FCP_FAZ_AN-7.6 Exam Questions
79 real FCP_FAZ_AN-7.6 exam questions with expert-verified answers and explanations. Page 1 of 2.
- Question #1Alerting and Incident Response
You created a playbook on FortiAnalyzer that uses a FortiOS connector. When you configure FortiGate, which type of trigger must you use so that the actions in an automation stitch...
FortiOS connectorautomation stitchincoming webhookplaybook trigger - Question #2Alerting and Incident Response
When managing incidents on FortiAnlyzer, what must an analyst be aware of?
incident managementreport attachmentanalyst workflowincident status - Question #3Reporting
An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email in...
output profileemail notificationreport deliverymail server - Question #4Reporting
Which statement regarding macros on FortiAnalyzer is true?
macrosADOMreport templatesFortiAnalyzer - Question #5Reporting
After generating a report, you notice the information you were expecting to see is not included in it. However, you confirm that the logs are there. Which two actions should you pe...
report troubleshootingdatasettime framelog visibility - Question #6Forensic Analysis
Refer to the exhibit. What can you conclude about these search results? (Choose two.)
log searchtext modeCSV exportFortiView - Question #7Logging and Monitoring
Which two statements regarding FortiAnalyzer operating modes are true? (Choose two.)
collector modeanalyzer modesyslog forwardingoperating modes - Question #8Alerting and Incident Response
As part of your analysis, you discover that an incident is a false positive. You change the incident status to Closed: False Positive. Which statement about your update is true?
incident statusfalse positiveaudit historyincident lifecycle - Question #9Forensic Analysis
Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web inte...
log filtertext filterlogin eventsGUI access - Question #10Logging and Monitoring
Which two statements about local logs on FortiAnalyzer are true? (Choose two.)
local logsADOMplaybook logsapplication control logs - Question #11Logging and Monitoring
Refer to the exhibit. What does the data point at 21:20 indicate?
log indexingsqlplugindlog insert lagperformance monitoring - Question #12Alerting and Incident Response
A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails. What will be the status of the playb...
playbook executiontask statusplaybook statusautomation - Question #13Logging and Monitoring
Refer to the exhibit. Client-1 is trying to access the internet for web browsing. All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer...
Security Fabrictraffic logsfirewall policy loggingFortiGate logging - Question #14Reporting
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)
auto-cachehcachereport performancereport generation - Question #15Logging and Monitoring
What is the purpose of running the command diagnose sql status sqlplugind?
SQL diagnosticssqlplugindlog insertiondatabase status - Question #16Logging and Monitoring
Refer to the exhibit. What can you conclude about the output?
log statisticsADOMdiagnostic outputindexing - Question #17Alerting and Incident Response
As part of your analysis, you discover that a Medium severity level incident is fully remediated. You change the incident status to Closed: Remediated. Which statement about your u...
incident statusremediationincident dashboardseverity level - Question #18Alerting and Incident Response
What is the purpose of playbook trigger variables?
playbooktrigger variablesautomationtask filtering - Question #19Reporting
Which statement correctly describes one difference between templates and reports?
report templatesreportsconfiguration optionsFortiAnalyzer reporting - Question #20Alerting and Incident Response
Which statement about sending notifications with incident updates is true?
incident notificationsconnectorsnotification settingsincident updates - Question #21Reporting
Refer to the exhibit. What is the purpose of using the Chart Builder feature on FortiAnalyzer?
Chart Builderdataset creationfiltered searchFortiAnalyzer reporting - Question #22Alerting and Incident Response
Which two statements regarding the outbreak detection service are true? (Choose two.)
outbreak detectionlicensingevent handlersemail alerts - Question #23Logging and Monitoring
You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but, so far, you have been unsuccessful. Which two tasks should you perform to investi...
