High , and Critical selected, while Low severity is not selected. That means low-severity virtual patching signatures are not enforced by this profile. So for the device with MAC address 12:12:12:12:12 , low-severity signatures are not blocked. The study guide explains virtual patching as device-specific protection where "FortiGate caches the signatures and mitigation rules that apply to each device" and applies them when the related traffic matches the firewall policy. Option D is correct because the Virtual Patching Exemptions table shows a row with the MAC address 11: 11:11:11:11 and no specific signature listed. The study guide states that in the Virtual Patching profile you can "Exempt a specific device with the MAC address or a specific signature." A MAC-only exemption means that specific device is excluded from virtual patching enforcement, so in practical terms it is treated as having no applicable vulnerabilities in this profile. Option C is incorrect because the profile does not block critical signatures for all devices. The exemptions list proves that at least one device can be excluded by MAC address, and a specific signature can also be exempted. Therefore, enforcement is not universal across all devices. Option A is incorrect because the entry Schneider.Electric.ClearSCADA.HTTP.Interface.XSS appears as a specific signature exemption , not as the only remaining vulnerability. The profile display is showing exemptions, not a statement that only one vulnerability is still present.
Question 5
Refer to the exhibit. Which statement about this partial Asset Identity List page is correct? (Choose one answer)
Correct Answer: B
Based on the OT Security 7.6 Architect study guide regarding the Asset Identity Center and Asset Management : * Vulnerability Visibility : The Asset Identity List tab displays key metadata for IT and OT devices, including detected addresses, users, and a specific column for Vulnerabilities . * Virtual Patching Feature : In the OT Security 7.6 architecture, the " Vulnerabilities " column is populated through the OT Security Service license, which includes " OT vulnerability correlation definitions & virtual patching signatures " . * Correlation Mechanism : FortiGate extracts metadata from OT traffic and uses these signatures to identify known vulnerabilities on the assets. For these vulnerabilities to be identified and correlated in the Asset Identity Center as shown in the exhibit (displaying a count of 8 vulnerabilities), the Virtual Patching feature must be active. * Architectural Implementation : Virtual patching is a critical component of the " Protection " layer in OT networks, allowing administrators to secure legacy or unpatchable PLCs and RTUs by blocking exploit attempts at the network level using IPS-based virtual patching signatures. * Exhibit Analysis : The presence of identified vulnerabilities (the number " 8 " in the red shield) in the Asset Identity List confirms that the FortiGate is actively performing vulnerability correlation, which is the operational result of having a Virtual Patching security profile applied to the relevant firewall policy.
