[Aug 20, 2026] Lesson Brilliant PDF for the FCP_FAZ_AN-7.6 Tests Free Updated Today
Get New 2026 Valid Practice Fortinet Certified Professional FCP_FAZ_AN-7.6 Q&A - Testing Engine
Fortinet FCP_FAZ_AN-7.6 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
NEW QUESTION # 28
Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)
- A. Send SMS notification
- B. Send SNMP trap
- C. Send Alert through FortiSIEM MEA
- D. Send Alert through Fabric Connectors
Answer: B,D
Explanation:
Send Alert through Fabric Connectors: This method involves creating a Fabric Connector profile and selecting the option "Send Alert through Fabric Connectors" in the event handler notification settings. Notifications are then sent in JSON format to the configured endpoint, such as Microsoft Teams or other integrated platforms.
Send SNMP trap: You can configure SNMP traps to be sent when an event triggers an incident.
This involves setting the SNMP Trap IP address, community string, trap type, and protocol in the system's analytics or incident settings.
NEW QUESTION # 29
It is a best practice to upload FortiAnalyzer local logs to a remote server. Which three remote servers are supported for the upload? (Choose three.)
- A. UDP
- B. SCP
- C. FTP
- D. SFTP
- E. TCP
Answer: B,C,D
NEW QUESTION # 30
You find that as part of your role as an analyst, you frequently search log View using the same parameters.
Instead of defining your search filters repeatedly, what can you do to save time?
- A. Configure a data selector.
- B. Configure a marco and apply it to device groups.
- C. Configure a custom view.
- D. Configure a custom dashboard.
Answer: C
Explanation:
When you frequently use the same search parameters in FortiAnalyzer's Log View, setting up a reusable filter or view can save considerable time. Here's an analysis of each option:
* Option A - Configure a Custom Dashboard:
* Custom dashboards are useful for displaying a variety of widgets and summaries on network activity, performance, and threat data, but they are not designed for storing specific search filters for log views.
* Conclusion: Incorrect.
* Option B - Configure a Custom View:
* Custom views in FortiAnalyzer allow analysts to save specific search filters and configurations.
By setting up a custom view, you can retain your frequently used search parameters and quickly access them without needing to reapply filters each time. This option is specifically designed to streamline the process of recurring log searches.
* Conclusion: Correct.
* Option C - Configure a Data Selector:
* Data selectors are used to define specific types of data for FortiAnalyzer reports and widgets.
They are useful in reports but are not meant for saving and reusing log search parameters in Log View.
* Conclusion: Incorrect.
* Option D - Configure a Macro and Apply It to Device Groups:
* Macros in FortiAnalyzer are generally used for automation tasks, not for saving log search filters.
Applying macros to device groups does not fulfill the requirement of saving specific log view search parameters.
* Conclusion: Incorrect.
Conclusion:
* Correct Answer: B. Configure a custom view.
* Custom views allow you to save specific search filters, enabling quick access to frequently used parameters in Log View.
References:
FortiAnalyzer 7.4.1 documentation on creating and using custom views for log searches.
NEW QUESTION # 31
Which statement about the FortiSIEM management extension is correct?
- A. It can be installed as a dedicated VM.
- B. It requires a licensed FortiSIEM supervisor.
- C. Its use of the available disk space is capped at 50%.
- D. It allows you to manage the entire life cycle of a threat or breach.
Answer: B
NEW QUESTION # 32
Which SQL query is in the correct order to query the database in the FortiAnalyzer?
- A. SELECT devid FROM $log WHERE 'user'=' GROUP BY devid
- B. SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid
- C. SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid
- D. SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'
Answer: A
Explanation:
Exact Extract: Study Guide p.158: SELECT statements must follow clause order: SELECT, FROM, WHERE, GROUP BY, ORDER BY, LIMIT, OFFSET.
Technical Deep Dive: The correct answer is D because it is the only option that follows the expected SQL clause sequence closely enough: SELECT columns, FROM $log, WHERE condition, and GROUP BY. Even if the printed option appears to have a minor value/quotation issue, its clause order is the tested point. Option A places GROUP BY before WHERE, which is invalid. Option B lacks a proper selected column and malformed filtering syntax. Option C misspells SELECT and places WHERE before FROM, which breaks the required SQL structure.
NEW QUESTION # 33
What are the two methods you can use to send notifications when an event is generated by an event handler?
(Choose two answers)
- A. Send SMS notification
- B. Send SNMP trap.
- C. Send an alert through the FortiGuard server.
- D. Send an alert through Fabric connectors.
Answer: B,D
Explanation:
Exact Extract: Study Guide p.78: event handlers can use notification profiles; p.107 describes external notifications through Fabric connectors.
Technical Deep Dive: The correct answers are A and C. When an event handler generates an event, FortiAnalyzer can use notification mechanisms such as SNMP traps through notification profiles.
