Exact Extract: Study Guide p.158: SELECT statements must follow clause order: SELECT, FROM, WHERE, GROUP BY, ORDER BY, LIMIT, OFFSET.
Technical Deep Dive: The correct answer is D because it is the only option that follows the expected SQL clause sequence closely enough: SELECT columns, FROM $log, WHERE condition, and GROUP BY. Even if the printed option appears to have a minor value/quotation issue, its clause order is the tested point. Option A places GROUP BY before WHERE, which is invalid. Option B lacks a proper selected column and malformed filtering syntax. Option C misspells SELECT and places WHERE before FROM, which breaks the required SQL structure.

Exact Extract: Study Guide p.184: reports and charts can be imported/exported between same-type ADOMs; chart exports include associated datasets.
Technical Deep Dive: The correct answers are A and C. FortiAnalyzer requires the source and destination ADOMs to be the same type when moving reports or charts. Reports contain charts, and exported charts carry their associated datasets, so the reporting dependency comes across with the import workflow. Option B describes name-conflict behavior for playbook imports, not the report-moving requirement tested here. Option D is wrong because reports can be imported/exported directly; converting them to templates first is not required.

Exact Extract: Study Guide p.118: token usage includes prompt and response; more text and larger responses consume more tokens.
Technical Deep Dive: The correct answer is A. The best low-token prompt is concise and scoped: it specifies the endpoint and limits the response to the past week. Option C is verbose and asks for all log entries, increasing both input and output tokens. Option B asks for all logs for the past week without limiting to an endpoint, which can generate a large response. Option D is short, but it lacks a time window, so it can produce a broader and more token-heavy response than option A.

Exact Extract: Study Guide p.126: threat hunting is a proactive search for suspicious or risky network activity.
Technical Deep Dive: The correct answer is D. Threat hunting is FortiAnalyzer's proactive investigation workflow. Instead of waiting for an event handler or incident to tell the SOC what happened, the analyst begins with a hypothesis and searches logs for suspicious patterns. FortiView is valuable for visibility but is not, by itself, the named proactive method. Outbreak alerts notify about emerging threats, and the Incidents dashboard manages known incidents. Threat hunting is the feature that best matches proactive network- security management.

Exact Extract: Study Guide p.130-p.132: blacklisted IP or DGA matches produce an Infected verdict and appear under Compromised Hosts.
Technical Deep Dive: The correct answer is B. When IOC analysis finds web logs matching blacklisted IP addresses or domain-generation algorithm patterns, FortiAnalyzer treats that as a real breach and creates
/updates an infected compromised-host entry for the endpoint. Option A describes suspicious-list behavior, where FortiAnalyzer flags the host for further analysis. Option C is wrong because blacklisted matches are classified as Infected, not merely Suspicious. Option D overstates the automatic endpoint response; quarantine is a separate response action, not the IOC engine classification itself.