FCP_FAZ_AN-7.6 Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst Questions and Answers

Exact Extract: Study Guide p.39: rolled log files are compressed, receive the .gz extension, and are known as archive logs.

Technical Deep Dive: The correct answer is C. FortiAnalyzer stores received logs first as log files and also indexes them for analytics. When the log file rolls over, FortiAnalyzer renames it, timestamps it, and compresses it into a .gz file. That compressed offline file is the archive log. Option A describes analytics logs in the SQL database. Option B is wrong because FortiView uses analytics logs, not archive logs. Option D confuses archive status with device availability; a log is archived because of the storage workflow, not because the source device is offline.

Exact Extract: Study Guide p.21: FortiAnalyzer Fabric operates with a supervisor and members; members send information to the supervisor for centralized monitoring.

Technical Deep Dive: The correct answer is D. The exhibit shows devices that meet the conditions to participate as FortiAnalyzer Fabric members, so all listed devices can be members. The key concept is that Fabric membership is about centralized monitoring visibility between FortiAnalyzer systems, not about forcing every member into HA or a single time zone. A member remains an operating FortiAnalyzer device and reports member information to the supervisor. The distractor pairs are too restrictive because they unnecessarily exclude devices that still satisfy the Fabric member role.

Exact Extract: The FortiAnalyzer 7.6 Analyst Study Guide explains that FortiView provides dashboards for summarized network information, and that the Threats dashboard shows “top threats.” It also states that from a FortiView widget, “you can find more details about a specific entry,” and that the Top Threats widget displays the top threats, including IPS events and related CVE information when available.

Technical Deep Dive: The correct answer is A because the FortiView Top Threats table includes an entry named Apache.Expect.Header.XSS . That threat name directly indicates a cross-site scripting/XSS-related signature associated with Apache. The same row shows the threat type as IPS , meaning FortiAnalyzer is displaying it as an IPS-detected threat event. Therefore, the analyst can reasonably conclude that FortiAnalyzer recorded XSS attack activity against an Apache web server or Apache-related service.

Option B is not supported. The presence of a CVE ID provides vulnerability context, but it does not automatically mean that attack must be prioritized over every other entry. In FortiAnalyzer/FortiView, prioritization depends on threat level, threat score, incident count, affected assets, and SOC impact. In the exhibit, some entries without CVE IDs have higher threat scores and more incidents than the Apache XSS entry.

Option C is wrong because the exhibit itself includes non-IPS threat types, such as Malicious Website and P2P . FortiAnalyzer does not treat only IPS threats as genuine threats. FortiView aggregates multiple security-relevant categories so analysts can review threats across different log and detection types.

Option D is not a safe conclusion. The displayed table does not show a Critical threat level in the visible rows, but that does not prove that no critical threats exist. The view may be filtered, scoped by time, or limited to the currently displayed Top Threats entries. A SOC analyst should not infer total absence of critical threats from a filtered widget alone.

Exact Extract: Study Guide p.102-p.106: incident charts and status tracking help analysts prioritize and manage incident lifecycle changes.

Technical Deep Dive: The correct answer is C. When an incident is closed as remediated, the incident dashboard and incident status views reflect the updated lifecycle state. FortiAnalyzer keeps incidents visible for tracking and audit unless an administrator deletes them separately. The corresponding event is not automatically rewritten as Mitigated simply because the incident is closed. Incident severity is not automatically lowered by changing status; severity and status are separate incident attributes.

Exact Extract: Study Guide p.9: Tier 2 Incident Responder investigates escalated alerts in more depth for response.

Technical Deep Dive: The correct answer is D. When an event is escalated into an incident, the SOC role responsible for deeper handling and response is the incident responder. Tier 1 security analysts handle monitoring and triage. Threat hunters proactively search for complex or hidden threats rather than owning every escalated incident. SOC engineers maintain tools such as SIEM/SOAR platforms but are not the primary incident-handling role. The guide’s SOC role model places escalated response work with the Incident Responder.

Exact Extract: Study Guide p.208: to run a report as a playbook task, the report must already exist and have auto-cache and extended log filtering enabled.

