What is the purpose of output variables?

To use the output of the previous task as the input of the current task

To store playbook execution statistics

To use the output of the previous task as the input of the current task

To display details of the connectors used by a playbook

To save all the task settings when a playbook is exported

Which two statements are correct regarding the export and import of playbooks? (Choose two.)

You can import a playbook even if there is another one with the same name in the destination.

A playbook that was disabled when it was exported, will be disabled when it is imported.

You can export only one playbook at a time.

You can import a playbook even if there is another one with the same name in the destination.

Playbooks can be exported and imported only within the same FortiAnaryzer.

A playbook that was disabled when it was exported, will be disabled when it is imported.

Which SQL query is in the correct order to query the database in the FortiAnslyzer?

SELECT devid FROM Slog- WHERE *user' =' USERl' GROUP BY devid

SELECT devid FROM Slog GROOP BY devid WHERE * user' =* USERl'

SELECT devid WHERE 'u3er'='USERl' FROM $ log GROUP BY devid

SELECT devid FROM Slog- WHERE *user' =' USERl' GROUP BY devid

FROM Slog WHERE 'user* =' USERl' SELECT devid GROUP BY devid

Refer to the exhibit. Which statement is correct regarding the event displayed?

The security event risk is considered open.

The security risk was blocked or dropped.

The security event risk is considered open.

An incident was created from this event.

What is required to authorize a FortiGate on FortiAnalyzer using Fabric authorization?

Valid FortiAnalyzer credentials

Refer to the exhibit. Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than 'admin' and coming from Laptop1:Which filter will achieve the desired result?

operation-login & performed_on=='GUI(10.1.1.100)' & user!=admin

operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

operation-login & dstip==10.1.1.210 & userl-admin

operation-login & performed_on=='GUI(10.1.1.210)' & user!=admin

If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

The configured priority is checked first

The configured IP address is checked first.

The active port number is checked first.

The firmware version is checked first.

The configured priority is checked first

Which statement is true about sending notifications with incident updates?

You can send notifications to multiple external platforms

Notifications can be sent only when an incident is updated or deleted.

If you use multiple fabric connectors, all connectors must have the same notification settings

Notifications can be sent only by email.

You can send notifications to multiple external platforms

Which statement correctly describes the management extensions available on FortiAnalyzer?

Management extensions may require a minimum number of CPU cores to run.

Management extensions do not require additional licenses.

Management extensions allow FortiAnalyzer to act as a ForbSIEM supervisor.

Management extensions require a dedicated VM for best performance.

Management extensions may require a minimum number of CPU cores to run.

When working with FortiAnalyzer reports, what is the purpose of a dataset?

To retrieve data from the database

To provide the layout used for reports

To define the chart type to be used

To retrieve data from the database

To set the data included in templates

Refer to the exhibit. The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster.What can you conclude from the configuration displayed?

This FortiAnalyzer is configured to receive logs in its port1.

This FortiAnalyzer will join to the existing HA cluster as the primary.

This FortiAnalyzer is configured to receive logs in its port1.

This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.

After joining to the cluster, this FortiAnalyzer will keep an updated log database.

What must you consider when using log fetching? (Choose two.)

You can use filters to include only logs from a single device.

The fetching profile must include a user with the Super_User profile.

The fetch client can retrieve logs from devices that are not added to its local Device Manager

You can use filters to include only logs from a single device.

The fetching profile must include a user with the Super_User profile.

The archive logs retrieved from the server become archive logs in the client.

Which two statements are true regarding the outbreak detection service? (Choose two.)

An additional license is required.

It automatically downloads new event handlers and reports.

New alerts are received by email.

Outbreak alerts are available on the root ADOM only.

An additional license is required.

It automatically downloads new event handlers and reports.

Which statement about the FortiSOAR management extension is correct?

It runs as a docker container on FortiAnalyzer

It requires a FortiManager configured to manage FortiGate

It requires a dedicated FortiSOAR device or VM.

It does not include a limited trial by default.

It runs as a docker container on FortiAnalyzer

Why run the command diagnose sql status sqlplugind?

