FCP_FAZ_AN-7.6 — Fortinet FCP - FortiAnalyzer 7.6 Analyst All 51 questions & answers on one page · harvested from ExamTopics discussion threads, Google search + Fortinet official docs · 20 exhibit images

Why it is a normalized log (B): The log entry contains header metadata fields such as adom_oid, itime, loguid, and data_parsername=FortiGate Log Parser. These fields do not exist in the original raw syslog sent by a FortiGate device; they are added automatically by FortiAnalyzer when it processes, parses, and injects the log into the normalized Fabric SIEM database (siemdb).Why it is in raw log format (C): Within the FortiAnalyzer Log View GUI, administrators can toggle between a structured table/columnar view (Formatted) and a text string of key-value pairs (Raw). The exhibit shows the log displayed in this text-based Raw key-value string format rather than the human-friendly column table.

B. This is a normalized log. D. This is the original log that FortiAnalyzer received from FortiGate.

B: This is a normalized log

this is raw log without parsers data_parsername = tells what device

If no matching parser exist, FortiAnalyzer uses generic syslog parser

FortiAnalyzer 7.6 Analyst Study Guide - Pag.41 "If no matching parser exist, FortiAnalyzer uses the generic syslog parser"

It's stored as an archived log but does not show as an analytics log because it can't be normalized.

Before Version 7.6: FortiAnalyzer natively relied on a row-oriented relational PostgreSQL (PSQL) database to index, query, and store analytics logs. From Version 7.6 Onward: The backend system migrated to a ClickHouse database.

The answer is D. The keyword in the question is '[KEYWORD]'.

B,C,D are corrects

FortiAnalyzer Administration Guide , page 151

B. Traffic Yes — traffic logs are normalized so FortiAnalyzer can correlate sessions, bandwidth, NAT, and UTM events. C. Event Yes — event logs (system events, admin events, HA events, etc.) are normalized for SIEM correlation. D. Security Yes — this includes: Web filter, Application control, IPS, Antivirus, DNS filter, SSL inspection, DoS These are all normalized because they contain structured UTM fields.

My choice is D. What are your thoughts?

A use ALTER B use DELETE C use INSERT D use SELECT over metadata

Because the schema is stored in system tables, and SELECT can read them. Best answer is D.

C is the only option that isn't immediately wrong.

FortiAnalyzer 7.6 Analyst Study Guide - Pag.55, There are two modes you can use when you search for logs in the log view: • Filter mode allows you to define your search criteria using the GUI. • Text mode allows you to type in your filter and conditions or pick a filter from history

D seems like the most plausible answer, though [Other Option] is a clever distractor.

This is "Text mode"

FortiAnalyzer 7.6 Analyst Study Guide - Pag.54 "FortiAnalyzer allows you to save searches and build a custom view that you can go to directly whenever you are looking for logs using specific search parameters. This feature is very useful when you are performing a specific search frequently and repeatedly"

Group and order and the match with the ip address

I'll go with A.

Well, [Option A] and [Option C] are definitely wrong. Between the other two, B is the better fit.

FortiView is the primary interface within FortiAnalyzer designed for real-time and historical threat analysis

Threat Listing and Organization: FortiView automatically consolidates security logs and displays identified threats categorized into specific views (such as Top Threats, Top Cyber Threats, Top Sources, etc.) within customizable timeframes. Quick Export to PDF: It features a native button directly on the GUI screen (such as "Export to PDF" or a print icon) that allows you to generate and download an instant PDF report based on the active filters and charts on your screen.

B. Final answer.

FROM $log: In FortiAnalyzer, the mandatory macro variable used to pull data dynamically from the correct active log table is $log. WHERE catdesc = 'Gambling': The field catdesc (Category Description) stores the human-readable text name of the FortiGuard web filter category. The prompt explicitly targets gambling websites (‘Gambling’), which must be wrapped in single quotes as a string literal. Aliases (as "SourceIP"): To match the expected report output table format, column aliases are defined using double quotes (SourceIP and DestIP), properly mapping the technical database fields (srcip and dstip).

Absolutely B. The other options are factually incorrect.

