FCP_FAZ_AN-7.4 Exam Questions

What should you always do after erasing the FortiAnalyzer configuration on flash?

Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)

Refer to the exhibit. What can you conclude from this output?

Refer to the exhibits. Assume these are all the events that exist on the FortiAnalyzer device. How many events will be added to the incident created after running this playbook?

Which statement about SQL SELECT queries is true?

Refer to the exhibit. What is the analyst trying to create?

Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?

Refer to the exhibit with partial output. Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observe the output as shown i...

You find that as part of your role as an analyst, you frequently search Log View using the same parameters. Instead of defining your search filters repeatedly, what can you do to s...

When you move a FortiGate device from one ADOM to a new ADOM, what is the purpose of rebuilding the new ADOM database?

What is the main purpose of deploying RAID with FortiAnalyzer?

When generating reports on FortiAnalyzer, macros can be used to include additional data. Which two statements about macros are true? (Choose two.)

Why must you wait for several minutes before you run a playbook that you just created?

Refer to the exhibit. What can you conclude about the output?

Refer to the exhibit. A fortiAnalyzer analyst is customizing a SQL query to use in a report. Which SQL query should the analyst run to get the expected results?

You want to design a playbook that runs a series of tasks in parallel. How can you accomplish this goal?

Refer to the exhibit. Which statement about the event displayed is correct?