To view the current hcache size

To list the current SQL processes running

To check what is the database log insertion status

To display the SOL query connections and hcache status

To view the current hcache size

What are two benefits of using fabric connectors? (Choose two.)

They allow FortiAnalyzer to send logs in real-time to public cloud accounts.

Fabric connectors allow you to improve redundancy.

They allow FortiAnalyzer to send logs in real-time to public cloud accounts.

You do not need an additional license to send logs to the cloud platform.

Fabric connectors allow you to improve redundancy.

Using fabric connectors is more efficient than using third-party polling with API.

Which log will generate an event with the status Contained?

An AV log with action=quarantine.

A WebFilter log with action=dropped.

An AV log with action=quarantine.

An AppControl log with action=blocked.

Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than 'admin', and coming from Laptop1.Which filter will achieve the desired result?

operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

operation-login & dstip==10.1.1.210 & user!-admin

operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

operation-login & performed_on=='GUI(10.1.1.210)' & user!=admin

operation-login & performed_on=='GUI(10.1.1.100)' & user!=admin

After generating a report, you notice the information you were expecting to see is not included in it. What are two possible reasons for this scenario? (Choose two.)

The logfiled service has not indexed all the expected logs.

The logs were overwritten by the data retention policy.

You enabled auto-cache with extended log filtering.

The logfiled service has not indexed all the expected logs.

The logs were overwritten by the data retention policy.

The time frame selected in the report is wrong.

What is the purpose of using prefilters when configuring event handlers?

They download new filters to be used in event handlers.

They limit which logs are checked for matches by the other filters.

They can filter the logs before they are processed by FortiAnalyzer

They download new filters to be used in event handlers.

They are common filters applied simultaneously to all event handlers.

Which statement describes a dataset in FortiAnalyzer?

They determine what data is retrieved from the database.

They provide the layout used for reports.

They are used to set the data included in templates.

They define the chart types to be used in reports.

What is the purpose of trigger variables?

To display statistics about the playbook runtime

To use information from the trigger to filter the action in a task

To provide the trigger information to make the playbook start running

To store the start times of playbooks with On_Schedule triggers

Which statement about sending notifications with incident updates is true?

Each incident can send notifications to a single external platform.

Notifications can be sent only when an incident is created or deleted.

You must configure an output profile to send notifications by email.

Each incident can send notifications to a single external platform.

Each connector used can have different notification settings.

Refer to the exhibit. What is the purpose of using the Chart Builder feature on FortiAnalyzer?

To add charts directly to generate reports in the current ADOM

To add a new chart under FortiView to be used in new reports

To build a dataset and chart automatically, based on the filtered search results

To add charts directly to generate reports in the current ADOM

To build a chart automatically based on the top 100 log entries

What are two advantages of setting up fabric ADOM? (Choose two.)

It can be used for fast data processing and log correlation

It can include all Fortinet devices that are part of the same Security Fabric

It can be used for fast data processing and log correlation

It can be used to facilitate communication between devices in same Security Fabric

It can include all Fortinet devices that are part of the same Security Fabric

It can include only FortiGate devices that are part of the same Security Fabric

What is the purpose of a predefined template on the FortiAnalyzer?

It specifies the report layout which contains predefined texts, charts, and macros

It can be edited and modified as required

It specifies the report layout which contains predefined texts, charts, and macros

It specifies report settings which contains time period, device selection, and schedule

It contains predefined data to generate mock reports

Which two purposes does the auto cache setting on reports serve? (Choose two.)

It automatically updates the hcache when new logs arrive.

It reduces report generation time.

It automatically updates the hcache when new logs arrive.

It provides diagnostics on report generation time.

It reduces the log insert lag rate.

It reduces report generation time.

What are offline logs on FortiAnalyzer?

Compressed logs, which are also known as archive logs, are considered to be offline logs.

When you restart FortiAnalyzer. all stored logs are considered to be offline logs.

Logs that are indexed and stored in the SQL database.

Logs that are collected from offline devices after they boot up.

Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.

Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with the same FortiAnalyzer devices at the other end.

Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.

Log fetching allows the administrator to fetch analytics logs from another FortiAnalyzer for redundancy.

Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.