Exact Extract: Study Guide p.157-p.159: datasets are SQL SELECT queries over $log, and WHERE filters narrow returned log rows.
Technical Deep Dive: The correct answer is A. The required dataset must select source IP, destination IP, and URL from $log, then filter web-filter logs where the category description equals Gambling. Option A uses the correct fields and catdesc filter. Option B incorrectly uses IPv6 aliases that do not match the expected output.
Option C filters Dating instead of Gambling. Option D reverses the table and filter logic by placing Gambling in the FROM position and $log in the WHERE expression, which is invalid for the intended dataset.

Exact Extract: Study Guide p.189: verify logs from the report time frame and test the dataset query when expected data is missing.
Technical Deep Dive: The correct answers are A and D. This duplicate scenario tests the same reporting troubleshooting logic. A report can be empty or incomplete even while the logs exist if the report uses a time window that excludes them or if the dataset filters them out. Testing the dataset proves whether the SQL query is actually retrieving the intended rows. Disabling auto-cache is a performance workaround only in very specific stale-cache investigations and is not the recommended first step. Report quota is not the issue when the report runs but contains the wrong data.

Exact Extract: Study Guide p.184: templates and datasets cannot be exported directly; chart exports include the associated dataset.
Technical Deep Dive: The correct answer is C. In Report Definitions, the export/import rule is specific:
reports and charts can be moved, templates and datasets cannot be exported directly. When a chart is exported, the dataset associated with that chart is included automatically, so importing the chart also imports the dataset. Option A is wrong because templates cannot be exported. Option B is wrong for the same reason.
Option D is wrong because datasets are not directly exportable as standalone objects.

Exact Extract: Official Fortinet Administration Guide: Management Extension Applications are installed and run on FortiAnalyzer; CLI options include enabling the fortisoar container.
Technical Deep Dive: The correct answer is B. FortiSOAR MEA is a management extension application hosted by FortiAnalyzer, not a separate FortiSOAR appliance requirement for this question. FortiAnalyzer uses Docker-based MEA support, and FortiSOAR MEA is one of the supported extensions. Option A is wrong because FortiManager is not required just to run the FortiSOAR MEA. Option C describes a standalone FortiSOAR deployment, not the management extension. Option D is wrong because Fortinet documents FortiSOAR MEA trial licensing behavior for evaluation use.

Exact Extract: Study Guide p.83: generic text filters support field operators, including equality and inequality, for precise event-handler matching.
Technical Deep Dive: The correct answer is A. The required filter must match login operations to the GUI from Laptop1 and exclude the admin user. Option A includes the login operation, the correct GUI/IP value for Laptop1, and user!=admin. Option B uses the wrong IP address. Option C incorrectly matches user==admin, which is the opposite of the requirement. Option D lacks the correct performed_on GUI condition and has malformed inequality syntax. For event-handler filters, small syntax or field mistakes change the result completely.