Get 2026 Free Fortinet FCP_FAZ_AN-7.6 Exam Practice Materials Collection
Get Latest and 100% Accurate FCP_FAZ_AN-7.6 Exam Questions
NEW QUESTION # 30
An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer. Which item must configure on FortiAnalyzer so that emails are sent when the reports are generated?
- A. Add a mailto:<email address> option within the report layouts.
- B. Enable email notification under the report calendar.
- C. Enable the option to email all repots under the mail server.
- D. Enable an output profile on the reports.
Answer: D
Explanation:
To ensure that reports generated by FortiAnalyzer are automatically sent to an email inbox, you need to set up an output profile for the reports. Output profiles specify where and how reports should be delivered, including the option to send them via email.
Option D - Enable an Output Profile on the Reports:
An output profile can be configured on FortiAnalyzer to define delivery options, including emailing the report to specified recipients. This setup ensures that every time a report is generated according to the schedule, it is automatically emailed to the configured address.
NEW QUESTION # 31
In your role as an analyst, you frequently search the log view using the same parameters.
Instead of defining the same search filters repeatedly, what can you do to save time?
- A. Configure a chart template and apply it to device groups.
- B. Configure a custom view.
- C. Configure a report template.
- D. Configure a custom dashboard.
Answer: B
Explanation:
In FortiAnalyzer, a custom view allows you to save frequently used search filters and parameters in Log View. This enables you to quickly reuse the same search criteria without redefining the filters each time, saving significant time during log analysis.
NEW QUESTION # 32
Which three modules does FortiAnalyzer automatically download content from with a valid SOC Automation service license? (Choose three.)
- A. Report templates
- B. Incident templates
- C. Playbooks
- D. Event handlers
- E. Active Connectors
- F. Dashboards
Answer: B,C,D
Explanation:
With a valid SOC Automation service license, FortiAnalyzer receives automatic updates for these specific content types:
Event handlers: These define how FortiAnalyzer processes and responds to specific security events.
Playbooks: These are automated workflows used to investigate and respond to security incidents.
Incident templates: These provide predefined structures for classifying and managing security incidents.
NEW QUESTION # 33
After a generated a repot, you notice the information you were expecting to see in not included in it. However, you confirm that the logs are there:
Which two actions should you perform? (Choose two.)
- A. Test the dataset.
- B. Disable auto-cache.
- C. Check the time frame covered by the report.
- D. Increase the report utilization quota.
Answer: A,C
Explanation:
When a generated report does not include the expected information despite the logs being present, there are several factors to check to ensure accurate data representation in the report.
Option A - Check the Time Frame Covered by the Report:
Reports are generated based on a specified time frame. If the time frame does not encompass the period when the relevant logs were collected, those logs will not appear in the report.
Ensuring the time frame is correctly set to cover the intended logs is crucial for accurate report content.
Option D - Test the Dataset:
Datasets in FortiAnalyzer define which logs and fields are pulled into the report. If a dataset is misconfigured, it could exclude certain logs. Testing the dataset helps verify that the correct data is being pulled and that all required logs are included in the report parameters.
NEW QUESTION # 34
As part of your analysis, you discover that an incident is a false positive.
You change the incident status to Closed: False Positive.
Which statement about your update is true?
- A. The corresponding event will be marked as mitigated.
- B. The incident number will be changed
- C. The incident will be deleted.
- D. The audit history log will be updated.
Answer: D
Explanation:
Exact Extract: Study Guide p.105-p.106: incident analysis includes audit history, and incident settings/status should be kept up to date.
Technical Deep Dive: The correct answer is A. When an analyst changes an incident status to Closed: False Positive, FortiAnalyzer records the action in the incident audit history. That preserves accountability and allows other analysts to see what changed and why. The corresponding event is not automatically reclassified as mitigated. The incident is not deleted just because it is closed. The incident number remains stable because it is the identifier used to track the case through its lifecycle.
NEW QUESTION # 35
Which SQL query is in the correct order to query the database in the FortiAnalyzer?
- A. SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid
- B. SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid
- C. SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'
- D. SELECT devid FROM $log WHERE 'user'=' GROUP BY devid
Answer: D
Explanation:
Exact Extract: Study Guide p.158: SELECT statements must follow clause order: SELECT, FROM, WHERE, GROUP BY, ORDER BY, LIMIT, OFFSET.
