FCP_FAZ_AN-7.6 Questions and Answers

The study guide explains that in a Security Fabric,traffic logging is not duplicatedacross FortiGates for the same session:“Traffic logging for a session … is always carried out by the first FortiGate that handled it”and if a FortiGate receives traffic from a peer FortiGate MAC,“it does not generate a new traffic log for that session.”

For UTM (web filtering) logs, the study guide states:“When configured, upstream devices complete UTM logging.”

In the illustrated example, it further clarifies the role split:“All traffic from Client-1 is first received by FGT-B, which creates traffic logs for the initial session… [then] forwarded to FGT-A… [and] FGT-A … applies web filtering … and generates the relevant UTM logs as necessary.”

Because web filter profiles are configured tolog only violations, web filter (UTM) logs will be generated only when a violation is detected—and per the study guide behavior, that UTM logging is done by theupstreamFortiGate (FGT-A). Therefore,only FGT-A will create web filter logs if it detects a violation(Option D).

When a generated report does not include the expected information despite the logs being present, there are several factors to check to ensure accurate datarepresentation in the report.

Option A - Check the Time Frame Covered by the Report:

Reports are generated based on a specified time frame. If the time frame does not encompass the period when the relevant logs were collected, those logs will not appear in the report. Ensuring the time frame is correctly set to cover the intended logs is crucial for accurate report content.

Conclusion:Correct.

Option B - Disable Auto-Cache:

Auto-cache is a feature in FortiAnalyzer that helps optimize report generation by using cached data for frequently used datasets. Disabling auto-cache is generally not necessary unless there is an issue with outdated data being used. In most cases, it does not directly impact whether certain logs are included in a report.

Conclusion:Incorrect.

Option C - Increase the Report Utilization Quota:

The report utilization quota controls the resource limits for generating reports. While insufficient quota might prevent a report from generating or completing, it does not typically cause specific log entries to be missing. Therefore, this option is not directly relevant to missing data within the report.

Conclusion:Incorrect.

Option D - Test the Dataset:

Datasets in FortiAnalyzer define which logs and fields are pulled into the report. If a dataset is misconfigured, it could exclude certain logs. Testing the dataset helps verify that the correct data is being pulled and that all required logs are included in the report parameters.

Conclusion:Correct.

Conclusion:

Correct Answer:A. Check the time frame covered by the reportandD. Test the dataset.

These actions directly address the issues that could cause missing information in a report when logs are available but not displayed.

In FortiAnalyzer's incident management system, analysts have the option to manually manage incidents, which includes attaching relevant reports to an incident for further investigation and documentation. This feature allows analysts to consolidate information, such as detailed reports on suspicious activity, into an incident record, providing a comprehensive view for incident response.

Let's review the other options to clarify why they are incorrect:

Option A: You can manually attach generated reports to incidents

This is correct. FortiAnalyzer allows analysts to manually attach reports to incidents, which is beneficial for providing additional context, evidence, or analysis related to the incident. This functionality is part of the incident management process and helps streamline information for tracking and resolution.

Option B: The status of the incident is always linked to the status of the attached event

This is incorrect. The status of an incident on FortiAnalyzer is managed independently of the status of any attached events. An incident can contain multiple events, each with different statuses, but the incident itself is tracked separately.

Option C: Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour

This is incorrect. While incidents have severity levels, specific SLA response times are typically set according to the organization’s incident response policy, and FortiAnalyzer does not impose a default SLA response time of 1 hour for high-severity incidents.

Option D: Incidents must be acknowledged before they can be analyzed

This is incorrect. Incidents on FortiAnalyzer can be analyzed even if they are not yet acknowledged. Acknowledging an incident is often part of the workflow to mark it as being actively addressed, but it is not a prerequisite for analysis.

Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:

FortiAnalyzer’s ingestion pipeline does not “drop” logs simply because a parser is unavailable. The study guide states that when devices send logs,“Logs received are decompressed and saved in a log file on the FortiAnalyzer disk”(with a .log extension). This establishes that the raw log is still accepted and stored on disk as part of the normal workflow.

