Which two statements are true regarding ADOM modes? (Choose two.)

In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

You can only change ADOM modes through CLI.

In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM.

In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

A new Infected entry is added for the corresponding endpoint.

The endpoint is marked as Compromised and. optionally, can be put in quarantine.

FortiAnalyzer flags the associated host for further analysis.

A new Infected entry is added for the corresponding endpoint.

The detection engine classifies those logs as Suspicious

Refer to the exhibit. Based on the partial outputs displayed, which devices can be members of a FortiAnalyzer Fabric?

All devices listed can be members

FortiAnalyzerl and FortiAnalyzer3

FortiAnalyzer1 and FortiAnalyzer2

All devices listed can be members

FortiAnalyzer2 and FortiAnalyzer3

Refer to the exhibit. What does the data point at 12:20 indicate?

The sqlplugind service is caught up with new logs.

The performance of FortiAnalyzer is below the baseline.

FortiAnalyzer is using its cache to avoid dropping logs.

The log insert lag time is increasing.

The sqlplugind service is caught up with new logs.

Which statement about the FortiSIEM management extension is correct?

It requires a licensed FortiSIEM supervisor.

Allows you to manage the entire life cycle of a threat or breach.

Its use of the available disk space is capped at 50%.

It requires a licensed FortiSIEM supervisor.

It can be installed as a dedicated VM.

What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

When new logs are received, the hard-cache data is updated automatically.

The generation time for reports is decreased.

The size of newly generated reports is optimized to conserve disk space.

FortiAnalyzer local cache is used to store generated reports.

When new logs are received, the hard-cache data is updated automatically.

The generation time for reports is decreased.

Why must you wait for several minutes before you run a playbook that you just created?

FortiAnalyzer needs that time to back up the current playbooks.

FortiAnalyzer needs that time to parse the new playbook.

FortiAnalyzer needs that time to back up the current playbooks.

FortiAnalyzer needs that time to ensure there are no other playbooks running.

FortiAnalyzer needs that time to debug the new playbook.

Which statement describes online logs on FortiAnalyzer?

Logs that can be used to create reports

Logs that reached a specific size and were rolled over

Logs that can be used to create reports

Logs that can be viewed using Log Browse

Logs that are saved to disk, compressed, and available in FortiView

How can you attach a report to an incident?

From the properties of an existing incident

By attaching it to an event handler alert

By editing the settings of the desired report

From the properties of an existing incident

Saving it in JSON format, and then importing it

What is the purpose of the FortiAnalyzer command execute format disk?

To erase all device settings and images, databases, and log data from the disk, but preserve the IP and routing info.

To reset all settings from flash except the current IP addresses and routes.

To erase all device settings and images, databases, and log data from the disk, but preserve the IP and routing info.

To perform a low-level format of the disk overwriting the hard disk with random data.

To reset to factory default settings from flash.

Which statement regarding the FortiAnalyzer Fabric is true?

The Fabric supervisor collects logs from the Fabric members.

Logging devices can register to the Fabric supervisor or to Fabric members.

Administrators can create new incidents from the Fabric supervisor.

What are analytics logs on FortiAnalyzer?

Logs that are indexed and stored in the SQL database.

Logs that are saved in the active log file with the. log extension.

Logs that are compressed and saved to a log file with the, gz extension.

Logs that are rolled over when the log file reaches a specific size.

Logs that are indexed and stored in the SQL database.

Which two statements are true about FortiAnalyzer log forwarding modes? (Choose two.)

Aggregation mode requires two FortiAnalyzer devices.

Forwarding mode forwards logs to other FortiAnalyzer devices syslog servers, or CEF servers.

Both modes, forwarding and aggregation send logs as soon as they are received.

Aggregation mode requires two FortiAnalyzer devices.

Forwarding mode forwards logs to other FortiAnalyzer devices syslog servers, or CEF servers.

Forwarding mode requires configuration on the server side.

Which two statements about creating ADOMs are true1? (Choose two.)

FortiAnalyzer creates default ADOMs when ADOMs are enabled.

The ADOM type you create must match the device type you are planning to add.

An administrator with the default standard_User profile can create ADOMs.

Disk quotas can be defined per device inside the ADOM.

FortiAnalyzer creates default ADOMs when ADOMs are enabled.

The ADOM type you create must match the device type you are planning to add.

Which statement is true about ADOMs?

A fabric ADOM can include all the device types supported by FortiAnalyzer.

When a FortiAnalyzer Fabric is implemented the default ADOM mode is set to advanced.

In normal mode, you cannot change the disk quota of the ADOM after its creation.

You can change the ADOM mode only through the GUI.

Fortinet FCP_FAZ_AD-7.4 Practice Test 5 - Free Online Exam Prep & Questions

An administrator has configured the following settings:

config system fortiview settings

set resolve-ip enable

end

What is the significance of executing this command?

Become a Premium Member for full access

Unlock Premium Member

Fortinet FCP_FAZ_AD-7.4 Practice Test 5

Question

Fortinet FCP_FAZ_AD-7.4 Practice Tests

Practice Tests