Technical Deep Dive: The correct answer is D because it is the only option that follows the expected SQL clause sequence closely enough: SELECT columns, FROM $log, WHERE condition, and GROUP BY. Even if the printed option appears to have a minor value/quotation issue, its clause order is the tested point. Option A places GROUP BY before WHERE, which is invalid. Option B lacks a proper selected column and malformed filtering syntax. Option C misspells SELECT and places WHERE before FROM, which breaks the required SQL structure.
NEW QUESTION # 36
Refer to the exhibit with partial output:
Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observer the output as shown in the exhibit.
Which statement about the export is true?
- A. The playbook is misconfigured.
- B. The option to include the connector was not selected.
- C. Your colleague put a password on the export.
- D. The export data type is zipped.
Answer: D
Explanation:
Exact Extract: Study Guide p.217: zipped/base64 encoded JSON is one of the playbook export data types.
Technical Deep Dive: The correct answer is A. The exhibit shows encoded data rather than readable plain-text JSON, which indicates the playbook was exported in the zipped/base64 encoded format. That does not mean the playbook is misconfigured. It also does not prove connectors were excluded; connector inclusion is a separate export option. There is no indication of password protection. The key visual clue is that the export contains encoded data plus integrity information instead of a readable JSON playbook structure.
NEW QUESTION # 37
Which log will generate an event with the status Contained?
- A. An AV log with action=quarantine.
- B. An AppControl log with action=blocked.
- C. A WebFilter log will action=dropped.
- D. An IPS log with action=pass.
Answer: A
NEW QUESTION # 38
Which three types of logs does FortiAnalyzer collect from FortiGate devices for normalization?
(Choose three.)
- A. Firewall
- B. System
- C. Traffic
- D. Event
- E. Security
Answer: B,C,D
Explanation:
FortiAnalyzer collects and normalizes System logs for device and operational activity, Traffic logs for session and connection details, and Event logs for security and system-related events generated by FortiGate devices.
NEW QUESTION # 39
Why must you wait for several minutes before you run a playbook that you just created?
- A. FortiAnalyzer needs that time to parse the new playbook.
- B. FortiAnalyzer needs that time to debug the new playbook.
- C. FortiAnalyzer needs that time to ensure there are no other playbooks running.
- D. FortiAnalyzer needs that time to back up the current playbooks.
Answer: A
Explanation:
Exact Extract: Study Guide p.210: after creating a new playbook, FortiAnalyzer needs a few minutes to parse it.
Technical Deep Dive: The correct answer is A. FortiAnalyzer must parse the newly created playbook before it can execute reliably. Parsing checks the playbook definition and prepares it for execution by the automation engine. Option B is wrong because FortiAnalyzer is not automatically debugging the playbook; debugging happens after a failed or problematic run. Option C is unrelated to playbook creation. Option D is wrong because FortiAnalyzer can track multiple jobs; the wait is about playbook parsing, not waiting for all other playbooks to stop.
NEW QUESTION # 40
After generating a report, you notice the information you were expecting to see is not included in it. However, you confirm that the logs are there.
Which two actions should you perform? (Choose two.)
- A. Test the dataset.
- B. Disable auto-cache.
- C. Check the time frame covered by the report.
- D. Increase the report utilization quota.
Answer: A,C
Explanation:
Check the time frame covered by the report: If the report's time range does not match the period of the available logs, the expected information will not appear.
Test the dataset: Testing the dataset ensures that the query used to extract log information is correct and retrieving the intended data for the report.
NEW QUESTION # 41
Which two statements about local logs on FortiAnalyzer are true? (Choose two.)
- A. They are not supported in FortiView.
- B. You can view playbook logs for all ADOMs in the root ADOM.
- C. Event logs are available only in the root ADOM.
- D. Event logs show system-wide information, whereas application logs are ADOM specific.
Answer: B,D
Explanation:
Playbook logs, which relate to automated incident response actions, can be viewed centrally in the root ADOM, allowing visibility across all ADOMs.
Event logs on FortiAnalyzer typically provide system-wide information applicable to the entire FortiAnalyzer unit, while application logs are specific to each ADOM, reflecting the logs related to devices and activities managed within that ADOM.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/208717/enabling-and- disabling-the-adom-feature
NEW QUESTION # 42
Refer to Exhibit:
What does the data point at 21:20 indicate?
- A. FortiAnalyzer is indexing logs faster than logs are being received.
- B. The SQL database requires a rebuild because of high receive lag.
- C. FortiAnalyzer is temporarily buffering received logs so older logs can be indexed first.
- D. The fortilogd daemon is ahead in indexing by one log.
