FCP_FAZ_AD-7.4 Exam Questions
184 real FCP_FAZ_AD-7.4 exam questions with expert-verified answers and explanations. Page 3 of 4.
- Question #102
Which two statements are true regarding fabric connectors? (Choose two.)
- Question #103Device Registration and ADOMs
Which two statements about a FortiAnalyzer Fabric are true? (Choose two.)
FortiAnalyzer Fabricsupervisorcollector modeAPI access - Question #104Troubleshooting and Maintenance
Refer to the exhibit. What does the data point at 12:20 indicate?
log insert lagperformance monitoringsqlplugindlog indexing graph - Question #105Reports
What is the purpose of predefined report templates on FortiAnalyzer?
report templatespredefined templatesreport layoutreport customization - Question #106SOC Features (Playbooks, Incident Response)
What is the purpose of output variables?
output variablesplaybook taskstask chainingplaybook connectors - Question #107
Refer to the exhibit. What does the data point at 21:20 indicate?
- Question #108SOC Features (Playbooks, Incident Response)
Which two statements are correct regarding the export and import of playbooks? (Choose two.)
playbook exportplaybook importplaybook managementdisabled playbooks - Question #109Reports
Which SQL query is in the correct order to query the database in the FortiAnslyzer?
SQL querySELECT FROM WHEREdataset syntaxdatabase query - Question #110SOC Features (Playbooks, Incident Response)
Refer to the exhibits. How many events will be added to the incident created after running this playbook?
playbook executionincident managementevent correlationplaybook output - Question #111SOC Features (Playbooks, Incident Response)
You are looking for a playbook that was exported by a junior administrator. You perform a search and find the files listed below. Which file will perform an import operation?
playbook importJSON formatfile formatplaybook export - Question #112Event Management
Refer to the exhibit. Which statement is correct regarding the event displayed?
event statussecurity eventincident creationopen event - Question #113Device Registration and ADOMs
What is required to authorize a FortiGate on FortiAnalyzer using Fabric authorization?
Fabric authorizationFortiGate registrationdevice authorizationFortiAnalyzer credentials - Question #114SOC Features (Playbooks, Incident Response)
Refer to the exhibit. Which FortiAnalyzer tool can refer to the Cyber Kill Chain stages and allows you to identify which Fortinet products can protect you against new vulnerabiliti...
Cyber Kill Chainthreat huntingSIEM tablevulnerability protection - Question #115Event Management
Refer to the exhibit. Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web inte...
text filterlog filter syntaxweb interface loginevent filtering - Question #116System Settings and High Availability
If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?
HA clusterprimary electionpriorityfailover - Question #117Reports
What are two advantages of grouping similar reports? (Choose two.)
report groupinghcachereport performanceauto-hcache - Question #118SOC Features (Playbooks, Incident Response)
Which statement is true about sending notifications with incident updates?
incident notificationsfabric connectorsmulti-platform notificationsincident updates - Question #119FortiAnalyzer Initial Setup
Which statement correctly describes the management extensions available on FortiAnalyzer?
management extensionsCPU requirementslicensessystem resources - Question #120SOC Features (Playbooks, Incident Response)
A play book contains five tasks in total. An administrator executed the playbook and four out of five tasks finished successfully, but one task failed. What will be the status of t...
playbook executiontask failureplaybook statuserror handling - Question #121Reports
When working with FortiAnalyzer reports, what is the purpose of a dataset?
datasetsdatabase queryreport configurationSQL - Question #122System Settings and High Availability
Refer to the exhibit. The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster. What can you conclude from the configuratio...
HA clusterlog receptionport configurationfailover - Question #123SOC Features (Playbooks, Incident Response)
You crested a playbook on FortiAnalyzer that uses a FortiOS connector. When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation...
FortiOS connectorautomation stitchincoming webhookplaybook integration - Question #124Logging and Archiving
What must you consider when using log fetching? (Choose two.)
log fetchingarchive logsfetch clientFortiAnalyzer API - Question #125Event Management
Which two statements are true regarding the outbreak detection service? (Choose two.)
outbreak detectionFortiGuard licensingevent handlersauto-download - Question #126Reports
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)
auto-cachehard-cachereport generationperformance optimization - Question #127SOC Features (Playbooks, Incident Response)
Why must you wait for several minutes before you run a playbook that you just created?
playbook parsingplaybook deploymentexecution timing - Question #128Logging and Archiving
Which statement describes online logs on FortiAnalyzer?
online logslog typeslog statusreport data - Question #129SOC Features (Playbooks, Incident Response)
How can you attach a report to an incident?
incident managementreport attachmentincident properties - Question #130Reports
Which item must you configure on FortiAnalyzer to email generated reports automatically?
output profileemail deliveryreport automationreport scheduling - Question #131FortiAnalyzer Initial Setup
Which statement about the FortiSOAR management extension is correct?
FortiSOARmanagement extensionsdocker containerdeployment - Question #132Troubleshooting and Maintenance
Why run the command diagnose sql status sqlplugind?
SQL diagnosticslog insertion statusCLI commandstroubleshooting - Question #133
What are two benefits of using fabric connectors? (Choose two.)
- Question #134Event Management
Which log will generate an event with the status Contained?
event statusAV quarantinecontained statuslog action mapping - Question #135
Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web inte...
- Question #136
After generating a report, you notice the information you were expecting to see is not included in it. What are two possible reasons for this scenario? (Choose two.)
- Question #137Event Management
What is the purpose of using prefilters when configuring event handlers?
event handlersprefilterslog filteringfilter priority - Question #138Reports
Which statement describes a dataset in FortiAnalyzer?
datasetsdatabase queryreport dataSQL - Question #139SOC Features (Playbooks, Incident Response)
A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails. What will be the status of the playb...
playbook executiontask failureplaybook statuserror handling - Question #140SOC Features (Playbooks, Incident Response)
What is the purpose of trigger variables?
trigger variablesplaybook triggerstask filteringplaybook actions - Question #141SOC Features (Playbooks, Incident Response)
Which statement about sending notifications with incident updates is true?
incident notificationsconnectorsoutput profilesincident management - Question #142Reports
Refer to the exhibit. What is the purpose of using the Chart Builder feature on FortiAnalyzer?
Chart BuilderFortiViewdataset automationfiltered search - Question #143SOC Features (Playbooks, Incident Response)
What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?
IOC detectionblocklisted IPcompromised endpointsbreach detection - Question #144
Refer to the exhibit. The image shows the details of a playbook after it finished running. What is the status of the playbook?
- Question #145Device Registration and ADOMs
View the exhibit: What does the 1000MB maximum for disk utilization refer to?
disk quotaADOM storagedevice log settingsdisk utilization - Question #146Device Registration and ADOMs
You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?
ADOM migrationanalytics logsdatabase rebuilddevice management - Question #147Logging and Archiving
What happens when a log file saved on FortiAnalyzer disks reaches the size specified in the device log settings?
log rolloverlog archivinglog file sizedevice log settings - Question #148Event Management
Refer to the exhibit. Which statement is correct regarding the event displayed?
security event statusrisk classificationevent indicatorsblocked traffic - Question #149Logging and Archiving
Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?
log fetchingarchived logsinter-FortiAnalyzer retrievallog timeframe - Question #150Troubleshooting and Maintenance
What is the recommended method of expanding disk space on a FortiAnalyzer VM?
disk expansionVM storageLVM extendvirtual disk management - Question #151Logging and Archiving
How are logs forwarded when FortiAnalyzer is using aggregation mode?
aggregation modelog forwardingscheduled uploadcontent files