FCP_FAZ_AN-7.6 exam questions

1. Question 1

   Single answer

   Which log will generate an event with the status Unhandled?

   • A

     An AV log with action=quarantine.

   • B

     An IPS log with action=pass.

   • C

     A WebFilter log with action=dropped.

   • D

     An AppControl log with action=blocked.

   Reveal answer

   Correct answer

   • B

     An IPS log with action=pass.

   Explanation

   Study Guide p.82: "Unhandled" means the security event risk is not mitigated or contained, and an IPS/AV pass action is an example.

   Technical Deep Dive: The correct answer is B because an IPS log with action=pass means the traffic matched or was observed in a way that generated a security event, but the traffic was not blocked, dropped, or quarantined. FortiAnalyzer therefore treats the event as still open from a SOC workflow perspective. Option A is wrong because quarantine isolates the malicious object and maps to Contained. Options C and D are wrong because dropped or blocked actions mean enforcement already occurred, which maps to Mitigated rather than Unhandled.

2. Question 2

   Multiple answer

   Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer? (Choose two.)

   • A

     Enable device detection on the FortiGate devices that are sending logs to FortiAnalyzer.

   • B

     Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

   • C

     Make sure all endpoints are reachable by FortiAnalyzer.

   • D

     Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

   Reveal answer

   Correct answer

   • B

     Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

   • D

     Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

   Explanation

   Study Guide p.130: the IOC service uses FortiGuard and analyzes web filtering, DNS, and traffic logs for breach detection.

   Technical Deep Dive: The correct answers are B and D. To view compromised hosts, FortiAnalyzer needs relevant logs that expose suspicious destinations or web activity, and it needs current FortiGuard IOC intelligence. Web filtering logs are especially important because they contain URL/domain activity that can be compared with FortiGuard threat intelligence. The FortiGuard subscription keeps the threat database current. Option A may help identify devices in some FortiGate workflows, but it is not the core IOC requirement described in the Analyst guide. Option C is wrong because FortiAnalyzer does not need direct reachability to every endpoint; it evaluates logs received from FortiGate.

3. Question 3

   Single answer

   Which SQL query is in the correct order to query the database in the FortiAnalyzer?

   • A

     SELECT devid FROM $log GROUP BY devid WHERE ‘user’,,’ users1’

   • B

     SELECT FROM $log WHERE devid ‘user’,, USER1’ GROUP BY devid

   • C

     SELCT devid WHERE ’user’-‘ USER1’ FROM $log GROUP By devid

   • D

     SELECT devid FROM $log WHERE ‘user’=’ GROUP BY devid

   Reveal answer

   Correct answer

   • D

     SELECT devid FROM $log WHERE ‘user’=’ GROUP BY devid

   Explanation

   Study Guide p.158: SELECT statements must follow clause order: SELECT, FROM, WHERE, GROUP BY, ORDER BY, LIMIT, OFFSET.

   Technical Deep Dive: The correct answer is D because it is the only option that follows the expected SQL clause sequence closely enough: SELECT columns, FROM $log, WHERE condition, and GROUP BY. Even if the printed option appears to have a minor value/quotation issue, its clause order is the tested point. Option A places GROUP BY before WHERE, which is invalid. Option B lacks a proper selected column and malformed filtering syntax. Option C misspells SELECT and places WHERE before FROM, which breaks the required SQL structure.

4. Getting the hang of it? 74 more FCP_FAZ_AN-7.6 questions are waiting, each with its answer. Unlock them all

5. Question 4

   Single answer

   You created a playbook on FortiAnalyzer that uses a FortiOS connector.

   When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

   • A

     FortiAnalyzer Event Handler

   • B

     Fabric Connector event

   • C

     FortiOS Event Log

   • D

     Incoming webhook

   Reveal answer

   Correct answer

   • D

     Incoming webhook

   Explanation

   Study Guide p.202: FortiOS connector actions appear only after enabling an automation rule using the Incoming Webhook Call trigger on FortiGate.

   Technical Deep Dive: The correct answer is D. A FortiAnalyzer playbook can list a FortiOS connector after FortiGate is added, but the available FortiOS actions depend on FortiGate-side automation rules. FortiGate must expose an Incoming Webhook trigger so FortiAnalyzer can call the automation stitch. A FortiAnalyzer Event Handler is used on FortiAnalyzer to generate events, not to expose FortiOS connector actions. Fabric Connector events and FortiOS Event Log triggers do not provide the FortiAnalyzer-to-FortiGate action handoff tested here.

6. Question 5

   Single answer

   When managing incidents on FortiAnalyzer, what must an analyst be aware of?

   • A

     You can manually attach generated reports to incidents.

   • B

     The status of the incident is always linked to the status of the attached event.

   • C

     Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.

   • D

     Incidents must be acknowledged before they can be analyzed.

   Reveal answer

   Correct answer

   • A

     You can manually attach generated reports to incidents.

   Explanation

   Study Guide p.185: reports can be attached to incidents manually from an existing report, manually from an incident, or automatically through playbooks.

   Technical Deep Dive: The correct answer is A. Incidents are containers for related security events, and attaching a report gives the analyst historical or contextual evidence in addition to real-time event data. Option B is wrong because incident status is managed independently from attached event status. Option C is not a FortiAnalyzer default rule from the guide; SLA response times are organization-specific. Option D is wrong because incidents can be opened and analyzed directly; acknowledgment is not a prerequisite to analysis.

7. Question 6 Locked Unlock to see this question
8. Question 7 Locked Unlock to see this question

Back to the FCP_FAZ_AN-7.6 exam page