Normalization, however, depends on having a suitable parser. The study guide explains that“FortiAnalyzer uses predefined parsers to extract key fields from ingested logs and maps them to a consistent, standardized set of field names.”It further emphasizes that“Log parsers … are central to log normalization”because they convert unstructured/native logs into a standardized schema.

Therefore, ifno matching parserexists for a given device log, FortiAnalyzer can stillstore the incoming log(it is received, decompressed, and written to disk), but it cannot perform the “extract key fields” and “map to standardized field names” steps required for normalization. In practical terms, the log remains in its native/unstructured form (not normalized), which aligns exactly with optionC.

When you frequently use the same search parameters in FortiAnalyzer’s Log View, setting up a reusable filter or view can saveconsiderable time. Here’s an analysis of each option:

Option A - Configure a Custom Dashboard:

Custom dashboards are useful for displaying a variety of widgets and summaries on network activity, performance, and threat data, but they are not designed for storing specific search filters for log views.

Conclusion:Incorrect.

Option B - Configure a Custom View:

Custom views in FortiAnalyzer allow analysts to save specific search filters and configurations. By setting up a custom view, you can retain your frequently used search parameters and quickly access them without needing to reapply filters each time. This option is specifically designed to streamline the process of recurring log searches.

Conclusion:Correct.

Option C - Configure a Data Selector:

Data selectors are used to define specific types of data for FortiAnalyzer reports and widgets. They are useful in reports but are not meant for saving and reusing log search parameters in Log View.

Conclusion:Incorrect.

Option D - Configure a Macro and Apply It to Device Groups:

Macros in FortiAnalyzer are generally used for automation tasks, not for saving log search filters. Applying macros to device groups does not fulfill the requirement of saving specific log view search parameters.

Conclusion:Incorrect.

Conclusion:

Correct Answer:B. Configure a custom view.

Custom views allow you to save specific search filters, enabling quick access to frequently used parameters in Log View.

In the exhibit, the data structure shows a checksum field and a data field with a long, seemingly encoded string. This format is indicative of a file that has been compressed or encoded for storage and transfer.

Export Data Type:

The data field is likely a base64-encoded string, which is commonly used to represent binary data in text format. Base64 encoding is often applied to data that has been compressed (zipped) for easier handling and transfer. The checksum field, with an MD5 hash, provides a way to verify the integrity of the data after decompression.

Option Analysis:

A. The export data type is zipped: Correct. The compressed and encoded format of the data suggests that the export is in a zipped format, allowing for efficient storage and transfer.

B. The playbook is misconfigured: There is no indication of misconfiguration in this exhibit. The presence of the checksum and data fields aligns with standard export practices.

C. The option to include the connector was not selected: There is no evidence in the output to conclude that connectors are missing. Connectors are typically listed separately and would not directly affect the checksum and encoded data structure.

D. Your colleague put a password on the export: There’s no indication of password protection in the exhibit. Password protection would likely alter the data structure, and there would be some mention of encryption.

Conclusion:

Correct Answer:A. The export data type is zipped.

This answer is consistent with the typical use of base64 encoding for compressed (zipped) data exports in FortiAnalyzer.

In the exhibit, we see a playbook in FortiAnalyzer designed to retrieve events based on specific criteria, create an incident, and attach relevant data to that incident. The "Get Event" task configuration specifies filters to match any of the following conditions:

Severity= High

Event Type= Web Filter

Tag= Malware

Analysis of Events:

In the FortiAnalyzer Event Monitor list:

We need to identify events that meet any one of the specified conditions (since the filter is set to "Match Any Condition").

Events Matching Criteria:

Severity = High:

There are two events with "High" severity, both with the "Event Type" IPS.

Event Type = Web Filter:

There are two events with the "Event Type" Web Filter. One has a "Medium" severity, and the other has a "Low" severity.

Tag = Malware:

There are two events tagged with "Malware," both with the "Event Type" Antivirus and "Medium" severity.

After filtering based on these criteria, there arefour distinct events:

Two from the "Severity = High" filter.

One from the "Event Type = Web Filter" filter.

One from the "Tag = Malware" filter.

Conclusion:

Correct Answer:D. Four events will be added.

This answer matches the conditions set in the playbook filter configuration and the events listed in the Event Monitor.

