Question 30 - FCP_FAZ_AN-7.4 discussion

The objective is to create a filter that identifies all login attempts to the FortiAnalyzer web interface (GUI) coming from Laptop1 (IP 10.1.1.100) and excludes the admin user. This filter should match any user other than admin.

Filter Components Analysis:

Operation-login: This portion of the filter will target login actions specifically, which is correct for filtering login attempts.

performed_on==''GUI(10.1.1.100)': This indicates that the login attempt must occur on the GUI interface and originate from the specified IP, which matches Laptop1's IP address (10.1.1.100). This ensures that the filter only matches GUI logins from this specific device.

user!=admin: This part excludes logins by the admin user, meeting the requirement to capture only non-admin users.

Option Analysis:

Option A: Correctly specifies the Operation-login, performed_on==''GUI(10.1.1.100)', and user!=admin. This setup effectively filters login attempts to the GUI from Laptop1, excluding the admin user.

Option B: Uses the incorrect IP 10.1.1.120 in the performed_on filter, which does not match Laptop1's IP (10.1.1.100).

Option C: This option includes srcip==10.1.1.100 and dstip==10.1.1.210 but incorrectly specifies user==admin instead of user!=admin, which does not match the requirement to exclude admin users.

Option D: This option does not specify the performed_on field to restrict it to the GUI and only includes dstip (destination IP) without srcip. It also incorrectly uses user!-admin instead of the correct syntax user!=admin.

Conclusion:

Correct Answe r : A. Operation-login and performed_on==''GUI(10.1.1.100)' and user!=admin

This filter precisely captures the required conditions: login attempts from Laptop1 to the GUI interface by any user except admin.

FortiAnalyzer 7.4.1 documentation on log filters, syntax for login operations, and GUI login tracking.