FCP_FAZ_AD-7.4 Exam Training Practice Tests (Fortinet FCP

Question 1

Which two statements are true regarding high availability (HA) on FortiAnalyzer? (Choose two.)

A. All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector. B. FortiAnalyzer HA implementation is supported by many public cloud infrastructures such as AWS, Microsoft Azure, and Google Cloud. C. FortiAnalyzer HA can function without VRRP. and VRRP is required only if you have more than two FortiAnalyzer devices in a cluster. D. FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

Correct Answer: A,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

A. The detection engine classifies those logs as Suspicious B. The endpoint is marked as Compromised and. optionally, can be put in quarantine. C. FortiAnalyzer flags the associated host for further analysis. D. A new Infected entry is added for the corresponding endpoint.

Correct Answer: D

Question 3

By default, what happens when a log file reaches its maximum file size?

A. FortiAnalyzer stops logging. B. FortiAnalyzer rolls the active log by renaming the file. C. FortiAnalyzer overwrites the log files. D. FortiAnalyzer forwards logs to syslog.

Correct Answer: B

Question 4

Consider the CLI command:

What is the purpose of the command?

A. To add the MD5 hash value and authentication code B. To add a unique tag to each log to prove that it came from this FortiAnalyzer C. To add a log file checksum D. To encrypt log communications

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

How can you attach a report to an incident?

A. Saving it in JSON format, and then importing it B. From the properties of an existing incident C. By attaching it to an event handler alert D. By editing the settings of the desired report

Correct Answer: B

Question 6

When working with FortiAnalyzer reports, what is the purpose of a dataset?

A. To set the data included in templates B. To retrieve data from the database C. To provide the layout used for reports D. To define the chart type to be used

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

You need to upgrade your FortiAnalyzer firmware.
What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?

A. FortiGate uses the miglogd process to cache the logs B. The logfiled process stores logs in offline mode C. FortiAnalyzer uses log fetching to retrieve the logs when back online D. Logs are dropped

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

In a Fortinet Security Fabric, what can make an upstream FortiGate create traffic logs associated with sessions initiated on downstream FortiGate devices?

A. The downstream device cannot connect to FortiAnalyzer. B. The upstream FortiGate is configured to do NAT C. Log redundancy is configured in the fabric. D. The traffic destination is another FortiGate in the fabric.

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Which two parameters impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)

A. Total quota B. License type C. RAID level D. Disk size

Correct Answer: C,D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

A. Use real-time forwarding B. Use host name resolution C. Use DNS D. Use an NTP server

Correct Answer: D

Question 11

Refer to the exhibit.

Which image corresponds to the packet capture shown in the exhibit?

A. Option D B. Option B C. Option A D. Option C

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 12

Which two statements regarding the log synchronization states for HA on FortiAnalyzer are true? (Choose two.)

A. When Log Data Sync is turned on, the backup device reboots and then rebuilds the log database with the synchronized logs. B. By default, Log Data Sync is disabled on all backup devices. C. With Initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device. D. Log Data Sync provides real-time log synchronization to all backup devices.

Correct Answer: A,D

Fortinet FCP - FortiAnalyzer 7.4 Administrator - FCP_FAZ_AD-7.4 Exam Practice Test