Free FCP_FAZ_AN-7.6 sample questions

Correct answer: dstport!=443 and user~admin

In FortiAnalyzer search syntax: '!=' denotes 'not equal to', and '~' denotes 'contains' (partial match). Therefore, 'dstport!=443' filters out HTTPS traffic, and 'user~admin' looks for 'admin' anywhere in the user field. The 'and' operator combines them.

Correct answer: The playbook input variable for 'Source IP' is utilizing a trigger field that does not exist in the event log type that triggered the playbook.

Playbooks rely on variables passed from the trigger (Event or Incident). If the playbook is triggered by an event that lacks the specific 'srcip' field (or if the variable mapping points to a non-existent field in that log context), the connector action receives a null value and fails to execute the quarantine.

Correct answer: Create a single Event Handler with a specific correlation rule grouping by 'srcip', requiring both 'Login Failed' and 'Login Success' events in sequential order within a time window.

FortiAnalyzer Event Handlers support correlation rules. To detect a specific sequence (brute force success), you must create a correlation handler that looks for the specific sequence of sub-handlers (or log filters) occurring within a defined time window, grouped by the same Source IP. This creates a single event/incident for the entire attack chain.

Correct answers: SQL database and Reporting features are disabled.; It forwards logs to another FortiAnalyzer in Analyzer mode.

In Collector mode, the SQL database daemon (sqlplugind) is disabled, meaning no analytics, reports, or FortiView dashboards are available locally.

Collector mode is designed to receive logs from devices, compress/store them, and forward them to an Analyzer for indexing and reporting. It disables most analytic features like FortiView and Reporting to save resources for high-volume ingestion.

Correct answer: The report time period does not cover the timestamps of the logs found during the test.

Dataset testing usually queries a sample or a broad range. A scheduled report runs for a specific time frame (e.g., 'Last 24 Hours'). If the logs with 'user=marketing' exist outside that specific window, the report will be empty even if the query logic is correct.

Correct answer: COALESCE

The COALESCE(expression1, expression2, ...) function returns the first non-null value in the list. In FortiAnalyzer datasets, `COALESCE(user, 'Unauthenticated')` is commonly used to ensure user fields are not empty in charts.