FCP_FAZ_AN-7.6 practice questions 21–30

1. Question 21 · 50 in bank

   Select 2

   What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

   • AThe size of newly generated reports is optimized to conserve disk space.
   • BThe hcache data is updated automatically when new logs are received.
   • CThe report generation time is reduced.
   • DFortiAnalyzer local cache is used to store generated reports.

   Show answer

   Answer: BC

   Next question

2. Question 22 · 50 in bank

   Refer to the exhibit.

   

   Client-1 is trying to access the internet for web browsing. All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured. All firewall policies have logging enabled. All web filter profiles are configured to log only violations. Which statement about the logging behavior for this specific traffic flow is true?

   • AFGT-A will create all traffic logs except for security logs.
   • BFGT-A will create logs for web filter events only if FGT-B did not already detect a violation.
   • CFGT-A will see the MAC address of FGT-B in the packets and know it does not need to log this flow.
   • DBoth FGT-A and FGT-B will create traffic logs.

   Show answer

   Answer: C

   Next question

3. Question 23 · 50 in bank

   When there are no matching parsers for a device log, what does FortiAnalyzer do?

   • AStores the log but doesn’t normalize it
   • BApplies the generic SYSLOG parser
   • CDrops the log
   • DArchives the log for future analysis

   Show answer

   Answer: B

   Next question

4. Question 24 · 50 in bank

   How does FortiAnalyzer block indicators?

   • AIt uses a webhook to allow FortiGate to send the block list.
   • BIt uses a FortiClient EMS connector to send the block list.
   • CIt uses a FortiManager connector to send the block list.
   • DIt uses an automation script to update FortiGate with the block list.

   Show answer

   Answer: C

   Next question

5. Question 25 · 50 in bank

   What is the purpose of running the command diagnose sql status sqlreportd?

   • ATo identify the configuration status of all configured reports
   • BTo view a list of current reports that are running
   • CTo display the SQL query connections and hcache status
   • DTo list the current running SQL processes

   Show answer

   Answer: C

   Next question

6. Question 26 · 50 in bank

   Select 2

   Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

   • APlaybook logs for all ADOMs are in the root ADOM.
   • BApplication control logs are ADOM specific.
   • CLocal logs are not displayed in FortiView.
   • DEvent logs are available in the root ADOM.

   Show answer

   Answer: AB

   Next question

7. Question 27 · 50 in bank

   Refer to the exhibit.

   

   What is the analyst trying to create?

   • AA trigger variable to use in a playbook
   • BA SOC report in a playbook
   • CA report in a playbook
   • DAn output variable to use in a playbook

   Show answer

   Answer: D

   Next question

8. Question 28 · 50 in bank

   Select 3

   In a FortiAnalyzer Fabric deployment, which three modules from Fabric members are available for analysis on the supervisor? (Choose three.)

   • AReports
   • BPlaybooks
   • CLogs
   • DIndicators
   • EEvents

   Show answer

   Answer: ACE

   Next question

9. Question 29 · 50 in bank

   What is the purpose of running the command diagnose sql status sqlplugind?

   • ATo identify the database log insertion status
   • BTo list the current running SQL processes
   • CTo view the amount of time between log received and log inserted into the database
   • DTo display the SQL query connections and hcache status

   Show answer

   Answer: A

   Next question

10. Question 30 · 50 in bank

    Refer to the exhibit.

    

    A FortiAnalyzer analyst is customizing a SQL query to use in a report. Which SQL query should the analyst run to get the expected results?

    • ASELECT srcip AS "Source IP", dstport AS "Destination Port" FROM $log - WHERE $filter AND srcip = !'10.0.1.10' GROUP BY Source IP, Destination Port ORDER BY dstport DESC
    • BSELECT srcip AS "Source IP", dstport AS "Destination Port" FROM $log - WHERE $filter AND srcip = '10.0.1.10' GROUP BY srcip, dstport - ORDER BY dstport DESC
    • CSELECT srcip AS "Source IP", dstport AS "Destination Port" FROM $log - WHERE $filter AND Source IP != '10.0.1.10' GROUP BY srcip, dstport - ORDER BY dstport DESC
    • DSELECT srcip AS "Source IP", dstport AS "Destination Port" ORDER BY dstport DESC - GROUP BY srcip, dstport - FROM $log - WHERE $filter AND srcip = '10.0.1.10'

    Show answer

    Answer: B

    Next question

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

FCP_FAZ_AN-7.6 practice, question 21. 50 questions available.