This would be C: SQL inseration status - sql status sqlplugind SQL query connection and hcache status - sql status sqlreportd

sqlplugind (SQL Plugin Daemon): This daemon is responsible for taking raw logs sent by devices (like FortiGate) and inserting/indexing them into the SQL database. Therefore, running diagnose sql status sqlplugind is strictly used to identify the database log insertion status.

The purpose of running the command diagnose sql status sqlplugind on a FortiAnalyzer is to display the status of the SQL plugin, which handles SQL queries, including active query connections and the hcache (historical cache) status. It is used to monitor and troubleshoot SQL-based reporting processes

This would be C: SQL inseration status - sql status sqlplugind SQL query connection and hcache status - sql status sqlreportd

sorry A

To select log on which to build chart

419 Chart Builder is a productivity tool in FortiAnalyzer. When you are analyzing logs and apply specific filters to find a network incident or behavior, the button allows you to automatically transform those filters into a dataset (the SQL query) and a chart (the visualization). This prevents you from having to manually write complex SQL queries to create custom reports.

100% A. I remember this specific point from the official study guide.

100% - D ;-)

FortiAnalyzer 7.6 Analyst Study Guide Pag.182 "To boost the report performance and reduce report generation time, you can enable auto-cache in the settings of the report. When you do this, the hcache is automatically updated when new logs come in and new log tables are generated"

My initial thought is B, and after re-reading, I'm sticking with it.

StudyGuide - "Output variables allow you to use the output from a preceding task as input to the current task." "An output variable consists of the task ID, followed by the task output."

In the specific configuration shown in the exhibit (Attach Data), the analyst is handling the return payload from a previously executed action. When a task such as Run Report runs, it dynamically generates a unique identifier for the produced report called report_uuid.By mapping this field in a subsequent action (such as attaching data to an incident), the analyst is configuring and utilizing an Output Variable. This allows data produced by one task to serve as automatic input for the next blocks in the Playbook, ensuring workflow continuity and proper incident orchestration.

I’m thinking it’s C, but not 100%. The question could be interpreted in two ways.

Reports: These are fully functional, independent objects. Beyond just the visual layout, they include all advanced operational and execution configurations, such as specific log timeframes, device filters, delivery profiles (e.g., automated email or SFTP uploads), execution schedules, and database settings like Auto-Cache. Templates: These serve strictly as a layout blueprint or structural skeleton. They define where headers sit, the order of data tables, and which specific charts will be rendered. They do not contain target device groups, execution schedules, or advanced data delivery pipelines.

FortiAnalyzer 7.6 Analyst Study Guide, pag172

I’m leaning heavily toward B on this one.

A,C The report configuration is saved as a .dat file on the management computer. This includes the charts, datasets, images, and report settings. If the device type used in the charts and datasets for the report does not match the ADOM type, the import will be rejected with an error. https://docs.fortinet.com/document/fortianalyzer/7.6.0/administration-guide/490181/importing-and-exporting-reports

Click OK to export the report. The report configuration is saved as a .dat file on the management computer. This includes the charts, datasets, images, and report settings. To import reports: If using ADOMs, ensure that you are in the correct ADOM. If the device type used in the charts and datasets for the report does not match the ADOM type, the import will be rejected with an error. For more information, see How ADOMs affect reports.

A. Reports (Correct): A complete report object can be seamlessly exported from one ADOM and imported into another through the GUI. D. Charts (Correct): Individual layout charts can be exported or imported standalone. When a chart is exported, FortiAnalyzer automatically packages and embeds its corresponding dataset query inside it to ensure the chart renders the data successfully at the destination

Remember, each ADOM has its own reports, libraries, and advanced settings. You can, however, import and export reports and charts (whether default or custom) into different ADOMs within the same FortiAnalyzer device or a different FortiAnalyzer device. Both ADOMs must be of the same type. You can’t export templates and datasets. However, when you import an exported report, you can save the layout of the report as a template. When you export a chart, the associated dataset is exported with it, so when you import an exported chart, the associated dataset is imported as well. You can export and import reports through the right-click menu on the Reports page. FortiAnalyzer 7.6 Analyst Study Guide page 184

On a FortiAnalyzer, the two modules that can be exported and imported between Administrative Domains (ADOMs) are: - Reports (including charts and datasets) - Event Handlers (under the Incidents & Events/FortiSoC module) Key Details: Reports: You can export report charts and configurations and import them into a different ADOM, provided both ADOMs are of the same type. When a chart is exported, its associated dataset is included. Event Handlers: These can be exported and imported to facilitate custom event creation and bulk deployment across different ADOMs or FortiAnalyzer

My choice is D. What are your thoughts?