FortiViewADOM data policySQL databaseLog Browse - Question #24SOC Operations
Which two statements about playbook execution are true? (Choose two.)
playbook executionPlaybook Monitortask statustroubleshooting logs - Question #25Reporting
You discover that a few reports are taking a long time to generate. Which two steps can you take to troubleshoot? (Choose two.)
report performanceauto-cachereport diagnosticstroubleshooting - Question #26SOC Operations
Which two statements about exporting and importing playbacks are true? (Choose two.)
playbook exportplaybook importconnectorsADOM portability - Question #27Logging and Monitoring
You are tasked with finding logs corresponding to a suspected attack on your network. You need to use an interface where all identified threats within timeframe are listed and orga...
FortiViewthreat visibilityPDF exportlog investigation - Question #28SOC Operations
Which statement about automation connectors in FortiAnalyzer is true?
automation connectorsFortiOS connectorautomation rulesADOM - Question #29Alerting and Incident Response
What is the purpose of using data selectors when configuring event handlers?
data selectorsevent handlerslog filteringcommon filters - Question #30Reporting
You need to move reports between two ADOMs. Which two statements are true? (Choose two.)
ADOM report migrationADOM compatibilitycharts and datasetsreport import - Question #31Reporting
Which statement about exporting items in Report Definitions is true?
Report Definitionschart exportdataset associationtemplate export - Question #32Alerting and Incident Response
Which log will generate an event with the status Contained?
event statusContainedAV logquarantine action - Question #33Logging and Monitoring
Refer to the exhibit. What does the data point at 12:20 indicate?
log insert lagFortiAnalyzer performancesqiplugindmonitoring metrics - Question #34SOC Operations
Which statement about the FortiSIEM management extension is correct?
FortiSIEMmanagement extensionlicensingsupervisor requirement - Question #35SOC Operations
You are trying to configure a task in the playbook editor to run a report. However, when you try to select the desired report you do not see it listed. What is the reason?
playbook editorauto-cacheextended log filteringreport task configuration - Question #36Alerting and Incident Response
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?
IOC engineblacklisted IPCompromised Hostsweb log analysis - Question #37Data Policy and Archiving
It is a best practice to upload FortiAnalyzer local logs to a remote server. Which three remote servers are supported for the upload? (Choose three.)
local log uploadFTPSFTPSCP - Question #38Reporting
Which two FortiAnalyzer features allow you to automatically build a dataset and chart based on a filtered search result? (Choose two.)
Chart BuilderExport to Report ChartFortiViewdataset automation - Question #39Data Policy and Archiving
What is included in the disk quota for each ADOM on the FortiAnalyzer?
ADOM disk quotaarchive logsanalytics logsstorage allocation - Question #40Alerting and Incident Response
Which log will generate an event with the status Unhandled?
event statusUnhandledIPS logpass action - Question #41SOC Operations
Refer to the exhibit. Which statement about the displayed event is correct?
event statussecurity riskSOC dashboardincident management - Question #42Logging and Monitoring
Which statement describes archive logs on FortiAnalyzer?
archive logslog compressiongz fileslog storage - Question #43Alerting and Incident Response
Which statement about sending notifications with incident update is true?
incident notificationsfabric connectorsexternal platformsincident update - Question #44SOC Operations
Which statement about the FortiSOAR management extension is correct?
FortiSOARdocker containermanagement extensionFortiAnalyzer integration - Question #45Logging and Monitoring
Refer to the exhibit. Based on the partial outputs displayed, which devices can be members of a FotiAnalyzer Fabric?
FortiAnalyzer Fabricfabric membersdevice topologyADOM - Question #46SOC Operations
Which two actions should you take to view compromised hosts on FortiAnalyzer? (Choose two.)
compromised hostsFortiGuardweb filteringthreat database - Question #47Reporting
Which SQL query is in the correct order to query the database in the FortiAnalyzer?
SQL querySELECT statementquery syntaxFortiAnalyzer database - Question #48Alerting and Incident Response
What are event handlers?
event handlerslog conditionsalert triggersraw logs - Question #49Logging and Monitoring
Which two external servers can you configure to validate administrator logins? (Choose two.)
RADIUSLDAPadministrator authenticationexternal servers - Question #50Reporting
Which database language does FortiAnalyzer support for the purposes of logging and reporting?
database languageSQLlogging and reportingFortiAnalyzer database