Which two actions should an administrator take to vide Compromised Hosts on FortiAnalyzer? (Choose two.)

Enable device detection on the FotiGate device that are sending logs to FortiAnalyzer.

Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to fortiAnalyzer.

Enable device detection on the FotiGate device that are sending logs to FortiAnalyzer.

Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to fortiAnalyzer.

Make sure all endpoints are reachable by FortiAnalyzer.

Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

You need to move reports between two ADOMs.Which two statements are true? (Choose two.)

The ADOMs must be compatible types.

All charts and datasets associated with the report will be imported together.

The ADOMs must be compatible types.

The data and time will be appointed to the original report name to avoid conflicts.

All charts and datasets associated with the report will be imported together.

You need to convert the reports into templates first.

Which log will generate an event with the status Unhandled?

An AV log with action=quarantine.

A WebFilter log will action=dropped.

An AppControl log with action=blocked.

Exhibit. Which statement about the event displayed is correct?

The security risk was blocked or dropped.

The security event risk is considered open.

An incident was created from this event.

Which statement describes archive logs on FortiAnalyzer?

Logs compressed and saved in files with the .gz extension

Logs that are indexed and stored in the SQL database

Logs a FortiAnalyzer administrator can access in FortiView

Logs compressed and saved in files with the .gz extension

Logs previously collected from devices that are offline

Which statement about sending notifications with incident update is true?

You can send notifications to multiple external platforms.

Notifications can be sent only by email.

If you use multiple fabric connectors, all connectors must have the same settings.

Notifications can be sent only when an incident is updated or deleted.

Which statement about the FortiSOAR management extension is correct?

It requires a dedicated FortiSOAR device or VM.

It requires a FortiManager configured to manage FortiGate.

It runs as a docker container on FortiAnalyzer.

It requires a dedicated FortiSOAR device or VM.

It does not include a limited trial by default.

Which SQL query is in the correct order to query to database in the FortiAnalyzer?

SELECT devid FROM $log WHERE 'user'=' GROUP BY devid

SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'

SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid

SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid

SELECT devid FROM $log WHERE 'user'=' GROUP BY devid

When managing incidents on FortiAnlyzer, what must an analyst be aware of?

You can manually attach generated reports to incidents.

The status of the incident is always linked to the status of the attach event.

Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.

Incidents must be acknowledged before they can be analyzed.

Why must you wait for several minutes before you run a playbook that you just created?

FortiAnalyzer needs that time to parse the new playbook.

FortiAnalyzer needs that time to debug the new playbook.

FortiAnalyzer needs that time to back up the current playbooks.

FortiAnalyzer needs that time to ensure there are no other playbooks running.

Exhibit. What can you conclude about the output?

The message rate being lower that the log rate is normal.

Both messages and logs are almost finished indexing.

There are more traffic logs than event logs.

Exhibit. What can you conclude about these search results? (Choose two.)

They can be downloaded to a file.

They were searched by using text mode.

They can be downloaded to a file.

They are sortable by columns and customizable.

They are not available for analysis in FortiView.

They were searched by using text mode.

Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)

Send Alert through Fabric Connectors

Send Alert through FortiSIEM MEA

Exhibit. What can you conclude from this output?

The allocated disk quote to ADOM1 is 3 GB.

There is not disk quota allocated to quarantining files.

FGT_B is the Security Fabric root.

The allocated disk quote to ADOM1 is 3 GB.

Archive logs are using more space than analytic logs.

Which statement about SQL SELECT queries is true?

They can be used to purge log entries from the database.

They must be followed immediately by a WHERE clause.

They can be used to display the database schema.

Exhibit. What is the analyst trying to create?

The analyst is trying to create an output variable to be used in the playbook.

The analyst is trying to create a trigger variable to the used in the playbook.

The analyst is trying to create an output variable to be used in the playbook.

The analyst is trying to create a report in the playbook.

The analyst is trying to create a SOC report in the playbook.

Refer to the exhibit with partial output: Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observer the output as shown in the exhibit.Which statement about the export is true?

The export data type is zipped.

The option to include the connector was not selected.

Your colleague put a password on the export.

You find that as part of your role as an analyst, you frequently search log View using the same parameters.Instead of defining your search filters repeatedly, what can you do to save time?

Configure a marco and apply it to device groups.

An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer.Which item must configure on FortiAnalyzer so that emails are sent when the reports are generated?

Enable an output profile on the reports.

Enable the option to email all repots under the mail server.

Add a mailto:<email address> option within the report layouts.

Enable email notification under the report calendar.

Enable an output profile on the reports.

Which statement regarding macros on FortiAnalyzer is true?

Macros are useful in generating excel log files automatically based on the report settings.

Macros are predefined templates for reports and cannot be customized.

Macros are useful in generating excel log files automatically based on the report settings.

Macros are ADOM-specific and each ADOM type have unique macros relevant to that ADOM.

Macros are supported only on the FortiGate ADOMs.