FortiAnalyzer also supports sending alerts to external platforms using configured Fabric connectors.
FortiGuard is not an alert delivery server in this workflow; it supplies threat intelligence and outbreak content.
SMS notification is not one of the event-handler notification methods described in the guide sections relevant to this question.
NEW QUESTION # 34
(Refer to the exhibit.
Which statement about the displayed event is correct? (Choose one answer)
- A. The security risk was blocked.
- B. The security event risk is from an application control log.
- C. The risk source is isolated.
- D. The security risk was dropped.
Answer: A
Explanation:
Exact Extract: Study Guide p.82: Mitigated means a security risk was blocked or dropped.
Technical Deep Dive: The correct answer is C. The exhibit shows a mitigated event with blocked web activity, so the accurate statement is that the security risk was blocked. A dropped action would also be a mitigated outcome, but the displayed event specifically indicates blocked. Option B describes Contained status, where the risk source is isolated. Option D is wrong because the event type shown is Web Filter, not application control. Option A is less precise than the exhibit because the action shown is blocked rather than dropped.
NEW QUESTION # 35
Exhibit.
Which statement about the event displayed is correct?
- A. An incident was created from this event.
- B. The risk source is isolated.
- C. The security risk was blocked or dropped.
- D. The security event risk is considered open.
Answer: D
Explanation:
Exact Extract: Study Guide p.82: " Unhandled " indicates the security event risk is considered open.
Technical Deep Dive: The displayed event is best interpreted as open/unhandled, so the correct answer is C.
In FortiAnalyzer, event status is not just a label; it tells the analyst whether the risk still requires action. A risk source being isolated would map to Contained, while traffic being blocked or dropped maps to Mitigated. An incident being created from an event is a separate workflow action and cannot be concluded from the event status alone unless the exhibit explicitly shows the incident linkage.
NEW QUESTION # 36
Refer to the exhibit. What can you conclude about the output?
- A. There are more traffic logs than event logs.
- B. The message rate being higher than the log rate is not normal.
- C. Both messages and logs are almost finished indexing.
- D. The output is ADOM specific.
Answer: C
Explanation:
The commands shown are:
diagnose fortilogd lograte → shows the log receiving/indexing rate
diagnose fortilogd msgrate → shows the message processing rate
In the output, both rates are very low over the last 5, 30, and 60 seconds. This indicates that FortiAnalyzer is almost finished processing (indexing) incoming logs and messages, with no significant backlog.
NEW QUESTION # 37
Refer to Exhibit:
What does the data point at 21:20 indicate?
- A. The SQL database requires a rebuild because of high receive lag.
- B. FortiAnalyzer is temporarily buffering received logs so older logs can be indexed first.
- C. FortiAnalyzer is indexing logs faster than logs are being received.
- D. The fortilogd daemon is ahead in indexing by one log.
Answer: C
Explanation:
Exact Extract: Study Guide p.141: Insert Rate is the rate logs are indexed; Receive Rate is the rate raw logs reach FortiAnalyzer.
Technical Deep Dive: The correct answer is A. At the indicated time, the insert-rate value is higher than the receive-rate value, which means FortiAnalyzer is indexing logs faster than new logs are arriving. This can happen when the database is catching up with previously received logs. Option B is too literal and unsupported; the graph shows rates, not a one-log daemon lead. Option C is wrong because a rebuild is not indicated by a single favorable rate point. Option D would apply when received logs are waiting because indexing is behind, which is the reverse condition.
NEW QUESTION # 38
Which two statements about exporting and importing playbacks are true? (Choose two.)
- A. You can import a playbook even if there is another one win the same name in the destination
- B. You can export only one playbook at a time.
- C. Playbooks can so imported 10 a different FortiAnayzer device, but only if the connectors already exist
- D. A playbook that was disabled when it was exported mil be disabled when it is imported.
Answer: C,D
NEW QUESTION # 39
Exhibit. What can you conclude about the output?
- A. There are more traffic logs than event logs.
- B. The output is ADOM specific
- C. The message rate being lower that the log rate is normal.
- D. Both messages and logs are almost finished indexing.
Answer: C
NEW QUESTION # 40
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?
- A. The endpoint is marked as Compromised and, optionally, can be put in quarantine.
- B. FortiAnalyzer flags the associated host for further analysis.
- C. The detection engine classifies those logs as Suspicious.
- D. A new infected entry is added for the corresponding endpoint under Compromised Hosts.
Answer: D
NEW QUESTION # 41
Why must you wait for several minutes before you run a playbook that you just created?
- A. FortiAnalyzer needs that time to back up the current playbooks.
- B. FortiAnalyzer needs that time to ensure there are no other playbooks running.
- C. FortiAnalyzer needs that time to debug the new playbook.
