FCP_FAZ_AD-7.4 Practice Questions Preview

Question 1

Single choice

Why must you wait for several minutes before you run a playbook that you just created?

A
FortiAnalyzer needs that time to parse the new playbook.
B
FortiAnalyzer needs that time to back up the current playbooks.
C
FortiAnalyzer needs that time to ensure there are no other playbooks running.
D
FortiAnalyzer needs that time to debug the new playbook.

Question 2

Single choice

An administrator has configured the following settings:

config system global

set log-checksum md5-auth

end

What is the significance of executing this command?

A
This command records the log file MD5 hash value.
B
This command records passwords in log files and encrypts them.
C
This command encrypts log transfer between FortiAnalyzer and other devices.
D
This command records the log file MD5 hash value and authentication code.

Question 3

Single choice

Which SQL query is in the correct order to query the database in the FortiAnslyzer?

A
SELECT devid FROM Slog GROOP BY devid WHERE * user' =* USERl'
B
SELECT devid WHERE 'u3er'='USERl' FROM $ log GROUP BY devid
C
SELECT devid FROM Slog-WHERE *user' =' USERl' GROUP BY devid
D
FROM Slog WHERE 'user* =' USERl' SELECT devid GROUP BY devid

Question 4

Single choice

FortiAnalyzer uses the Optimized Fabric Transfer Protocok (OFTP) over SSL for what purpose?

A
To upload logs to an SFTP server
B
To prevent log modification during backup
C
To send an identical set of logs to a second logging server
D
To encrypt log communication between devices

Question 5

Single choice

Refer to the exhibit.

The exhibit shows the creation of a new administrator on FortiAnalyzer. The new account uses the credentials stored on an LDAP server.

Why would an administrator configure a password for this account?

A
This password is used if the authentication server becomes unreachable.
B
This password authenticates FortiAnalyzer aqainst the LDAP server.
C
This password is set to comply with FortiAnalvzer password policy
D
This password is required because this is a restricted user.

Question 6

Multiple choice

What statements are true regarding FortiAnalyzer 's treatment of high availability (HA) dusters? (Choose two)

A
FortiAnalyzer distinguishes different devices by their serial number.
B
FortiAnalyzer receives logs from d devices in a duster.
C
FortiAnalyzer receives bgs only from the primary device in the cluster.
D
FortiAnalyzer only needs to know (he serial number of the primary device in the cluster-it automaticaly discovers the other devices.

Question 7

Single choice

Which log will generate an event with the status Contained?

A
An IPS log with action=pass.
B
A WebFilter log with action=dropped.
C
An AV log with action=quarantine.
D
An AppControl log with action=blocked.

Question 8

Multiple choice

In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)

A
Remote logging must be enabled on FortiGate
B
Log encryption must be enabled
C
ADOMs must be enabled
D
FortiGate must be registered with FortiAnalyzer

Question 9

Single choice

What FortiGate process caches logs when FortiAnalyzer is not reachable?

A
logfiled
B
sqlplugind
C
oftpd
D
miglogd

Question 10

Multiple choice

Which two statements are true regarding fabric connectors? (Choose two.)

A
Configuring fabric connectors to send notification to ITSM platform upon incident creation Is more efficient than third-party information from the FortiAnalyzer API.
B
Fabric connectors allow to save storage costs and improve redundancy.
C
Storage connector service does not require a separate license to send logs to cloud platform.
D
Cloud-Out connections allow you to send real-time logs to pubic cloud accounts like Amazon S3, Azure Blob , and Google Cloud.

Question 11

Single choice

On the RAID management page, the disk status is listed as Initializing.

What does the status Initializing indicate about what the FortiAnalyzer is currently doing?

A
FortiAnalyzer is ensuring that the parity data of a redundant drive is valid
B
FortiAnalyzer is writing data to a newly added hard drive to restore it to an optimal state
C
FortiAnalyzer is writing to all of its hard drives to make the array fault tolerant
D
FortiAnalyzer is functioning normally

Question 12

Single choice

What is Log Insert Lag Time on FortiAnalyzer?