Output profiles allow you to define email addresses to which generated reports are sent and provide an option to upload the reports to FTP, SFTP, or SCP servers. Once created, an output profile can be specified for a report. https://docs.fortinet.com/document/fortianalyzer/7.4.0/administration-guide/112671/output-profiles KB https://community.fortinet.com/fortianalyzer-6/technical-tip-how-to-configure-email-server-on-fortianalyzer-to-receive-reports-over-email-94040

A output profile is needed

A is correct. old question.

Not super confident, but I’ll go with D.

Its B the SOC engineers can refine the following tools: For SIEM tools, SOC engineers can create and maintain detection rules, log parsers, and dashboards that will support effective alert triage. For SOAR tools, SOC engineers can develop and maintain playbooks for automation within the security fabric for incident response. For other SOC tools, SOC engineers can ensure tools are well integrated and scalable to ensure smooth automation for efficient response. https://docs.fortinet.com/document/fortianalyzer/7.6.0/security-operations-concept-guide/643388/what-is-a-security-operations-center-soc?

Its B, others are Tier levels not a job roles

Based on the sources, the SOC role responsible for configuring and fine-tuning playbooks is the Security analyst.

I’m leaning heavily toward A on this one.

"Note that to run a report as a task, it must already exist and have both auto-cache and extended log filtering enabled."

Only reports with Auto Cache and Extended Log Filtering enabled can be run from an incident.

FortiAnalyzer 7.6 Analyst Study Guide - pag.208

FortiAnalyzer 7.6.5 Administration Guide - Page 214: Only reports with Auto Cache and Extended Log Filtering enabled can be run from an incident.

O Study Guide afirma explicitamente que é necessário habilitar uma automation rule usando o Incoming Webhook Call trigger no FortiGate

From admin guide Enabling FortiOS actions The actions available with FortiOS connectors are determined by automation rules configured on each FortiGate. Automation rules using the Incoming Webhook trigger must be created in FortiOS before they are shown as actions in FortiAnalyzer. FortiOS automation rules are configured on FortiOS in Security Fabric > Automation. For information on creating FortiOS automation rules, see the FortiOS administration guide.

FortiAnalyzer 7.6 Analyst Study Guide - Pag.202, you must enable an automation rule using the Incoming Webhook Call trigger on FortiGate.

Let's discuss. I landed on D, but I want to be sure of the reasoning.

Option A is incorrect because FortiAnalyzer does not commit changes from failed playbooks to ensure system integrity. Option D is incorrect because a playbook status of "Failed" does not necessarily mean every single task failed; it indicates that the overall execution flow could not complete, but individual preceding tasks may have been successfully completed before the failure occurred.

Why A is correct: Playbooks in FortiAnalyzer execute tasks sequentially, one after another. If a playbook contains five tasks and the first four execute successfully but the fifth one fails, the overall playbook status is marked as Failed. Why C is correct: The Playbook Monitor menu inside FortiAnalyzer is the centralized hub for automation management and diagnostics. It is where a SOC analyst reviews execution history and drills down into granular troubleshooting logs for each individual step to see exactly which variable or connector caused a flow to fail.

Based on FortiAnalyzer playbook execution, the two true statements are:FortiAnalyzer will not commit changes made by a Failed playbook.The Playbook Monitor provides troubleshooting logs

If I had to guess, I’d pick A based on the wording of the question.

https://docs.fortinet.com/document/fortianalyzer/7.6.5/administration-guide/768287/connector-actions?utm_source=chatgpt.com#FortiOS The actions available with FortiOS connectors are determined by automation rules configured on each FortiGate

There were 5-6 questions in the exam that are not included here. I manage to pass but barely.

FortiAnalyzer 7.6.5 Administration Guide - Page 371: The actions available with FortiOS connectors are determined by automation rules configured on each FortiGate. Automation rules using the Incoming Webhook trigger must be created in FortiOS before they are shown as actions in FortiAnalyzer. FortiOS automation rules are configured on FortiOS in Security Fabric > Automation. For information on creating FortiOS automation rules, see the FortiOS administration guide.

