FCP_FAZ_AN-7.6 Practice Questions

A.  

You can manually attach generated reports to incidents.

B.  

The status of the incident is always linked to the status of the attached event.

C.  

Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.

D.  

Incidents must be acknowledged before they can be analyzed.

A.  

The report does not have auto-cache and extended log filtering enabled.

B.  

The playbook is currently running and will be available after it is finished.

C.  

You must create a trigger to run the report first.

D.  

The report has no result and must be reconfigured.

A.  

The risk source is isolated.

B.  

The security risk was blocked or dropped.

C.  

The security event risk is considered open.

D.  

An incident was created from this event.

A.  

The log insert log time is increasing.

B.  

FortiAnalyzer is using its cache to avoid dropping logs.

C.  

The performance of FortiAnalyzer is below the baseline.

D.  

The sqiplugind service is caught up with the logs

A.  

Each connector used can have different notification settings

B.  

Each incident can send notification to a single external platform.

C.  

You must configure an output profile to send notifications by email.

D.  

Notifications can be sent only when an incident is created oi deleted.

A.  

These are application control logs from FortiGate

B.  

Social networking websites are being allowed

C.  

Unrated websites are being blocked.

D.  

This is a custom view that was set by the analyst

A.  

To view a list of scheduled reports

B.  

To list the current SQL processes running

C.  

To display the SQL query connections and hcache status

D.  

To identify the database log insertion status

A.  

When running in collector mode, FortiAnalyzer can forward logs to a syslog server.

B.  

FortiAnalyzer runs in collector mode by default unless it is configured for H

A.  

C.  

You can create and edit reports when FortiAnalyzer is running in collector mode.

D.  

A topology with FortiAnalyzer devices running in both modes can improve their performance.

A.  

Remove old reports from the hcache

B.  

Enable auto-cache and run the reports again

C.  

Increase the ADOM reports quota

D.  

Review report diagnostics

A.  

The low indexing values require investigation.

B.  

The output is not ADOM-specific.

C.  

There are more event logs than traffic logs.

D.  

The log rate higher than the message rate is not normal.