- D. FortiAnalyzer needs that time to parse the new playbook.
Answer: D
NEW QUESTION # 42
Which statement about automation connectors in FortiAnalyzer is true?
- A. The local connector becomes available after you connectors are displayed.
- B. An ADOM with the Fabric type comes with multiple connectors configured.
- C. The actions available with FortiOS connectors are determined by automation rules configured on FortiGate.
- D. The local connector becomes available after you configured any external connector.
Answer: C
Explanation:
For example, the FortiOS connector will be listed as soon as the first FortiGate device is added to FortiAnalyzer. However, in order to see the actions related to that FortiOS connector, you must enable an automation rule using the Incoming Webhook Call trigger on the FortiGate side.
NEW QUESTION # 43
Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?
- A. Outbreak alert services
- B. FortiView Monitor
- C. Incidents dashboard
- D. Threat hunting
Answer: D
Explanation:
Threat hunting consists of proactively searching for suspicious or potentially risky network activity in your environment. The proactive approach will help the analyst find any threats that might have eluded detection by the current security solutions or configurations.
NEW QUESTION # 44
An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer.
Which item must configure on FortiAnalyzer so that emails are sent when the reports are generated?
- A. Enable the option to email all repots under the mail server.
- B. Enable email notification under the report calendar.
- C. Enable an output profile on the reports.
- D. Add a mailto:<email address> option within the report layouts.
Answer: C
Explanation:
To ensure that reports generated by FortiAnalyzer are automatically sent to an email inbox, you need to set up an output profile for the reports. Output profiles specify where and how reports should be delivered, including the option to send them via email.
* Option A - Enable the Option to Email All Reports Under the Mail Server:
* The mail server configuration allows FortiAnalyzer to send emails but does not automatically enable email distribution for reports. This setting alone does not specify which reports to send or to whom.
* Conclusion: Incorrect.
* Option B - Add a mailto:<email address> Option Within the Report Layouts:
* Adding an email address within the report layout is not a standard configuration option for report distribution. Report layouts define the format and content of the report but not its distribution method.
* Conclusion: Incorrect.
* Option C - Enable Email Notification Under the Report Calendar:
* The report calendar is used to schedule when reports are generated. While it triggers report generation at specific times, it does not handle email distribution. Emailing reports requires a configured output profile.
* Conclusion: Incorrect.
* Option D - Enable an Output Profile on the Reports:
* An output profile can be configured on FortiAnalyzer to define delivery options, including emailing the report to specified recipients. This setup ensures that every time a report is generated according to the schedule, it is automatically emailed to the configured address.
* Conclusion: Correct.
Conclusion:
* Correct Answer: D. Enable an output profile on the reports.
* Configuring an output profile is the correct way to set up automatic email distribution of generated reports in FortiAnalyzer.
References:
FortiAnalyzer 7.4.1 documentation on configuring output profiles and report distribution settings.
NEW QUESTION # 45
(Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)? (Choose two answers))
- A. IP address
- B. Application category
- C. URL
- D. Policy ID
Answer: A,C
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
The FortiAnalyzer study guide explains that IOC identification is performed by comparing relevant log fields against the FortiGuard threat database. Specifically, it states: "Depending on the log type, FortiAnalyzer identifies possible compromised hosts by checking the threat database against the log's IP address, domain, and URL." From this extract, two of the explicit parameters FortiAnalyzer uses for IOC detection are IP address and URL (both listed verbatim). Policy ID and application category are not part of the IOC matching parameters described for threat-database checks in this context.
This is further consistent with the study guide's definition of indicator types, which states: "There are three types of indicators: IP addresses, URLs, and domains."
NEW QUESTION # 46
Which two statements about playbook execution are true? (Choose two)
- A. You can <un the default debugging playbook to investigate playbook errors.
- B. Even I the playbook status is Failed, individual tasks may have succeeded.
- C. FortiAnalyzer will not commit changes made by a Failed playbook
- D. The Playbook Monitor provides troubleshooting logs
Answer: C,D
NEW QUESTION # 47
You want to design a playbook that runs a series of tasks in parallel.
How can you accomplish this goal?
- A. Create multiple triggers and link one task to each trigger
- B. Set up multiple connectors
- C. Connect a trigger or task to multiple tasks.
- D. Queue the same playbook to run multiple times
Answer: C
Explanation:
In FortiAnalyzer playbooks, parallel execution is achieved by branching. When you connect one trigger or task to multiple subsequent tasks, those tasks run in parallel rather than sequentially.
NEW QUESTION # 48
You find that as part of your role as an analyst, you frequently search log View using the same parameters.
Instead of defining your search filters repeatedly, what can you do to save time?
- A. Configure a data selector.
- B. Configure a marco and apply it to device groups.
- C. Configure a custom view.
- D. Configure a custom dashboard.
