FCP_FAZ_AN-7.4 Exam Questions

You created a playbook on FortiAnalyzer that uses a FortiOS connector. When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation...

When managing incidents on FortiAnlyzer, what must an analyst be aware of?

An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email in...

Which statement regarding macros on FortiAnalyzer is true?

After generating a report, you notice the information you were expecting to see is not included in it. However, you confirm that the logs are there. Which two actions should you pe...

Refer to the exhibit. What can you conclude about these search results? (Choose two.)

Which two statements regarding FortiAnalyzer operating modes are true? (Choose two.)

As part of your analysis, you discover that an incident is a false positive. You change the incident status to Closed: False Positive. Which statement about your update is true?

Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web inte...

Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

Refer to Exhibit. What does the data point at 21:20 indicate?

A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails. What will be the status of the playb...

Refer to the exhibit. Client-1 is trying to access the internet for web browsing. All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer...

What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

What is the purpose of running the command diagnose sql status sqlplugind?

Refer to the exhibit. What can you conclude about the output?

As part of your analysis, you discover that a Medium severity level incident is fully remediated. You change the incident status to Closed: Remediated. Which statement about your u...

What is the purpose of playbook trigger variables?

Which statement correctly describes one difference between templates and reports?

Which statement about sending notifications with incident updates is true?

Refer to the exhibit. What is the purpose of using the Chart Builder feature on FortiAnalyzer?

Which two statements regarding the outbreak detection service are true? (Choose two.)

You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but, so far, you have been unsuccessful. Which two tasks should you perform to investi...

Which two statements about playbook execution are true? (Choose two.)

You discover that a few reports are taking a long time to generate. Which two steps can you take to troubleshoot? (Choose two.)

Which two statements about exporting and importing playbacks are true? (Choose two.)

You are tasked with finding logs corresponding to a suspected attack on your network. You need to use an interface where all identified threats within timeframe are listed and orga...

Which statement about automation connectors in FortiAnalyzer is true?

What is the purpose of using data selectors when configuring event handlers?

You need to move reports between two ADOMs. Which two statements are true? (Choose two.)

Which statement about exporting items in Report Definitions is true?

Which log will generate an event with the status Contained?

Refer to the exhibit. What does the data point at 12:20 indicate?

Which statement about the FortiSIEM management extension is correct?

You are trying to configure a task in the playbook editor to run a report. However, when you try to select the desired playbook, you do to see it listed. What is the reason?

What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

It is a best practice to upload FortiAnalyzer local logs to a remote server. Which three remote servers are supported for the upload? (Choose three.)

Which two FortiAnalyzer features allow you to automatically build a dataset and chart based on a filtered search result? (Choose two.)

What is included in the disk quota for each ADOM on the FortiAnalyzer?

Which log will generate an event with the status Unhandled?

Refer to the exhibit. Which statement about the displayed event is correct?

Which statement describes archive logs on FortiAnalyzer?

Which statement about sending notifications with incident update is true?

Which statement about the FortiSOAR management extension is correct?

Refer to the exhibit. Based on the partial outputs displayed, which devices can be members of a FotiAnalyzer Fabric?

Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer? (Choose two.)

Which SQL query is in the correct order to query the database in the FortiAnalyzer?

What are event handlers?

Which two external servers can you configure to validate administrator logins? (Choose two.)

Which database language does FortiAnalyzer support for the purposes of logging and reporting?