A
The number of times in the logs where end users experienced slowness while accessing resources.
B
The amount of lag time that occurs when the administrator is rebuilding the ADOM database.
C
The amount of time that passes between the time a log was received and when it was indexed on FortiAnalyzer.
D
The amount of time FortiAnalyzer takes to receive logs from a registered device

Question 13

Single choice

View the exhibit:

What does the 1000MB maximum for disk utilization refer to?

A
The disk quota for the FortiAnalyzer model
B
The disk quota for all devices in the ADOM
C
The disk quota for each device in the ADOM
D
The disk quota for the ADOM type

Question 14

Multiple choice

Which two purposes does the auto cache setting on reports serve? (Choose two.)

A
It automatically updates the hcache when new logs arrive.
B
It provides diagnostics on report generation time.
C
It reduces the log insert lag rate.
D
It reduces report generation time.

Question 15

Single choice

Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

A
Log upload
B
Indicators of Compromise
C
Log forwarding an aggregation mode
D
Log fetching

Question 16

Single choice

Refer to the exhibit.

What does the data point at 14:55 tell you?

A
The received rate is almost at its maximum for this device
B
The sqlplugind daemon is behind in log indexing by two logs
C
Logs are being dropped
D
Raw logs are reaching FortiAnalyzer faster than they can be indexed

Question 17

Single choice

Refer to the exhibit.

Which image corresponds to the packet capture shown in the exhibit?

A
Option A
B
Option B
C
Option C
D
Option D

Question 18

Single choice

Which statement is true about ADOMs?

A
A fabric ADOM can include all the device types supported by FortiAnalyzer.
B
When a FortiAnalyzer Fabric is implemented the default ADOM mode is set to advanced.
C
In normal mode, you cannot change the disk quota of the ADOM after its creation.
D
You can change the ADOM mode only through the GUI.

Question 19

Multiple choice

What are the operating modes of FortiAnalyzer? (Choose two)

A
Standalone
B
Manager
C
Analyzer
D
Collector

Question 20

Single choice

In a Fortinet Security Fabric, what can make an upstream FortiGate create traffic logs associated with sessions initiated on downstream FortiGate devices?

A
The traffic destination is another FortiGate in the fabric.
B
The upstream FortiGate is configured to do NAT
C
Log redundancy is configured in the fabric.
D
The downstream device cannot connect to FortiAnalyzer.

Question 21

Multiple choice

Which two statements are true regarding the outbreak detection service? (Choose two.)

A
New alerts are received by email.
B
Outbreak alerts are available on the root ADOM only.
C
An additional license is required.
D
It automatically downloads new event handlers and reports.

Question 22

Multiple choice

Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)

A
SMS
B
Email
C
SNMP
D
IM

Question 23

Multiple choice

Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally? (Choose two.)

A
Mail server
B
Output profile
C
SFTP server
D
Report scheduling

Question 24

Single choice

What is required to authorize a FortiGate on FortiAnalyzer using Fabric authorization?

A
A FortiGate ADOM
B
The FortiGate serial number
C
A pre-shared key
D
Valid FortiAnalyzer credentials

Question 25

Multiple choice

Which two statements about creating ADOMs are true1? (Choose two.)

A
An administrator with the default standard_User profile can create ADOMs.
B
Disk quotas can be defined per device inside the ADOM.
C
FortiAnalyzer creates default ADOMs when ADOMs are enabled.
D
The ADOM type you create must match the device type you are planning to add.

Question 26

Single choice

Refer to the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

A
In Log View, this feature allows you to build a dataset and chart automatically, based on the filtered search results.
B
In Log View, this feature allows you to build a chart and chart automatically, on the top 100 log entries.
C
This feature allows you to build a chart under FortiView.
D
You can add charts to generated reports using this feature.

Question 27

Single choice

Which statement about sending notifications with incident updates is true?

A
Notifications can be sent only when an incident is created or deleted.
B
You must configure an output profile to send notifications by email.
C
Each incident can send notifications to a single external platform.
D
Each connector used can have different notification settings.