Free FCP_FAZ_AN-7.4: FCP - FortiAnalyzer 7.4 Analyst Exam Questions and Answers

Which playbook component is configured with an action offered by a connector and can use the output of an earlier component in the same playbook?

• AA. Trigger
• BB. Event handler
• CC. Connector
• DD. Task

An administrator must see how many logs per second FortiAnalyzer is currently receiving for the ADOM named Branch. Which CLI command should the administrator run?

• AA. diagnose log device
• BB. diagnose fortilogd lograte-adom Branch
• CC. diagnose fortilogd logvol-adom Branch
• DD. diagnose dvm adom list

Refer to the exhibit. Exhibit: Playbook: Investigate-High-Events Trigger: ON_DEMAND Task 1: Get Events (Local Connector), filter: Severity = High Task 2: Create Incident (Local Connector), input: Task 1 output The SOC team wants this playbook to start automatically each time an event handler generates a High severity event, without any analyst action. What must the administrator change?

• AA. Add a second Get Events task before Task 1 to poll for new events
• BB. Change the trigger to INCIDENT and filter on the incident severity High
• CC. Change the trigger to SCHEDULE and set the playbook to run every minute
• DD. Change the trigger to EVENT and filter on the event severity High

A report must include only traffic whose source IP address is in the 10.20.0.0/16 subnet. The report uses built-in charts that other reports also use. What should the analyst do?

• AA. Set the report time period to the hours when the subnet was active
• BB. Add a log filter on the source IP field in the report settings
• CC. Edit the built-in datasets used by the report and add a WHERE clause for the subnet
• DD. Create a device group for the subnet and assign it to the report

Refer to the exhibit. Exhibit: Device Manager > Unauthorized Devices Name: FGT-BR-02 IP Address: 10.0.2.10 Platform: FortiGate-60F Status: Unregistered The FortiGate is configured with the FortiAnalyzer IP address and reports a successful connection, but no logs from FGT-BR-02 appear in Log View in the root ADOM. What should the administrator do?

• AA. Increase the analytics retention period of the root ADOM
• BB. Change the FortiGate log upload option to real-time
• CC. Run the SQL database rebuild command for the root ADOM
• DD. Authorize the device and assign it to the root ADOM

Refer to the exhibit. Exhibit: date=2024-03-12 time=10:42:17 logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" srcip=10.0.1.25 srcport=51822 dstip=104.21.8.14 dstport=443 service="HTTPS" hostname="proxy-hub.example.net" profile="Corp-Web" action="blocked" reqtype="direct" url="/" catdesc="Proxy Avoidance" msg="URL belongs to a denied category in policy" An analyst reviews this entry in Log View. Which conclusion about the entry is correct?

• AA. FortiAnalyzer blocked the request after matching the hostname against a threat feed
• BB. The IPS sensor attached to the policy blocked the session after matching a signature
• CC. The FortiGate blocked the request because its URL category is denied in the web filter profile
• DD. The FortiGate allowed the connection and recorded only a warning about the URL category

An analyst reviews Event Monitor and finds three events from different event handlers that all involve the same compromised workstation. The analyst wants to track the investigation as one record, set a status, and assign it to a colleague. What should the analyst do?

• AA. Acknowledge the three events and add a comment to each one of them
• BB. Add the three events to a playbook trigger and run the playbook manually
• CC. Export the three events to a CSV file and share the file with the colleague
• DD. Create an incident and attach the three events to it

After a maintenance window, an administrator generates a weekly report. Charts for the first three days of the period show no data, although Log View displays logs for those days. The output of diagnose sql status rebuild-db shows that a database rebuild is still running. What is the most likely reason for the missing data?

• AA. The logs for those days are not yet indexed in the SQL database that reports query
• BB. The logs for those days were moved to the archive and are excluded from reports
• CC. The report time period is evaluated in UTC while the devices log in local time
• DD. The ADOM data policy deleted the analytics logs for the first three days

Which statement about administrative domains (ADOMs) in FortiAnalyzer is true?

• AA. Each ADOM requires its own FortiAnalyzer license before devices can be added
• BB. ADOMs group devices and let administrators be restricted to their assigned ADOMs
• CC. A device can be registered to several ADOMs at the same time to share its logs
• DD. ADOMs must be enabled before FortiAnalyzer can accept logs from any device

An administrator configures an event handler with an email notification. Matching events appear in Event Monitor, but no email is ever received. Which configuration is most likely missing?

• AA. A FortiGate automation stitch that forwards the event to the mail address
• BB. A report schedule with an email output profile for the handler
• CC. A mail server entry in FortiAnalyzer that the handler notification can use
• DD. An email filter profile applied to the firewall policy on the FortiGate