FortiAnalyzer 7.6.5 Administration Guide - Page 370: The actions available with FortiOS connectors are determined by automation rules configured on each FortiGate.

SOC AUTOMATION CONTENT PACK: Latest detection rules (handlers), playbook, compliance mapping, report templates, connectors and log parsers from Fortiguard

Page ~155 (Administration Guide FortiAnalyzer 7.6.6) It states that additional predefined objects are available from FortiGuard when the Security Automation Service license is valid. Final Answer: C. Event handlers D. Active Connectors E. Playbooks

❌ Why the other options are incorrect FortiAnalyzer-7.6.6-Administrator pg. 343 SOC Automation A. Report templates – are not always automatically included in the standard content pack; the reports offered may be premium, but are not guaranteed as standard automatic content. B. Dashboards – Dashboards are not typically distributed by FortiGuard SOC Automation content packs. D. Active Connectors – Connectors may appear in the content pack, but are not always automatically applied as standard SOC Automation content.

FortiAnalyzer-7.6.6-Administrator pg. 343 SOC Automation

FortiAnalyzer 7.6 Analyst Study Guide - Pag.202 • Green: The API connection successful. • Orange: The API connection is unknown. • Red: The API connection is down

B From the incident page, you can perform the following analysis tasks: Export incident, enrich incident indicators, execute playbooks, run a report on the incident, and quarantine endpoints. https://docs.fortinet.com/document/fortianalyzer/7.6.0/new-features/190478/incident-analysis-re-design#playbook

"From the incident page, you can perform the following analysis tasks: Export incident, enrich incident indicators, execute playbooks, run a report on the incident, and quarantine endpoints."

Within the FortiAnalyzer interface, specifically inside the SOC module (FortiSOC > Incidents), analysts have full control over triage and containment actions. From the details page of a specific incident, you can manually trigger an Incident Response (IR) Playbook to immediately mitigate the threat (for example, isolating a compromised host).

From the Incident page, you can perform the following analysis tasks: Export incident, enrich incident indicators, execute playbooks, run report, quarantine endpoints

When you change the status of an incident in FortiAnalyzer (e.g., shifting it from Open or In Progress to Closed: Remediated), the system immediately refreshes the global security metrics and the incidents dashboards. This ensures that KPI charts accurately display the exact number of remaining active threats and log the response team's resolution history.

When you change an incident status to Closed: Remediated, FortiAnalyzer keeps the incident but updates the incident information/status. The Study Guide says the Incidents page includes interactive charts for prioritizing and filtering incidents, and incident information is managed through that page. It also says when an incident is considered closed, you should change its status accordingly. This is covered on pages 102 and 106

FortiAnalyzer 7.6 Analyst Study Guide. Pag.106 "When an incident is considered closed, you should change its status accordingly. Additionally, you can delete resolved incidents from the list"

I'm voting for D.

This structure allows certain members to focus on monitoring and initial triage (tier 1) Security Analyst While others focus on escalated incident response for larger attacks where remediation may take more time (tier 2). Incident Responder https://docs.fortinet.com/document/fortianalyzer/7.6.0/security-operations-concept-guide/643388/what-is-a-security-operations-center-soc

Incident Responder (Tier 2): This professional is specifically tasked with taking ownership of and handling escalated incidents. Their core function is to deeply investigate the scope of the attack, contain the threat (e.g., blocking IPs or URLs via fabrics), and coordinate remediation efforts to recover the compromised assets.

FortiAnalyzer 7.6 Analyst Study Guide, pag 8 "Incident response: As part of incident investigation, the SOC also responds to threats by blocking IP addresses, domains, or URLs and coordinating recovery efforts for affected devices"

I checked the official docs on this topic, and C is the correct implementation.

FortiAnalyzer 7.6 Analyst Study Guide. Pag.107 "You can configure FortiAnalyzer to send a notification to external platforms using preconfigured Fabric connectors"

I'm torn between D and [Option X]. Can someone explain why D is the better choice?

Unhandled: This status indicates that the security threat or alert has not yet been addressed, contained, or resolved. In other words, the security event risk is considered open. This status typically applies to logs where the firewall action was simply logged as pass or allow, or when active Botnet/IoC indicators require deep investigation. The official exam exhibit explicitly highlights an event marked as Unhandled.

