FCP_FAZ_AN-7.6 Study Guide Latest [Jul 19, 2026] Realistic Verified FCP_FAZ_AN-7.6 Dumps [Q20-Q39]

Rate this post

FCP_FAZ_AN-7.6 Study Guide: Latest [Jul 19, 2026] Realistic Verified FCP_FAZ_AN-7.6 Dumps

FCP_FAZ_AN-7.6 Questions & Practice Test are Available On-Demand

Fortinet FCP_FAZ_AN-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	Reports: This domain explains the use of reports, charts, and datasets for presenting security intelligence, covers report configuration to meet organizational requirements, and includes troubleshooting report generation problems.
Topic 2	Log Analysis: This domain focuses on examining and interpreting logs, events, and incidents, using FortiView dashboards and widgets for data visualization, and diagnosing report generation issues.
Topic 3	SOC operation and automation: This domain addresses configuring events and event handlers, setting up incidents and indicators for threat tracking, configuring playbooks and fabric automation for orchestrated responses, and troubleshooting automation workflow issues.
Topic 4	Features and concepts: This domain covers FortiAnalyzer’s integration with Security Fabric for log collection, the technical processes of log data flow, normalization and parsing, and the SOC features available for security monitoring and analysis.

QUESTION 20
You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but, so far, you have been unsuccessful.
Which two tasks should you perform to investigate why you are having this issue? (Choose two.)

Open .gz log files in FortiView.

Rebuild the SQL database and check FortiView.

Review the ADOM data policy

Check logs in the Log Browse

QUESTION 21
Which statement about exporting items in Report Definitions is true?

Templates can be exported.

Template exports contain associated charts and datasets.

Chart exports contain associated datasets.

Datasets can be exported.

QUESTION 22
An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer. Which item must configure on FortiAnalyzer so that emails are sent when the reports are generated?

Enable the option to email all repots under the mail server.

Add a mailto:<email address> option within the report layouts.

Enable email notification under the report calendar.

Enable an output profile on the reports.

QUESTION 23
You need to move reports between two ADOMs.
Which two statements are true? (Choose two.)

The ADOMs must be compatible types.

The data and time will be appointed to the original report name to avoid conflicts.

All charts and datasets associated with the report will be imported together.

You need to convert the reports into templates first.

QUESTION 24
Refer to the exhibit.

An analyst is trying to create a dataset to pull all gambling websites that were visited by end users.
Which SQL query on FortiAnalyzer will give the result shown in the exhibit?

[Selected] select srcip as ” SourceIP ” , dstip as ” DestIP ” , url from $log where catdesc = ‘ Gambling ‘

select srcip as ” SourceIPv6 ” , dstip as ” DestIPv6 ” , url from $log where catdesc = ‘ Gambling ‘

select srcip as ” SourceIP ” , dstip as ” DestIP ” , url from $log where catdesc = ‘ Dating ‘

select srcip as ” SourceIP ” , dstip as ” DestIP ” , url from ‘ Gambling ‘ where catdesc = $log

QUESTION 25
Exhibit. Assume these are all the events that exist on the FortiAnalyzer device. How many events will be added to the incident created after running this playbook?

Eleven events will be added.

Seven events will be added

No events will be added.

Four events will be added.

QUESTION 26
Which log will generate an event with the status Unhandled?

An AV log with action=quarantine.

An IPS log with action=pass.

A WebFilter log will action=dropped.

An AppControl log with action=blocked.

QUESTION 27
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

FortiAnalyzer flags the associated host for further analysis.

A new infected entry is added for the corresponding endpoint under Compromised Hosts.

The detection engine classifies those logs as Suspicious.

The endpoint is marked as Compromised and, optionally, can be put in quarantine.

QUESTION 28
Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

They are not supported in FortiView.

You can view playbook logs for all ADOMs in the root ADOM.

Event logs show system-wide information, whereas application logs are ADOM specific.

Event logs are available only in the root ADOM.

QUESTION 29
You created a playbook on FortiAnalyzer that uses a FortiOS connector.
When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stich are available in the FortiOS connector?

FortiAnalyzer Event Handler

Fabric Connector event

FortiOS Event Log

Incoming webhook

QUESTION 30
Refer to the exhibit. What can you conclude from this output?