Answer: A
Explanation:
Exact Extract: Study Guide p.141: Insert Rate is the rate logs are indexed; Receive Rate is the rate raw logs reach FortiAnalyzer.
Technical Deep Dive: The correct answer is A. At the indicated time, the insert-rate value is higher than the receive-rate value, which means FortiAnalyzer is indexing logs faster than new logs are arriving. This can happen when the database is catching up with previously received logs. Option B is too literal and unsupported; the graph shows rates, not a one-log daemon lead. Option C is wrong because a rebuild is not indicated by a single favorable rate point. Option D would apply when received logs are waiting because indexing is behind, which is the reverse condition.
NEW QUESTION # 43
(Refer to the exhibit.
Which statement about the displayed event is correct? (Choose one answer)
- A. The security event risk is considered open.
- B. An incident was created from this event.
- C. The risk source is isolated.
- D. The security risk was escalated.
Answer: A
Explanation:
Exact Extract: Study Guide p.82: Unhandled means the security event risk is open and not mitigated or contained.
Technical Deep Dive: The correct answer is D. The exhibit shows the event status as Unhandled, which FortiAnalyzer defines as an open security event risk. That means the analyst should not treat the event as already blocked, quarantined, or isolated. Option A cannot be concluded because incident creation is a separate escalation action. Option B maps to Contained, not Unhandled. Option C uses a workflow term that is not the status shown in the event.
NEW QUESTION # 44
You are trying to configure a task in the playbook editor to run a report.
However, when you try to select the desired playbook, you do to see it listed.
What is the reason?
- A. The report has no result and must be reconfigured.
- B. You must create a trigger to run the report first.
- C. The playbook is currently running and will be available after it is finished.
- D. The report does not have auto-cache and extended log filtering enabled.
Answer: B
NEW QUESTION # 45
Which statement regarding macros on FortiAnalyzer is true?
- A. Macros are useful in generating excel log files automatically based on the report settings.
- B. Macros are predefined templates for reports and cannot be customized.
- C. Macros are supported only on the FortiGate ADOMs.
- D. Macros are ADOM-specific and each ADOM type have unique macros relevant to that ADOM.
Answer: D
Explanation:
Exact Extract: Study Guide p.173: macros represent dataset queries in abbreviated form, and macros are ADOM-specific.
Technical Deep Dive: The correct answer is C. FortiAnalyzer macros are not Excel-generation shortcuts and are not fixed templates. A macro is an abbreviated way to insert data extracted by a dataset query into a report without using a chart. Because reports, libraries, and related definitions are separated by ADOM, macros are ADOM-specific. Option A is wrong because custom macros can be created. Option B invents an Excel- specific behavior not described by the guide. Option D is too restrictive because macros are not limited only to FortiGate ADOMs.
NEW QUESTION # 46
Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)?
(Choose two.)
- A. IP address
- B. Policy ID
- C. URL
- D. Application category
Answer: A,C
NEW QUESTION # 47
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?
- A. The detection engine classifies those logs as Suspicious.
- B. FortiAnalyzer flags the associated host for further analysis.
- C. The endpoint is marked as Compromised and, optionally, can be put in quarantine.
- D. A new infected entry is added for the corresponding endpoint under Compromised Hosts.
Answer: D
Explanation:
The breach detection engine on FortiAnalyzer uses Fortiguard Threat DEtection Service (TDS) intelligence to analyze web filter logs for breach detection...When the threat match is found, a threat score is given to the end user based on the overall ranking score from TDS.
NEW QUESTION # 48
What is included in the disk quota for each ADOM on the FortiAnalyzer?
- A. Raw logs, archive files, SQL database tables
- B. Raw logs and archive files
- C. Archive logs and analytics logs
- D. SQL tables and archive files
Answer: C
NEW QUESTION # 49
Which statement about SQL SELECT queries is true?
- A. They can be used to purge log entries from the database.
- B. They must be followed immediately by a WHERE clause.
- C. They can be used to display the database schema.
- D. They are not used in macros.
Answer: D
Explanation:
FortiAnalyzer and similar systems often use macros for automated functions or specific query- based tasks. SELECT queries are typically not included in macros because macros focus on procedural or repetitive actions, rather than simple data retrieval.
NEW QUESTION # 50
......
Maximum Grades By Making ready With FCP_FAZ_AN-7.6 Dumps: https://passcollection.actual4labs.com/Fortinet/FCP_FAZ_AN-7.6-actual-exam-dumps.html