Free FCP-FAZ-AD-7-4 sample questions

Correct answer: Create a custom dataset using a SQL query with a WHERE clause to filter for 'Sales' and 'Marketing' user groups. Then, create a new report with a chart based on this custom dataset.

Standard report charts have limited filtering capabilities. To achieve complex filtering, such as by specific LDAP user groups, the correct method is to first create a custom dataset. This involves writing a SQL query that selects the required log data and uses a WHERE clause to filter on the `usergroup` field. Once this dataset is created and tested, it can be used as the source for a custom chart within a new report.

Correct answer: Configure the RADIUS server to return the Fortinet-ADOM-Name vendor-specific attribute (VSA) with the names of the allowed ADOMs for each engineer.

When using a wildcard RADIUS administrator, FortiAnalyzer can dynamically assign ADOM access based on vendor-specific attributes (VSAs) returned by the RADIUS server during authentication. By configuring the RADIUS server to send the `Fortinet-ADOM-Name` VSA containing the specific ADOM(s) an engineer is authorized to access, the MSP can enforce granular, per-user ADOM restrictions without creating multiple accounts on the FortiAnalyzer itself.

Correct answers: In Advanced mode, VDOMs from the same FortiGate can be assigned to different ADOMs.; In Normal mode, all VDOMs from a single FortiGate must be assigned to the same ADOM.

A key distinction is how VDOMs are handled. In Normal mode, the FortiGate device is the unit of assignment, so all of its VDOMs must belong to one ADOM. Advanced mode provides more flexibility, allowing an administrator to assign individual VDOMs from a single physical FortiGate to multiple different ADOMs, which is essential for complex multi-tenant environments.

Correct answer: False

An ADOM's disk quota can be both increased and decreased after it has been set. This can be done through the GUI or CLI, provided there is available disk space. However, you cannot decrease the quota to a value less than the current amount of data stored in that ADOM.

Correct answer: The encryption password used when the backup was created

When a FortiAnalyzer configuration backup is encrypted, the password used for that encryption is mandatory for the restore process. Without the correct password, the FortiAnalyzer cannot decrypt the file and the restore operation will fail.

Correct answer: Disable HA preemption.

HA preemption is the feature that allows a device with a higher priority (the original primary) to automatically take over the primary role when it becomes available. By disabling preemption, the original primary unit will remain in a passive state after it reboots, allowing the current primary (the original secondary) to continue its role without interruption. This prevents the unwanted second failover.

Correct answer: Log files from a device with a different FortiOS major version are being received in an ADOM.

FortiAnalyzer maintains a specific SQL database schema for each FortiOS major version within an ADOM. If logs from a device with a different major FortiOS version (e.g., FortiOS 7.2 logs being sent to an ADOM configured for 7.4) are received, FortiAnalyzer will trigger a database rebuild to accommodate the different log format. This is a resource-intensive process and a common cause of performance issues.

Correct answer: To send logs in real-time to another FortiAnalyzer or a third-party SIEM/syslog server.

Log forwarding allows FortiAnalyzer to act as a central aggregator and then forward received logs to other systems. This is commonly used to integrate with a central corporate SIEM (like Splunk or QRadar) or to create a tiered logging architecture with multiple FortiAnalyzers (e.g., regional collectors forwarding to a central analyzer).

Correct answers: Device Manager: Read; FortiView: Read; Reports: Read

Correct answer: To receive logs from devices, index them, and then forward them to an Analyzer.

In a distributed architecture, a FortiAnalyzer in Collector mode is optimized for log reception and forwarding. Its main job is to collect logs from multiple devices (often in a remote location), perform initial indexing, and then forward the logs to a central FortiAnalyzer in Analyzer mode for detailed analysis and reporting. This reduces the processing load on the Analyzer and optimizes WAN bandwidth.