Unhandled - Open Contained - Isolated Mitigated - Blocked Blank - Other

I'll go with D.

FortiAnalyzer 7.6 Analyst Study Guide - Pag.131 "Depending on the log type, FortiAnalyzer identifies possible compromised hosts by checking the threat database against the log's IP address, domain, and URL. The table on this slide displays which data in the logs FortiAnalyzer checks against the threat database."

FortiAnalyzer-7.6.5-Administration_Guide:"When using Indicator of Compromise, it is recommended to turn on the UTM web filter of FortiGate devices and subscribe your FortiAnalyzer unit to FortiGuard to keep its local threat database synchronized with the FortiGuard threat database"

Methods of Blocking Indicators FortiManager Connector (Version 7.6+): Workflow: When an incident is identified, an analyst can right-click a malicious indicator in the GUI to block it.Mechanism: FortiAnalyzer saves the indicator to an external resource list (e.g., root-BLKIP) and pushes it to FortiManager. FortiManager then updates the relevant FortiGate policies to deny traffic. FortiMQ Connector (Version 8.0+): Workflow: Provides direct communication between FortiAnalyzer and FortiGate, allowing for indicator blocking even without a FortiManager in the network.Mechanism: A predefined "block_indicator" playbook runs, sending indicators to FortiMQ. FortiGate then retrieves this feed, which is applied in security profiles or policies to block access.

Methods of Blocking IndicatorsFortiManager Connector (Version 7.6+):Workflow: When an incident is identified, an analyst can right-click a malicious indicator in the GUI to block it.Mechanism: FortiAnalyzer saves the indicator to an external resource list (e.g., root-BLKIP) and pushes it to FortiManager. FortiManager then updates the relevant FortiGate policies to deny traffic.FortiMQ Connector (Version 8.0+):Workflow: Provides direct communication between FortiAnalyzer and FortiGate, allowing for indicator blocking even without a FortiManager in the network.Mechanism: A predefined "block_indicator" playbook runs, sending indicators to FortiMQ. FortiGate then retrieves this feed, which is applied in security profiles or policies to block access.

FortiAnalyzer 7.6 Analyst Study Guide - Pag.98 "When the playbook runs successfully, the blocked indicator is pushed to the FortiManager External Resource list. Using this list in FortiManager"

The action for the social networking websites is passthrough, which is an action where the user can access the website through a warning page. D can't be the correct answer because custom views have an associated name that can be seen above the "All Devices" label and the exhibit doesn't have that.

Because of the filter in the top

I think B makes sense.

My initial thought is D, and after re-reading, I'm sticking with it.

From Admin guide: Make your prompts concise and specific. In terms of token usage, the prompt "Can you show me all the log entries for endpoint 10.10.10.10 from the past week?" is less effective than "Show recent logs for 10.10.10.10 (Past week)" because the former prompt uses more text than the latter.

FortiAnalyzer 7.6 Analyst Study Guide. Pag.118

Leaning toward A, but I'd be interested to hear arguments for the others.

A. Identify potential impacts and recommended remediation. (Correct - Native feature of the AI assistant) B. Perform threat hunting. (Correct - Executed via natural language queries) I believe the correct is to choose 2 answers, Fortianalyzer does not provision or deploy VPN tunnels and FortiAI not configure SDWAN

A, B and D

Pretty sure it's B. This pattern is very common.

supported methods: Fabric connectors, email, SNMP, Syslog

FortiAnalyzer 7.6 Analyst Study Guide - Pag.87 "A predefined event handler is available to detect safeguarding keywords in logs for web traffic, application traffic (social media), and email. This event handler supports consistent monitoring for harmful content,allowing timely intervention."

Safeguarding event handler A predefined event handler is available to detect safeguarding keywords in logs for web traffic, application control (social media), and email. This event handler supports consistent monitoring for harmful content, allowing timely intervention.