Technical Deep Dive: The correct answer is A. If the report is not visible as an available report task target, the usual reason is that it does not meet the report-task prerequisites. FortiAnalyzer requires the report to exist already and to have both auto-cache and extended log filtering enabled. Option B is irrelevant because a running playbook does not hide a report definition. Option C is wrong because the trigger starts the playbook, not the report listing. Option D is wrong because report results are not the prerequisite for listing the report as a task target.

Exact Extract: Study Guide p.189: for missing report data, check the report time frame and test the dataset.

Technical Deep Dive: The correct answers are A and D. If the logs exist but the generated report lacks expected information, the first checks are whether the report time frame includes those logs and whether the dataset query returns the expected rows. Reports are only as accurate as their time filter and SQL dataset. Disabling auto-cache is not the normal fix; cache improves performance and scheduled reports use it. Increasing a quota does not correct a wrong time range or broken SQL query unless the report fails for resource reasons, which is not the scenario described.

Exact Extract: Study Guide p.175: Chart Builder automatically builds a dataset and chart from filtered Log View search results.

Technical Deep Dive: The correct answer is D. Chart Builder is a shortcut for turning a useful filtered log search into reusable reporting content. The analyst first filters Log View to the desired data, then uses Chart Builder to create the dataset and chart automatically. Option A is wrong because it is not based on a fixed top-100 list. Option B is incomplete because the feature creates chart/dataset objects rather than merely adding a chart to a generated report. Option C incorrectly places the output under FortiView instead of reporting libraries.

Exact Extract: Study Guide p.188: diagnose sql status sqlreportd checks SQL query connections and hcache status for reports.

Technical Deep Dive: The correct answer is C. The sqlreportd diagnostic is a report troubleshooting command focused on SQL query connections and hcache status. It is useful when reports are slow because report generation depends heavily on hcache and SQL query execution. Option A is handled by scheduled report listing commands. Option B maps to diagnose sql process list. Option D maps more closely to sqlplugind insertion status, not sqlreportd.

Exact Extract: Study Guide p.216: Playbook Monitor provides detailed logs, and failed jobs may include successful individual tasks.

Technical Deep Dive: The correct answers are B and D. Playbook Monitor is the troubleshooting location for playbook execution, and View Log shows task-level detail for the job. A failed playbook job does not mean every task failed; the guide explicitly notes some individual actions may complete successfully. Option A is wrong because FortiAnalyzer does not roll back all completed external or local actions just because a later task failed. Option C is not described as a default debugging playbook workflow in the guide.

Exact Extract: Study Guide p.118: token usage includes prompt and response; more text and larger responses consume more tokens.

Technical Deep Dive: The correct answer is A. The best low-token prompt is concise and scoped: it specifies the endpoint and limits the response to the past week. Option C is verbose and asks for all log entries, increasing both input and output tokens. Option B asks for all logs for the past week without limiting to an endpoint, which can generate a large response. Option D is short, but it lacks a time window, so it can produce a broader and more token-heavy response than option A.

Exact Extract: Study Guide p.139: one log message can consist of multiple logs in LZ4 format, explaining the log-rate/message-rate difference.

Technical Deep Dive: The correct answer is A. In the diagnostic output, the message rate being lower than the log rate is normal because FortiAnalyzer can receive a compressed log message that contains multiple individual logs. The log rate counts logs, while the message rate counts received log messages. Option B is not supported because the output does not prove indexing is almost finished. Option C cannot be inferred unless the command output breaks down traffic versus event log counts. Option D is wrong because these fortilogd rate commands are general logging statistics rather than an ADOM-specific view.

Exact Extract: Study Guide p.82: " Unhandled " means the security event risk is not mitigated or contained, and an IPS/AV pass action is an example.

Technical Deep Dive: The correct answer is B because an IPS log with action=pass means the traffic matched or was observed in a way that generated a security event, but the traffic was not blocked, dropped, or quarantined. FortiAnalyzer therefore treats the event as still open from a SOC workflow perspective. Option A is wrong because quarantine isolates the malicious object and maps to Contained. Options C and D are wrong because dropped or blocked actions mean enforcement already occurred, which maps to Mitigated rather than Unhandled.

