Online Access Free FCP_FAZ_AN-7.6 Exam Questions

(How does FortiAnalyzer block indicators? (Choose one answer)

• A.It uses an automation script to update FortiGate with the block list.
• B.It uses a FortiManager connector to send the block list.
• C.It uses a webhook to allow FortiGate to send the block list.
• D.It uses a FortiClient EMS connector to send the block list.

As part of your analysis, you discover that an incident is a false positive.
You change the incident status to Closed: False Positive.
Which statement about your update is true?

• A.The audit history log will be updated.
• B.The incident will be deleted.
• C.The corresponding event will be marked as mitigated.
• D.The incident number will be changed

(Which two statements about FortiAnalyzer Fabric deployments are true? (Choose two answers)

• A.Supervisors and members must be in the same time zone.
• B.Fabric members do not forward their logs to the supervisor.
• C.Fabric members can operate in analyzer mode only.
• D.Supervisors can be in high availability (HA) for redundancy purposes only.

Which three types of logs does FortiAnalyzer collect from FortiGate devices for normalization? (Choose three.)

• A.Firewall
• B.Traffic
• C.Event
• D.Security
• E.System

What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

• A.The size of newly generated reports is optimized to conserve disk space.
• B.When new logs are received, the hard-cache data is updated automatically.
• C.The generation time for reports is decreased.
• D.FortiAnalyzer local cache is used to store generated reports.