Tricky one. Base on the ouput = Webfilter = 2 IPS = 2 Malware = 2 (Check the Anti-virus line, tag Malware is used twice). I'd go for D

FortiAnalyzer 7.6 Analyst Study Guide, pag. 77

This is a tough one. My best educated guess is D.

this is definitely A

A mi me tienen que explicar porqué tienen puesta la B como correcta y cómo se supone que puede estar "un log" por detrás viendo una gráfica de logs por segundo... En mi opinión es la A

I think it is C.

A and C are analytics logs, B is Log Fetching

B is the only option that isn't immediately wrong.

The total disk quota for an ADOM is the sum of the quota allocated for Archive logs and Analytics logs. 900 MB + 2.1 GB = 3 GB.

Na coluna de logs breakdown: 601.0MB( 601.0MB/ **0.0KB**/ 0.0KB/ 0.0KB) O segundo campo após o parêntese refere-se a quarantine = 0.0KB Adicionalmente, nos devices: todos mostram 0.0KB para quarantine Isso indica que não há espaço/quota alocado para quarantine files

Quota Log (900MB) + Quota Database (2.1GB) = 3GB

The Security Fabric logs each session only once The first FortiGate that handles a session will log it No duplicate traffic logs for sessions originating from another Fabric member MAC address, except in following cases: If an upstream FortiGate performs NAT If upstream Fortigate devices continue to log UTM events

FortiAnalyzer 7.6 Analyst Study Guide - Pag.19 ""Traffic logging for a session logging is always carried out by the first FortiGate that handled it in the Security Fabric. FortiGate devices in the Security Fabric know the MAC addresses of their upstream and downstream peers. If FortiGate receives a packet from a MAC address that belongs to another FortiGate in the Security Fabric, it does not generate a new traffic log for that session. This approach helps to prevent the repeated logging of the same session by multiple FortiGate devices""

I checked the official docs on this topic, and C is the correct implementation.

A –Incorrect - Playbook logs are not generated per specific ADOM. Application logs are ADOM-specific and do not all reside in the root ADOM. B – Incorrect - The Study Guide states that application logs are ADOM-specific (not just application control logs). C –Correct - Local logs (archive logs) are not displayed in FortiView. FortiView uses only analytics logs. D –Correct - Event logs are available in the root ADOM. The Study Guide confirms that administrators can view event logs in the root ADOM with system-wide information.

A. Playbook logs for all ADOMs are in the root ADOM (Correct): FortiAnalyzer centralizes the execution logs of automation workflows and Playbooks from all Administrative Domains (ADOMs) inside the root ADOM, allowing a global monitoring view for the administrator. B. Application control logs are ADOM specific (Correct): Local logs related to application control capture app behavior events that strictly belong to and are isolated within the context of each specific ADOM.

Page 59 says administrators can view both local event logs and application logs in the root ADOM; FortiAnalyzer event logs are system-wide, while application logs are ADOM-specific.

Based on FortiAnalyzer, the two true statements regarding local logs are that playbook logs for all ADOMs are accessible in the root ADOM and event logs provide system-wide information, while application logs are ADOM-specific.

While incidents are also managed and synced across the Fabric, "Reports," "Logs," and "Events" are the core modules consistently identified in FortiAnalyzer documentation as the primary data types/modules accessible for centralized viewing on the supervisor

Logs (Log View): The Supervisor allows you to perform global real-time log searches and filtering across logs collected by all members and ADOMs within the fabric. Reports (Reports): It enables you to generate unified reports by correlating and consolidating information distributed across all fabric devices. Events (Incidents & Events): It centrally displays events and alerts individually generated by Event Handlers configured within each member FortiAnalyzer.

Using FortiAnalyzer Fabric, you can view logs, reports, and events generated on fabric members, directly on the supervisor

message rate should be lower and it is not in the 5 second window

In FortiAnalyzer, the raw message rate (Message Rate) and the rate of logs indexed into the database (Log Rate) should run closely in balance under normal operating conditions. When the chart displays a raw message rate that is significantly higher than the processed log rate, it indicates a severe performance anomaly. This is typically caused by a bottleneck in the SQL indexing engine, commonly known as a Receive/Insert Lag.

This indicates FortiAnalyzer has very little remaining log/message indexing activity, so indexing is close to finishing.

When FGT send log to FAZ, multiple logs may compress into 1 message for better performance, so you will see 2 rate, one is for message and one is for uncompressed log. This means that the message rate being higher than the log rate is not normal.