VendorsExamsEnterprise
Support
Request an ExamContact UsFAQ

NSE 5 - FortiAnalyzer 7.6 Analyst Free Sample Questions

Description

Covers Security Fabric log collection and SOC features, log search and FortiView analysis, SOC event handlers and FortiAI-driven threat hunting, and report configuration.

12 free sample questions159 in the full practice test Other version: FCP-FAZ-AN-7-4(219)

Try simulator

FCP_FAZ_AN-7.6 Sample Questions

  1. Question 1

    Advanced

    Features and Concepts · Log Data Flow, Normalization, and Parsing

    An MSSP Administrator manages a FortiAnalyzer instance hosting multiple tenants in separate Administrative Domains (ADOMs). The administrator observes that a custom log parser configured in the 'root' ADOM is not parsing logs arriving from a FortiGate device assigned to 'Customer_A' ADOM. The FortiGate is sending logs correctly. What is the technical reason for this behavior?

    Answer and explanation

    Correct answer: C

    In FortiAnalyzer, while some objects are global, custom log parsers are often ADOM-specific or need to be explicitly applied to the device/ADOM context. If the parser is defined in 'root' but the device is in 'Customer_A', the parser logic does not automatically descend unless configured globally and associated correctly. The administrator must configure or import the parser into 'Customer_A' or ensure the scope allows it.

  2. Question 2

    Intermediate

    Log Analysis · Log View and Search

    A SOC analyst needs to search for all traffic logs where the destination port is NOT 443 and the user field contains the string 'admin'. Which search filter syntax should be used in the Log View?

    Answer and explanation

    Correct answer: B

    In FortiAnalyzer search syntax: '!=' denotes 'not equal to', and '' denotes 'contains' (partial match). Therefore, 'dstport!=443' filters out HTTPS traffic, and 'useradmin' looks for 'admin' anywhere in the user field. The 'and' operator combines them.

  3. Question 3

    Advanced

    SOC Operation and Automation · Playbooks and Fabric Automation

    A FortiAnalyzer administrator is designing a playbook to automatically quarantine a compromised host. The playbook fails to execute the quarantine action on the FortiGate. The administrator verifies that the 'Quarantine Host' connector is configured.

    What is the most likely cause of this failure regarding the variable mapping?

    Answer and explanation

    Correct answer: A

    Playbooks rely on variables passed from the trigger (Event or Incident). If the playbook is triggered by an event that lacks the specific 'srcip' field (or if the variable mapping points to a non-existent field in that log context), the connector action receives a null value and fails to execute the quarantine.

  4. Question 4

    Advanced

    SOC Operation and Automation · Events and Event Handlers

    Case Study:

    Scenario
    An enterprise uses FortiAnalyzer to manage logs for 50 branches. Each branch has a FortiGate. The SOC team wants to detect a specific attack pattern: 'Multiple failed login attempts followed by a successful login from the same IP within 5 minutes'.

    Requirements

    1. Detect the sequence of events.
    2. Group these events into a single actionable item.
    3. Minimize noise from random failed logins.

    Configuration

    • Event Handler A: Detects 'Login Failed' (Count > 5).
    • Event Handler B: Detects 'Login Success'.

    Which configuration approach best satisfies the requirements?

    Answer and explanation

    Correct answer: A

    FortiAnalyzer Event Handlers support correlation rules. To detect a specific sequence (brute force success), you must create a correlation handler that looks for the specific sequence of sub-handlers (or log filters) occurring within a defined time window, grouped by the same Source IP. This creates a single event/incident for the entire attack chain.

  5. Question 5

    IntermediateMultiple answers

    Features and Concepts · Log Data Flow, Normalization, and Parsing

    Which TWO statements accurately describe the behavior of FortiAnalyzer when operating in 'Collector' mode? (Select TWO)

    Answer and explanation

    Correct answers: B, C

    In Collector mode, the SQL database daemon (sqlplugind) is disabled, meaning no analytics, reports, or FortiView dashboards are available locally.

    Collector mode is designed to receive logs from devices, compress/store them, and forward them to an Analyzer for indexing and reporting. It disables most analytic features like FortiView and Reporting to save resources for high-volume ingestion.

  6. Question 6

    Intermediate

    Reports · Report Troubleshooting

    A custom report using a SQL dataset fails to generate data. The dataset query is:
    select * from $log where user = 'marketing'

    When testing the query in the dataset tester, it returns results. However, when the report runs as a scheduled task, it is empty. What is the most likely cause?

    Answer and explanation

    Correct answer: C

    Dataset testing usually queries a sample or a broad range. A scheduled report runs for a specific time frame (e.g., 'Last 24 Hours'). If the logs with 'user=marketing' exist outside that specific window, the report will be empty even if the query logic is correct.

Register free for 6 more questions

Or unlock all 159 FCP_FAZ_AN-7.6 questions with explanations, timed mode and flashcards.

Related practice tests

All Fortinet practice exams