Free FCP_FAZ_AN-7.6 sample questions

Correct answer: Custom log parsers are global objects and must be applied within the specific ADOM where the device is registered.

In FortiAnalyzer, while some objects are global, custom log parsers are often ADOM-specific or need to be explicitly applied to the device/ADOM context. If the parser is defined in 'root' but the device is in 'Customer_A', the parser logic does not automatically descend unless configured globally and associated correctly. The administrator must configure or import the parser into 'Customer_A' or ensure the scope allows it.

Correct answer: dstport!=443 and user~admin

In FortiAnalyzer search syntax: '!=' denotes 'not equal to', and '~' denotes 'contains' (partial match). Therefore, 'dstport!=443' filters out HTTPS traffic, and 'user~admin' looks for 'admin' anywhere in the user field. The 'and' operator combines them.

Correct answer: The playbook input variable for 'Source IP' is utilizing a trigger field that does not exist in the event log type that triggered the playbook.

Playbooks rely on variables passed from the trigger (Event or Incident). If the playbook is triggered by an event that lacks the specific 'srcip' field (or if the variable mapping points to a non-existent field in that log context), the connector action receives a null value and fails to execute the quarantine.

Correct answer: Create a single Event Handler with a specific correlation rule grouping by 'srcip', requiring both 'Login Failed' and 'Login Success' events in sequential order within a time window.

FortiAnalyzer Event Handlers support correlation rules. To detect a specific sequence (brute force success), you must create a correlation handler that looks for the specific sequence of sub-handlers (or log filters) occurring within a defined time window, grouped by the same Source IP. This creates a single event/incident for the entire attack chain.

Correct answers: It forwards logs to another FortiAnalyzer in Analyzer mode.; SQL database and Reporting features are disabled.

Collector mode is designed to receive logs from devices, compress/store them, and forward them to an Analyzer for indexing and reporting. It disables most analytic features like FortiView and Reporting to save resources for high-volume ingestion.

In Collector mode, the SQL database daemon (sqlplugind) is disabled, meaning no analytics, reports, or FortiView dashboards are available locally.

Correct answer: The report time period does not cover the timestamps of the logs found during the test.

Dataset testing usually queries a sample or a broad range. A scheduled report runs for a specific time frame (e.g., 'Last 24 Hours'). If the logs with 'user=marketing' exist outside that specific window, the report will be empty even if the query logic is correct.