Fortinet FCP_FAZ_AN-7.4 - FCP - FortiAnalyzer 7.4 Analyst Exam
Page: 3 / 11
Total 54 questions
Question #11 (Topic: Exam A)
What is the purpose of using data selectors when configuring event handlers?
A. They are common filters that can be applied simultaneously to all event handlers.
B. They filter the types of logs that FortiAnalyzer can accept from registered devices.
C. They apply their filter criteria to the entire event handler so that you don't have to configure the same criteria in the individual rules.
D. They download new filters that can be used in event handlers.
Answer: C
Question #12 (Topic: Exam A)
Refer to the exhibit.

What does the data point at 12:20 indicate?

What does the data point at 12:20 indicate?
A. FortiAnalyzer is using its cache to avoid dropping logs.
B. The log insert lag time is increasing.
C. The performance of FortiAnalyzer is below the baseline.
D. The sqlplugind service is caught up with new logs.
Answer: B
Question #13 (Topic: Exam A)
Which two statements about playbook execution are true? (Choose two.)
A. Even if the playbook status is Failed, individual tasks may have succeeded.
B. FortiAnalyzer will not commit changes made by a Failed playbook.
C. You can run the default debugging playbook to investigate playbook errors.
D. The Playbook Monitor provides troubleshooting logs.
Answer: AD
Question #14 (Topic: Exam A)
View the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

What is the purpose of using the Chart Builder feature on FortiAnalyzer?
A. To add a new chart under FortiView to be used in new reports
B. To build a dataset and chart based on the filtered search results
C. To build a chart automatically based on the top 100 log entries
D. To add charts directly to generate reports in the current ADOM
Answer: B
Question #15 (Topic: Exam A)
Which statement correctly describes one difference between templates and reports?
A. Templates can be cloned, but reports cannot be cloned.
B. Templates are mapped to device groups, while reports are mapped to ADOMs.
C. Reports support macros, but templates do not.
D. Reports provide more configuration options than templates.
Answer: D