Answer: C
Explanation:
When you frequently use the same search parameters in FortiAnalyzer's Log View, setting up a reusable filter or view can save considerable time.
Option B - Configure a Custom View:
Custom views in FortiAnalyzer allow analysts to save specific search filters and configurations. By setting up a custom view, you can retain your frequently used search parameters and quickly access them without needing to reapply filters each time. This option is specifically designed to streamline the process of recurring log searches.
NEW QUESTION # 49
What are the two methods you can use to send notifications when an event is generated by an event handler?
(Choose two answers)
- A. Send SMS notification
- B. Send SNMP trap.
- C. Send an alert through the FortiGuard server.
- D. Send an alert through Fabric connectors.
Answer: B,D
Explanation:
Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
FortiAnalyzer event handlers support alerting when a rule match generates an event. The study guide states that, for an event handler, "You can select a notification profile to send alerts whenever an event is generated by the handler." In FortiAnalyzer, notification profiles are the mechanism used to deliver alerts outward (for example, via an SNMP trap), which directly aligns with option A.
In addition, FortiAnalyzer supports sending notifications to external platforms through integrations: "You can configure FortiAnalyzer to send a notification to external platforms using preconfigured Fabric connectors." This validates the use of Fabric connectors as a notification delivery method, aligning with option C.
Option B is not a notification delivery method for event-handler-generated alerts in the workflow described (FortiGuard is used for threat intelligence/enrichment rather than relaying alerts). Option D is not presented in the study guide's described notification mechanisms for event-handler alerting in the referenced sections.
NEW QUESTION # 50
Which log will generate an event with the status Contained?
- A. An IPS log with action=pass.
- B. An AppControl log with action=blocked.
- C. A WebFilter log with action=dropped.
- D. An AV log with action=quarantine.
Answer: D
Explanation:
Exact Extract: Study Guide p.82: Contained means the risk source is isolated; antivirus quarantine is the example.
Technical Deep Dive: The correct answer is A. An AV log with action=quarantine indicates the detected file or object has been isolated, so FortiAnalyzer classifies the event status as Contained. An IPS action=pass is Unhandled because the risk was not stopped. WebFilter dropped and AppControl blocked are enforcement outcomes, so they align with Mitigated rather than Contained. The distinction matters in SOC triage because Contained still deserves review, but the immediate source/object has already been isolated.
NEW QUESTION # 51
Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)?
(Choose two.)
- A. IP address
- B. Application category
- C. URL
- D. Policy ID
Answer: A,C
Explanation:
FortiAnalyzer identifies IOCs by matching observable threat artifacts such as IP addresses and URLs, which are standard IOC indicators used for correlation across logs and threat intelligence sources.
NEW QUESTION # 52
Exhibit. Based on the partial outputs displayed, which devices can be members of a FotiAnalyzer Fabric?
- A. FortiAnalayzer1 and FortiAnalyzer3
- B. FortiAnalyzer2 and FortiAnalyzer3
- C. All devices listed can be members.
- D. FortiAnalyzer1 and FortiAnalyzer2
Answer: C
Explanation:
In a FortiAnalyzer Fabric, devices can participate in a cluster or grouping if they meet specific compatibility criteria. Based on the outputs provided, let's evaluate these criteria:
Version Compatibility:
All three devices, FortiAnalyzer1, FortiAnalyzer2, and FortiAnalyzer3, are running version v7.4.1- build0238, which is the same across the board. This version alignment is crucial because FortiAnalyzer Fabric requires that devices run compatible firmware versions for seamless communication and management.
Platform Type and Configuration:
All three devices are configured as Standalone in the HA mode, which allows them to operate independently but does not restrict their participation in a FortiAnalyzer Fabric. Each device is also on the FAZVM64-KVM platform type, ensuring hardware compatibility.
Global Settings:
Key settings such as adm-mode, adm-status, and adom-mode are consistent across all devices (adm-mode: normal, adm-status: enable, adom-mode: normal), which aligns with requirements for fabric integration and role assignment flexibility.
Each device also has the log-forward-cache-size set, which is relevant for forwarding logs within a fabric environment.
Based on the above analysis, all devices (FortiAnalyzer1, FortiAnalyzer2, and FortiAnalyzer3) meet the requirements to be part of a FortiAnalyzer Fabric. Reference: FortiAnalyzer 7.4.1 documentation outlines that devices within a FortiAnalyzer Fabric should be on the same or compatible firmware versions and hardware platforms, and they must be configured for integration. Given that all devices match the version, platform, and mode criteria, they can all be part of the FortiAnalyzer Fabric.
NEW QUESTION # 53
......
FCP_FAZ_AN-7.6 Dumps PDF - 100% Passing Guarantee: https://passcertification.preppdf.com/Fortinet/FCP_FAZ_AN-7.6-prepaway-exam-dumps.html