The allocated disk quota to ADOM1 is 3 GB.

There is no disk quota allocated to quarantining files.

Archive logs are using more space than analytic logs.

ADOM1 has 300 MB of disk space remaining.

QUESTION 31
You crested a playbook on FortiAnalyzer that uses a FortiOS connector.
When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

FortiAnalyzer Event Handler

Fabric Connector event

FortiOS Event Log

Incoming webhook

QUESTION 32
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

The size of newly generated reports is optimized to conserve disk space.

The hcache data is updated automatically when new logs are received.

The report generation time is reduced.

FortiAnalyzer local cache is used to store generated reports.

QUESTION 33
Exhibit.

What is the purpose of using the Chart Builder feature On FortiAnalyzer?

To build a chart automatically based on the top 100 log entries

To add charts directly to generate reports in the current ADOM.

To add a new chart under FortiView to be used in new reports

To build a dataset and chart based on the filtered search results

QUESTION 34
Which statement regarding macros on FortiAnalyzer is true?

Macros are predefined templates for reports and cannot be customized.

Macros are useful in generating excel log files automatically based on the report settings.

Macros are ADOM-specific and each ADOM type have unique macros relevant to that ADOM.

Macros are supported only on the FortiGate ADOMs.

QUESTION 35
Why must you wait for several minutes before you run a playbook that you just created?

FortiAnalyzer needs that time to back up the current playbooks.

FortiAnalyzer needs that time to debug the new playbook.

FortiAnalyzer needs that time to ensure there are no other playbooks running.

FortiAnalyzer needs that time to parse the new playbook.

QUESTION 36
Exhibit.

What can you conclude about these search results? (Choose two.)

They can be downloaded to a file.

They are sortable by columns and customizable.

They are not available for analysis in FortiView.

They were searched by using text mode.

QUESTION 37
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

The generation time for reports is decreased.

When new logs are received, the hard-cache data is updated automatically.

FortiAnalyzer local cache is used to store generated reports.

The size of newly generated reports is optimized to conserve disk space.

Enabling auto-cache in FortiAnalyzer reports is designed to improve the efficiency and speed of report generation by leveraging cached data. Let’s analyze each option to determine which effects are correct.
* Option A – The Generation Time for Reports is Decreased:
* When auto-cache is enabled, FortiAnalyzer can use previously cached data instead of reprocessing all log data from scratch each time a report is generated. This results in faster report generation times, especially for recurring reports that use similar datasets.
* Conclusion: Correct.
* Option B – Hard-Cache Data is Automatically Updated When New Logs are Received:
* Enabling auto-cache does not immediately update the cache with every new log received. Instead, the cache is updated when reports are generated, based on the existing logs up to that point.
Therefore, auto-cache does not constantly refresh with each incoming log, which would be inefficient.
* Conclusion: Incorrect.
* Option C – FortiAnalyzer Local Cache is Used to Store Generated Reports:
* Auto-cache utilizes FortiAnalyzer’s local cache to store data used in reports, reducing the need to retrieve and process logs repeatedly. This cached data can be reused for subsequent report generation, enhancing performance.
* Conclusion: Correct.
* Option D – The Size of Newly Generated Reports is Optimized to Conserve Disk Space:
* Auto-cache does not directly impact the size of the report files themselves. It focuses on performance optimization through cached data for faster access, but it does not compress or optimize the storage size of the generated report.
* Conclusion: Incorrect.
Conclusion:
* Correct Answer: A. The generation time for reports is decreased and C. FortiAnalyzer local cache is used to store generated reports.
* Enabling auto-cache helps reduce report generation time by using locally cached data and optimizes report processing, though it does not impact report size or continuously update with each new log.
References:
FortiAnalyzer 7.4.1 documentation on report caching, auto-cache functionality, and report generation optimizations.

QUESTION 38
Which two external servers can you configure to validate administrator logins? (Choose two.)

RADIUS

Only locally by FortiAnalyzer

Syslog

LDAP

QUESTION 39
Exhibit.

A FortiAnalyzer analyst is customizing a SQL query to use in a report.
Which SQL query should the analyst run to get the expected results?