FCP_FAZ_AN-7.6 Exam Questions
79 real FCP_FAZ_AN-7.6 exam questions with expert-verified answers and explanations. Page 2 of 2.
- Question #51Data Policy and Archiving
What should you always do after erasing the FortiAnalyzer configuration on flash?
configuration resetdisk formatflash memorysystem maintenance - Question #52Alerting and Incident Response
What are the two methods you can use to send notifications when an event is generated by an event handler? (Choose two.)
event handlerSNMP trapfabric connectorsalert notifications - Question #53Data Policy and Archiving
Refer to the exhibit. What can you conclude from this output?
disk quotaADOMarchive logsstorage allocation - Question #54SOC Operations
Refer to the exhibits. Assume these are all the events that exist on the FortiAnalyzer device. How many events will be added to the incident created after running this playbook?
playbookincident creationevent correlationSOC automation - Question #55Reporting
Which operation can you use SQL SELECT queries for?
SQL SELECTdatabase schemaquery operationsread-only queries - Question #56SOC Operations
Refer to the exhibit. What is the analyst trying to create?
playbook variablesoutput variableSOC automationplaybook configuration - Question #57SOC Operations
Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?
threat huntingproactive securityFortiViewnetwork security management - Question #58SOC Operations
Refer to the exhibit with partial output. Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observe the output as shown i...
playbook exportzip formatconnector exportplaybook configuration - Question #59Logging and Monitoring
In your role as an analyst, you frequently search the log view using the same parameters. Instead of defining the same search filters repeatedly, what can you do to save time?
log viewcustom viewsearch filterslog analysis - Question #60Data Policy and Archiving
When you move a FortiGate device from one ADOM to a new ADOM, what is the purpose of rebuilding the new ADOM database?
ADOM migrationdatabase rebuildanalytics logsADOM management - Question #61Data Policy and Archiving
What is the main purpose of deploying RAID with FortiAnalyzer?
RAIDlog storageredundancyFortiAnalyzer hardware - Question #62Reporting
When generating reports on FortiAnalyzer, macros can be used to include additional data. Which two statements about macros are true? (Choose two.)
macrosdataset queriesreport chartsFortiAnalyzer reports - Question #63SOC Operations
Why must you wait for several minutes before you run a playbook that you just created?
playbooksplaybook parsingFortiAnalyzer automation - Question #64Logging and Monitoring
Refer to the exhibit. What can you conclude about the output?
log indexingmessage ratelog rateFortiAnalyzer diagnostics - Question #65Reporting
Refer to the exhibit. A fortiAnalyzer analyst is customizing a SQL query to use in a report. Which SQL query should the analyst run to get the expected results?
SQL queriesdatasetreport customizationFortiAnalyzer reports - Question #66SOC Operations
You want to design a playbook that runs a series of tasks in parallel. How can you accomplish this goal?
playbooksparallel tasksSOC automationplaybook design - Question #67Alerting and Incident Response
Refer to the exhibit. Which statement about the event displayed is correct?
event handlersplaybooksincident templatesFortiAnalyzer events - Question #69Logging and Monitoring
Refer to the exhibit. Which two observations can you make after reviewing this log entry? (Choose two.)
raw logsnormalized logslog formatFortiGate logs - Question #70SOC Operations
Refer to the exhibit. The playbook shown in the exhibit requires fine-tuning. A task needs to be configured to run a report on the updated asset list that the FortiAnalyzer receive...
SOC engineerSOC rolesplaybook managementFortiClient EMS - Question #71Forensic Analysis
Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)? (Choose two.)
IOCIP addressURLthreat intelligence - Question #72Alerting and Incident Response
When managing incidents on FortiAnalyzer, which fact must an analyst be aware of?
incident managementplaybooksincidents pageFortiAnalyzer - Question #73Forensic Analysis
Which three types of indicators can FortiAnalyzer identify? (Choose three.)
indicatorsdomainURLIP address - Question #74Alerting and Incident Response
Which three types of traffic does the safeguarding event handler scan? (Choose three.)
event handlersweb trafficemail trafficDNS traffic - Question #75SOC Operations
Refer to the exhibit. What does the orange status indicator on the FortiGuard Connector indicate?
FortiGuard connectorstatus indicatorsconnection statusFortiAnalyzer connectors - Question #76Logging and Monitoring
When there are no matching parsers for a device log, what does FortiAnalyzer do?
log parsersSYSLOGgeneric parserlog normalization - Question #77Alerting and Incident Response
How does FortiAnalyzer block indicators?
indicator blockingFortiManager connectorblock listFortiAnalyzer - Question #78Reporting
What is the purpose of running the command diagnose sql status sqlreportd?
SQL diagnosticsreport statusCLI commandssqlreportd - Question #79SOC Operations
Refer to the exhibit. What is the analyst trying to create?
playbook variablesoutput variablesplaybook tasksFortiAnalyzer playbooks - Question #80Logging and Monitoring
In a FortiAnalyzer Fabric deployment, which three modules from Fabric members are available for analysis on the supervisor? (Choose three.)
FortiAnalyzer Fabricsupervisorlogs analysisFabric deployment