VCEdump

FCP_FAZ_AN-7.6 Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst

PDF question preview Back to product

Free preview

14 sample questions

The complete product contains 87 questions.

Question formats

Single choice13

Multiple choice1

Compare study plans

Fortinet · FCP_FAZ_AN-7.6

FCP_FAZ_AN-7.6 questions and answers

Review the question wording, option layout, and available explanations before choosing a study plan.

Question 1

Single choice

Which SQL query is in the correct order to query to database in the FortiAnalyzer?

A
SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'
B
SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid
C
SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid
D
SELECT devid FROM $log WHERE 'user'=' GROUP BY devid

Question 2

Single choice

Which statement regarding macros on FortiAnalyzer is true?

A
Macros are predefined templates for reports and cannot be customized.
B
Macros are useful in generating excel log files automatically based on the report settings.
C
Macros are ADOM-specific and each ADOM type have unique macros relevant to that ADOM.
D
Macros are supported only on the FortiGate ADOMs.

Question 3

Single choice

Refer to the exhibit with partial output:

Your colleagueexported a playbook and has sent it to you for review. You open the file in a text editor and observer the output as shown in the exhibit.

Which statement about the export is true?

A
The export data type is zipped.
B
The playbook is misconfigured.
C
The option to include the connector was not selected.
D
Your colleague put a password on the export.

Question 4

Single choice

What does FortiAnalyzer use ADOMs for in an operational environment?

A
To provide administrative and data separation for managed devices and logs.
B
To encrypt every report attachment with a unique public key.
C
To prevent FortiGate devices from sending logs.
D
To remove the need for role-based administrator access.

Question 5

Single choice

Exhibit.

What is the purpose of using the Chart Builder feature On FortiAnalyzer?

A
To build a chart automatically based on the top 100 log entries
B
To add charts directly to generatereports in the current ADOM.
C
To add a new chart under FortiView to be used in new reports
D
To build a dataset and chart based on the filtered search results

Question 6

Single choice

Exhibit.

What can you conclude from this output?

A
There is not disk quota allocated to quarantining files.
B
FGT_B is the Security Fabric root.
C
The allocated disk quote to ADOM1 is 3 GB.
D
Archive logs are using more space than analytic logs.

Question 7

Multiple choice

Which two statements about playbook execution are true? (Choose two)

A
FortiAnalyzer will not commit changes made by a Failed playbook
B
The Playbook Monitor provides troubleshooting logs
C
You can run the default debugging playbook to investigate playbook errors.
D
Even I the playbook status is Failed, individual tasks may have succeeded.

Question 8

Single choice

You created a playbook on FortiAnalyzer that uses a FortiOS connector.

When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stich are available in the FortiOS connector?

A
FortiAnalyzer Event Handler
B
Fabric Connector event
C
FortiOS Event Log
D
Incoming webhook

Question 9

Single choice

Aplaybook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails.

What will be the status of the playbook after it is run?

A
Attention required
B
Upstream_failed
C
Failed
D
Success

Question 10

Single choice

Exhibit.

What is the analyst trying to create?

A
The analyst is trying to create a trigger variable to the used in the playbook.
B
The analyst is trying to create an output variable to be used in the playbook.
C
The analyst is trying to create a report in the playbook.
D
The analyst is trying to create a SOC report inthe playbook.

Question 11

Single choice

Which FortiAnalyzer component is used by charts and macros to retrieve log data for reports?

A
Indicator
B
Dataset
C
Playbook connector
D
Event handler

Question 12

Single choice

Which statement about sending notifications with incident update is true?

A
You can send notifications to multiple external platforms.
B
Notifications can be sent only by email.
C
If you use multiple fabric connectors, all connectors must have the same settings.
D
Notifications can be sent only when an incident is updated or deleted.

Question 13

Single choice

Refer to the exhibit.

Which statement about the displayed event is correct? (Choose one answer))

A
An incident was created from this event.
B
The risk source is isolated.
C
The security risk was escalated.
D
The security event risk is considered open.

Question 14

Single choice

You are tasked with finding logs corresponding to a suspected attack on your network. You need to use an interface where all identified threats within timeframe are listed and organized. You also need to be able to quickly export the information to a PDF file.

Where can you go to accomplish this task?

A
Log Browse
B
Log View
C
Fabric View
D
FortiView