Free FCP-FAZ-AD-7-4 sample questions

Correct answer: RAID 10 (1+0)

RAID 10 (a stripe of mirrors) provides the best write performance among the redundant RAID levels because it does not require parity calculations for writes. It also offers redundancy for a single disk failure within each mirrored pair. RAID 5 has a write penalty due to parity calculations. RAID 6 has an even higher write penalty. RAID 1 offers redundancy but not the performance benefits of striping found in RAID 10.

Correct answer: diagnose test application oftps 1

The `diagnose test application oftps 1` command specifically tests the connection and log upload status to the FortiAnalyzer. It provides detailed output about the OFTPS (Over Fortinet Transfer Protocol Secure) connection state, including connection status, encryption settings, and log upload statistics, which is ideal for this troubleshooting scenario. Other commands are less specific to the FortiAnalyzer logging process.

Correct answer: Create a custom dataset using a SQL query with a WHERE clause to filter for 'Sales' and 'Marketing' user groups. Then, create a new report with a chart based on this custom dataset.

Standard report charts have limited filtering capabilities. To achieve complex filtering, such as by specific LDAP user groups, the correct method is to first create a custom dataset. This involves writing a SQL query that selects the required log data and uses a WHERE clause to filter on the `usergroup` field. Once this dataset is created and tested, it can be used as the source for a custom chart within a new report.

Correct answer: Configure the RADIUS server to return the Fortinet-ADOM-Name vendor-specific attribute (VSA) with the names of the allowed ADOMs for each engineer.

When using a wildcard RADIUS administrator, FortiAnalyzer can dynamically assign ADOM access based on vendor-specific attributes (VSAs) returned by the RADIUS server during authentication. By configuring the RADIUS server to send the `Fortinet-ADOM-Name` VSA containing the specific ADOM(s) an engineer is authorized to access, the MSP can enforce granular, per-user ADOM restrictions without creating multiple accounts on the FortiAnalyzer itself.

Correct answers: In Advanced mode, VDOMs from the same FortiGate can be assigned to different ADOMs.; In Normal mode, all VDOMs from a single FortiGate must be assigned to the same ADOM.

A key distinction is how VDOMs are handled. In Normal mode, the FortiGate device is the unit of assignment, so all of its VDOMs must belong to one ADOM. Advanced mode provides more flexibility, allowing an administrator to assign individual VDOMs from a single physical FortiGate to multiple different ADOMs, which is essential for complex multi-tenant environments.

Correct answer: False

An ADOM's disk quota can be both increased and decreased after it has been set. This can be done through the GUI or CLI, provided there is available disk space. However, you cannot decrease the quota to a value less than the current amount of data stored in that ADOM.

Correct answer: The encryption password used when the backup was created

When a FortiAnalyzer configuration backup is encrypted, the password used for that encryption is mandatory for the restore process. Without the correct password, the FortiAnalyzer cannot decrypt the file and the restore operation will fail.

Correct answer: Disable HA preemption.

HA preemption is the feature that allows a device with a higher priority (the original primary) to automatically take over the primary role when it becomes available. By disabling preemption, the original primary unit will remain in a passive state after it reboots, allowing the current primary (the original secondary) to continue its role without interruption. This prevents the unwanted second failover.

Correct answer: Log files from a device with a different FortiOS major version are being received in an ADOM.

FortiAnalyzer maintains a specific SQL database schema for each FortiOS major version within an ADOM. If logs from a device with a different major FortiOS version (e.g., FortiOS 7.2 logs being sent to an ADOM configured for 7.4) are received, FortiAnalyzer will trigger a database rebuild to accommodate the different log format. This is a resource-intensive process and a common cause of performance issues.

Correct answer: To send logs in real-time to another FortiAnalyzer or a third-party SIEM/syslog server.

Log forwarding allows FortiAnalyzer to act as a central aggregator and then forward received logs to other systems. This is commonly used to integrate with a central corporate SIEM (like Splunk or QRadar) or to create a tiered logging architecture with multiple FortiAnalyzers (e.g., regional collectors forwarding to a central analyzer).