Fortinet FCP_FAZ_AN-7.6 - Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst Exam
Page: 3 / 13
Total 63 questions
Question #11 (Topic: Exam A)
After generating a report you notice that the information you were expecting to see is not included in that report. However, you confirm that the logs are there.
Which two actions must you perform? (Choose two.)
Which two actions must you perform? (Choose two.)
A. Test the dataset.
B. Check the time frame covered by the report.
C. Increase the report utilization quota.
D. Enable auto-cache.
Answer: AB
Question #12 (Topic: Exam A)
When managing incidents on FortiAnalyzer, which fact must an analyst be aware of?
A. The status of the incident is always linked to the status of the attached event.
B. A playbook can be run from the Incidents page.
C. Incidents must be acknowledged before they can be analyzed.
D. Indicators found on the Incidents page can be enriched only from the Indicators page.
Answer: B
Question #13 (Topic: Exam A)
You are trying to configure a task in the playbook editor to run a report. However, when you try to select the desired report you do not see it listed.
What is the reason?
What is the reason?
A. The report template needs to be switched to one that is available for playbooks.
B. You must create a trigger to run the report first.
C. The playbook is currently running and the report will be available after it is finished.
D. The report does not have auto-cache and extended log filtering enabled.
Answer: D
Question #14 (Topic: Exam A)
Which three types of indicators can FortiAnalyzer identify? (Choose three.)
A. Email address
B. Host name
C. Domain
D. URL
E. IP address
Answer: CDE
Question #15 (Topic: Exam A)
Refer to the exhibit.
What can you conclude from this output?
What can you conclude from this output?
A. The allocated disk quota to ADOM1 is 3 GB.
B. There is no disk quota allocated to quarantining files.
C. Archive logs are using more space than analytic logs.
D. ADOM1 has 300 MB of disk space remaining.
Answer: A