After a generated a repot, you notice the information you were expecting to see in not included in it. However, you confirm that the logs are there:Which two actions should you perform? (Choose two.)

Check the time frame covered by the report.

Increase the report utilization quota.

After generating a report, you notice the information you where expecting to see is not included in it. However, you confirm that the logs are there.

Check the time frame covered by the report.

Increase the report utilization quota.

Which two statements regarding FortiAnalyzer operating modes are true? (Choose two.)

FortiAnalyzer runs in collector mode by default unless it is configured for HA.

A topology with FortiAnalyzeer devices running in both modes can improve their performance.

When running in collector mode, FortiAnalyzer can forward logs to a syslog server.

FortiAnalyzer runs in collector mode by default unless it is configured for HA.

You can create and edit reports when FortiAnalyzer is running in collector mode.

A topology with FortiAnalyzeer devices running in both modes can improve their performance.

As part of your analysis, you discover that an incident is a false positive.You change the incident status to Closed: False Positive.Which statement about your update is true?

The audit history log will be updated.

The corresponding event will be marked as mitigated.

The incident number will be changed

Exhibit. Laptop1 is used by several administrators to manage FotiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than admin'', and coming from Laptop1.Which filter will achieve the desired result?

Operation-login and performed_on==''GUI(10.1.1.100)' and user!=admin

Operation-login and performed_on==''GU (10.1.1.120)' and user!=admin

Operation-login and srcip== 10.1.1.100 and dstip==10.1.1.1.210 and user==admin

Operation-login and dstip==10.1.1.210 and user!-admin

Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

You can view playbook logs for all ADOMs in the root ADOM.

Event logs show system-wide information, whereas application logs are ADOM specific.

They are not supported in FortiView.

You can view playbook logs for all ADOMs in the root ADOM.

Event logs show system-wide information, whereas application logs are ADOM specific.

Event logs are available only in the root ADOM.

Refer to Exhibit: What does the data point at 21:20 indicate?

FortiAnalyzer is indexing logs faster than logs are being received.

The fortilogd daemon is ahead in indexing by one log.

The SQL database requires a rebuild because of high receive lag.

FortiAnalyzer is temporarily buffering received logs so older logs can be indexed first.

Refer to Exhibit: Client-1 is trying to access the internet for web browsing.All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured. All firewall policies have logging enabled. All web filter profiles are configured to log only violations.Which statement about the logging behavior for this specific traffic flow is true?

FGT B will create traffic logs and will create web filter logs if it detects a violation.

Only FGT-B will create traffic logs.

FGT-B will see the MAC address of FGT-A as the destination and notifies FGT-A to log this flow.

FGT B will create traffic logs and will create web filter logs if it detects a violation.

Only FGT-A will create web filter logs if it detects a violation.

What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

The generation time for reports is decreased.

FortiAnalyzer local cache is used to store generated reports.

The generation time for reports is decreased.

When new logs are received, the hard-cache data is updated automatically.

FortiAnalyzer local cache is used to store generated reports.

The size of newly generated reports is optimized to conserve disk space.

What is the purpose of running the command diagnose sql status sqlreportd?

To display the SQL query connections and hcache status

To view a list of scheduled reports

To list the current SQL processes running

To display the SQL query connections and hcache status

To identify the database log insertion status

Refer to the exhibit. What can you conclude about the output?

The log rate higher than the message rate is not normal.

The low indexing values require investigation.

The output is not ADOM specific.

There are more event logs than traffic logs.

The log rate higher than the message rate is not normal.

As part of your analysis, you discover that a Medium severity level incident is fully remediated.You change the incident status to Closed:Remediated.Which statement about your update is true?

The incident dashboard will be updated.

The incident can no longer be deleted.

The corresponding event will be marked as Mitigated.

The incident dashboard will be updated.

The incident severity will be lowered.

Which two statement regarding the outbreak detection service are true? (Choose two.)

It automatically downloads new event handlers and reports.

Outbreak alerts are available on the root ADOM only.

An additional license is required.

It automatically downloads new event handlers and reports.

Outbreak alerts are available on the root ADOM only.

New alerts are received by email.

You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but, so far, you have been uncuccessful.Which two tasks should you perform to investigate why you are having this issue? (Choose two.)

Open .gz log files in FortiView.

Rebuild the SQL database and check FortiView.

Open .gz log files in FortiView.

Rebuild the SQL database and check FortiView.

Fortinet FCP_FAZ_AN-7.4 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

Exhibit.

Fortinet FCP_FAZ_AN-7.4 image Question 1 129590 11272024002810000000

Based on the partial outputs displayed, which devices can be members of a FotiAnalyzer Fabric?

FortiAnalayzer1 and FortiAnalyzer3

FortiAnalyzer1 and FortiAnalyzer2

FortiAnalyzer2 and FortiAnalyzer3

All devices listed can be members.

Comment (0)

Fortinet FCP_FAZ_AN-7.4 Practice Test 1

Question

Fortinet FCP_FAZ_AN-7.4 Practice Tests

Practice Tests