I85PREP
⌘ K
Fortinet OT Security Architect study materials
Fortinet OT Security Architect study resources

Fortinet OT Security Architect: OT Security Operations and Monitoring

Fortinet OT Security Architect · Work through your exam, one topic at a time.

All guide sections

OT Security Operations and Monitoring

This domain tests what you do after deployment: which Fortinet component owns which telemetry, what an OT-relevant alert looks like, and how a suspected OT incident is triaged without disrupting production. Questions tend to be scenario-driven, asking for the next investigative step or the correct platform for a given data type.

Telemetry ownership

  • FortiGate generates the raw OT events: protocol discovery, asset fingerprint changes, vulnerability matches, policy denies, IPS hits.
  • FortiAnalyzer stores and reports on those logs; it is the system of record for FortiGate and FortiSwitch/FortiAP logs.
  • FortiSIEM correlates across sources and maintains a CMDB of assets; it is where cross-domain analytics belong.
  • FortiSOAR runs the response playbooks, calling enforcement points by API.
  • FortiDeceptor provides OT decoys that generate high-fidelity lure alerts, useful where production cannot be instrumented.
  • FortiNAC adds passive asset profiling and inventory for devices that never generate logs of their own.

Alert categories worth building around

New asset seen in a zone; new protocol or new function code on an existing asset; unauthorized remote access path; policy denies across a conduit; vulnerability match on an unpatchable PLC; firmware or program-change indicators on controllers. Each category needs an owner, a severity and a documented first action, otherwise the SOC drowns.

Worked example

FortiAnalyzer reports a new Modbus master writing to a Level 1 PLC at 03:00, from an address last seen on the enterprise network. Reasoning: first confirm whether the flow is permitted by an existing policy or is arriving through a deny rule (deny means nothing reached the PLC). Next, pull the asset fingerprint and the function codes used to judge whether this is a write to controller memory. Then check the conduit path and remote-access logs to determine entry, quarantine the source at the switch via FortiNAC if confirmed, and only then notify the plant, because an unannounced write to a controller may itself trigger a production stop.

Traps that cost marks

Enabling every signature and flooding the SOC, which guarantees alerts get ignored; monitoring only northbound traffic while east-west writes drive most OT incidents; assuming denied traffic reached the PLC; treating FortiAnalyzer as a full SIEM; and never tuning detection after the baseline period.