Free FCP_FAZ_AN-7.6: Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst Exam Questions and Answers

A playbook uses an EVENT_TRIGGER and has a task that sends an email when a High severity event is generated. A High severity event was generated by an event handler in the same ADOM, but no job appears on the playbook Monitor tab. Which two conditions could cause this? (Choose two.)

Select 2 answers.

• AA. The playbook is set to disabled in the playbook list
• BB. The SMTP server on FortiAnalyzer is not configured for sending email
• CC. The filter in the event trigger does not match the attributes of the generated event
• DD. The event handler is not linked to the playbook through an automation stitch on the FortiGate

An analyst wants an event handler to generate a separate event for each source IP address that meets the handler condition. Which event handler setting should the analyst configure?

• AA. Event category
• BB. Notification profile
• CC. Group By
• DD. Generic text filter

A FortiGate with a single VDOM sends logs to FortiAnalyzer. A security manager wants the Top Applications report to include only traffic that entered the FortiGate on the vlan50 interface. The change must apply to every chart in the report, and no dataset can be edited. What should the analyst configure?

• AA. A custom SQL dataset with a WHERE clause on the srcintf field assigned to each chart
• BB. A log filter in the report settings that matches the source interface vlan50
• CC. A data selector for vlan50 that is assigned to the event handler used by the report
• DD. A device selection in the report settings that limits the report to the vlan50 interface

Refer to the exhibit. Exhibit: Dataset query: SELECT dstip, SUM(sentbyte) AS bytes FROM $log GROUP BY srcip ORDER BY bytes DESC LIMIT 10 A chart based on this dataset shows no data when the report is generated, and the dataset test returns an error. What is the cause?

• AA. The query is missing a WHERE clause that contains the $filter macro
• BB. The LIMIT clause is not allowed in a dataset used for a chart
• CC. The dstip column is selected but not included in the GROUP BY clause
• DD. The ORDER BY clause cannot reference a column alias such as bytes

After changing a firewall policy on FortiGate-Edge, an analyst wants to watch its traffic logs as they are received, without rerunning a time-range query. Which Log View option should the analyst use?

• AA. Real-time Log for the device
• BB. Historical Log with the time period set to Last 5 minutes
• CC. A custom filter on the policy ID with the sort order set to newest first
• DD. Log Browse for the device, then download the current log file

An analyst must add a chart to a weekly report that lists the 10 destination countries with the highest total bytes of FortiGate traffic. None of the built-in charts provides this result. In which order should the analyst create the components?

• AA. Create a dataset with the SQL query, create a chart that uses the dataset, and then add the chart to a report template
• BB. Create a report template, add the SQL query directly to its layout, and then create a chart that formats the output
• CC. Create a chart, create a dataset that the chart references, and then add the dataset to a report template
• DD. Create a macro with the SQL query, create a dataset that calls the macro, and then add the dataset to a report template

A weekly report in the root ADOM completes successfully, but every Application Control chart is empty while the traffic charts contain data. The same FortiGate sends both log types to this ADOM. Which action will help identify the cause?

• AA. Change the report output format from PDF to HTML and then generate the report again for the period
• BB. Increase the hcache size for the report and then generate the report again for the same time period
• CC. Rebuild the SQL database for the ADOM and then generate the report again for the same time period
• DD. Search Log View in the same ADOM and time period for application control logs from the FortiGate

An analyst is working on incident IN00000012 when a new event appears in Event Monitor for the same host. The analyst wants the event to be listed in that incident. What should the analyst do?

• AA. Select the second event in Event Monitor and attach it to the existing incident
• BB. Add only the source IP address of the second event as an indicator of the existing incident
• CC. Copy the second event ID into the Notes field of the existing incident for later reference
• DD. Create a new incident from the second event and then merge it into the existing incident

In a FortiAnalyzer incident, what do indicators represent?

• AA. Observable artifacts tied to the incident, such as IP addresses or file hashes
• BB. Conditions in an event handler that decide when an event becomes an incident
• CC. Users who receive a notification when the incident is updated by an analyst
• DD. Playbook tasks that run automatically when the incident status is changed

The log settings of a FortiGate point to the IP address of a FortiAnalyzer, and the connection is up. Minutes later, the analyst finds no logs from the device in Log View. The FortiGate is listed on FortiAnalyzer as an unauthorized device. What must the analyst do for FortiAnalyzer to accept its logs?

• AA. Enable log forwarding for the FortiGate serial number in the FortiAnalyzer system settings
• BB. Set the upload option to real-time on the FortiGate and wait for the next log upload cycle to run
• CC. Create an event handler for the FortiGate so that FortiAnalyzer starts accepting its logs
• DD. Authorize the FortiGate in Device Manager on FortiAnalyzer and assign it to an ADOM