To viewCompromised Hostson FortiAnalyzer, certain configurations need to be in place on both FortiGate and FortiAnalyzer. Compromised Host data on FortiAnalyzer relies on log information from FortiGate to analyze threats and compromised activities effectively. Here’s why the selected answers are correct:

Option A: Enable device detection on the FortiGate devices that are sending logs to FortiAnalyzer

Enabling device detection on FortiGate allows it to recognize and log devices within the network, sending critical information about hosts that could be compromised. This is essential because FortiAnalyzer relies on these logs to determine which hosts may be at risk based on suspicious activities observed by FortiGate. This setting enables FortiGate to provide device-level insights, which FortiAnalyzer uses to populate the Compromised Hosts view.

Option B: Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer

Web filtering is crucial in identifying potentially compromised hosts since it logs any access to malicious sites or blocked categories. FortiAnalyzer uses these web filter logs to detect suspicious or malicious web activity, which can indicate compromised hosts. By ensuring that FortiGate sends these web filtering logs to FortiAnalyzer, the administrator enables FortiAnalyzer to analyze and identify hosts engaging in risky behavior.

Let’s review the otheroptions for clarity:

Option C: Make sure all endpoints are reachable by FortiAnalyzer

This is incorrect. FortiAnalyzer does not need direct access to all endpoints. Instead, it collects data indirectly from FortiGate logs. FortiGate devices are theones that interact with endpoints and then forward relevant logs to FortiAnalyzer for analysis.

Option D: Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date

Although subscribing to FortiGuard helps keep threat intelligence updated, it is not a requirement specifically to view compromised hosts. FortiAnalyzer primarily uses logs from FortiGate (such as web filtering and device detection) to detect compromised hosts.

Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:

The exhibit shows the eventEvent Status = MitigatedandEvent Type = Web Filter, with the event message indicating the web request wasblocked.

The study guide definesMitigatedevents as follows:“Mitigated: The security risk is mitigated by being blocked or dropped.”This means a mitigated status corresponds to enforcement that prevented the risk (block/drop), not a condition where the source is isolated.

It also distinguishesContainedevents from mitigated ones:“Contained: The risk source is isolated.”Since the exhibit clearly showsMitigated(not Contained), optionBis incorrect.

Additionally, the study guide notes:“Generally, you can acknowledge mitigated events because the related traffic was blocked by the firewall.”This aligns directly with the exhibit’s “blocked” wording and supports that the correct interpretation is that the security risk was blocked.

Finally, the event type displayed isWeb Filter, not application control, so optionDis incorrect.

Therefore, the correct statement isC. The security risk was blocked.

Macros in FortiAnalyzer are used to streamline reporting tasks by automating dataextraction and report generation. Here’s a breakdown of each option to determine the correct answer:

Option A - Macros are Predefined Templates for Reports and Cannot be Customized:

This statement is incorrect. Macros in FortiAnalyzer are not simply fixed templates; they allow for customization to tailor data extraction and reporting based on specific needs and configurations.

Conclusion:Incorrect.

Option B - Macros are Useful in Generating Excel Log Files Automatically Based on the Report Settings:

This statement is accurate. Macros in FortiAnalyzer can be configured to automate the generation of reports, including outputting log data to Excel format based on predefined report settings. This makes them especially useful for scheduled reporting and data analysis.

Conclusion:Correct.

Option C - Macros are ADOM-Specific and Each ADOM Type Has Unique Macros Relevant to that ADOM:

Macros are not limited to specific ADOMs, nor are they ADOM-specific. Macros can be applied across various ADOMs based on report configurations but are not inherently tied to or unique for each ADOM type.

Conclusion:Incorrect.

Option D - Macros are Supported Only on the FortiGate ADOMs:

This is not true. Macros in FortiAnalyzer are not restricted to FortiGate ADOMs; they can be utilized across different ADOMs that FortiAnalyzer manages.

Conclusion:Incorrect.

Conclusion:

Correct Answer:B. Macros are useful in generating excel log files automatically based on the report settings.

This answer correctly describes thefunctionality of macros in FortiAnalyzer, emphasizing their role in automating report generation, especially for Excel log files.