Exact Extract: Study Guide p.172: templates include only Editor-tab details and do not include report settings or advanced settings.

Technical Deep Dive: The correct answer is C. Templates define the report layout: text, charts, and macros. They do not carry report settings such as the report time range, selected devices, scheduling, filters, output profile, or advanced settings. Reports include those operational settings. Option A is wrong because templates can include macros. Option B is wrong because both reports and templates can be cloned. Option D is imprecise: reports/charts can be imported/exported between same-type ADOMs, while templates are not exported directly, but the tested difference is settings.

Exact Extract: Study Guide p.43 and p.58: Log View uses normalized format, and the GUI can toggle between formatted and raw log views.

Technical Deep Dive: The correct answers are A and D. The exhibit shows a raw key/value style log display, so it is in raw log format. However, in FortiAnalyzer Log View, received device logs are parsed and normalized for consistent fields, even when the analyst toggles into raw display. Option B is wrong because formatted view would appear as structured table columns. Option C is not the best conclusion because the displayed raw view is not necessarily the untouched original FortiGate message; it is the raw display of FortiAnalyzer’s stored/normalized log data.

Exact Extract: Study Guide p.107: FortiAnalyzer can send incident notifications to external platforms using Fabric connectors; more than one connector can be added.

Technical Deep Dive: The correct answer is A. Incident update notifications are not restricted to email. FortiAnalyzer can use configured Fabric connectors to notify external collaboration or response platforms, and each connector can be configured for the incident activities that should trigger a notification. Option B is too narrow because email is only one possible delivery model. Option C is wrong because multiple connectors do not have to share identical settings. Option D is wrong because notification triggers are configurable for different incident activities, not only update or delete events.

Exact Extract: Study Guide p.65: FortiView threat widgets show top threats and drilldowns such as IPS events, CVEs, attack vectors, and affected hosts.

Technical Deep Dive: The correct answer is C. The FortiView top-threat view is used to identify the threat type and the affected destination/application context. The exhibit supports the conclusion that an SQL injection attack occurred against an application. Option A names a different attack and target. Option B is too broad; the widget display does not prove FortiAnalyzer logged only three IPS attack types in total. Option D is a prioritization judgment not supported by the exhibit; FortiView shows severity and counts, but the analyst still assesses business impact.

Exact Extract: Study Guide p.141: Insert Rate is the rate logs are indexed; Receive Rate is the rate raw logs reach FortiAnalyzer.

Technical Deep Dive: The correct answer is A. At the indicated time, the insert-rate value is higher than the receive-rate value, which means FortiAnalyzer is indexing logs faster than new logs are arriving. This can happen when the database is catching up with previously received logs. Option B is too literal and unsupported; the graph shows rates, not a one-log daemon lead. Option C is wrong because a rebuild is not indicated by a single favorable rate point. Option D would apply when received logs are waiting because indexing is behind, which is the reverse condition.

Exact Extract: Study Guide p.211: output variables use the output from a preceding task as input to the current task.

Technical Deep Dive: The correct answer is B. The exhibit shows the analyst referencing output from an earlier task, such as a generated report identifier, so a later task can attach that result to an incident. That is an output variable. A trigger variable would pull values from the event or incident that started the playbook. The analyst is not creating the report object itself, nor creating a SOC report definition; the report task has already produced data, and the current task is consuming that output dynamically.

Exact Extract: Study Guide p.94 and p.130-p.131: indicators include IP addresses, URLs, and domains; IOC checks use IP/domain/URL values.

Technical Deep Dive: The correct answers are A and B. FortiAnalyzer identifies IOC matches by checking log artifacts such as IP addresses, domains, and URLs against FortiGuard threat intelligence. IP address and URL are explicitly listed as indicator types and IOC comparison parameters. Policy ID identifies which FortiGate policy matched traffic, but it is not an IOC artifact. Application category describes application classification, not a compromise indicator used for FortiGuard IOC matching.