Question 1

Why must you wait for several minutes before you run a playbook that you just created?

Options :

A : FortiAnalyzer needs that time to parse the new playbook.

B : FortiAnalyzer needs that time to back up the current playbooks.

C : FortiAnalyzer needs that time to ensure there are no other playbooks running.

D : FortiAnalyzer needs that time to debug the new playbook.

Answer: B

Question 2

Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Options :

A : Log upload

B : Indicators of Compromise

C : Log forwarding an aggregation mode

D : Log fetching

Answer: D

Question 3

FortiAnalyzer centralizes which functions? (Choose three)

Options :

A : Network analysis

B : Graphical reporting

C : Content archiving / data mining

D : Vulnerability assessment

E : Security log analysis / forensics

Answer: B,C,E

Question 4

Which log will generate an event with the status Contained?

Options :

A : An IPS log with action=pass.

B : A WebFilter log with action=dropped.

C : An AV log with action=quarantine.

D : An AppControl log with action=blocked.

Answer: C

Question 5

The admin administrator is failing to register a FortiClient EMS on the FortiAnalyzer device. What can be the reason for this failure?

Options :

A : FortiAnalyzer is in an HA cluster.

B : ADOM mode should be set to advanced, in order to register the FortiClient EMS device.

C : ADOMs are not enabled on FortiAnalyzer.

D : A separate license is required on FortiAnalyzer in order to register the FortiClient EMS device.

Answer: C

Higher Test Marks with Free Online FCP_FAZ_AD-7.4 Exam Practice