[2026年03月] 厳密検証されたFCP_FAZ_AN-7.6問題集と解答でFCP_FAZ_AN-7.6問題集と正解付き
ベストFortinet Certified Professional学習ガイドはFCP_FAZ_AN-7.6試験合格させます
質問 # 10
Which statement about sending notifications with incident update is true?
- A. Notifications can be sent only by email.
- B. Notifications can be sent only when an incident is updated or deleted.
- C. You can send notifications to multiple external platforms.
- D. If you use multiple fabric connectors, all connectors must have the same settings.
正解：C
解説：
In FortiOS and FortiAnalyzer, incident notifications can be sent to multiple external platforms, not limited to a single method such as email. Fortinet's security fabric and integration capabilities allow notifications to be sent through various fabric connectors and third-party integrations. This flexibility is designed to ensure that incident updates reach relevant personnel or systems using preferred communication channels, such as email, Syslog, SNMP, or integration with SIEM platforms.
質問 # 11
You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but, so far, you have been uncuccessful.
Which two tasks should you perform to investigate why you are having this issue? (Choose two.)
- A. Check logs in the Log Browse
- B. Review the ADOM data policy
- C. Open .gz log files in FortiView.
- D. Rebuild the SQL database and check FortiView.
正解：C、D
質問 # 12
Exhibit. What can you conclude from this output?
- A. The allocated disk quote to ADOM1 is 3 GB.
- B. Archive logs are using more space than analytic logs.
- C. There is not disk quota allocated to quarantining files.
- D. FGT_B is the Security Fabric root.
正解：A
解説：
The exhibit displays a diagnose log device output on a FortiAnalyzer, showing details about disk space usage and quotas for different FortiGate devices and ADOMs (Administrative Domains).
Here's a breakdown of key details:
Disk Quota for Quarantined Files:
The output includes columns labeled for used space in categories such as "logs," "quarantine,"
"content," and "DB." For each device, the quarantine column consistently shows 0.0KB used, indicating that there is no disk quota allocated or utilized for quarantining files.
質問 # 13
You crested a playbook on FortiAnalyzer that uses a FortiOS connector.
When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?
- A. Fabric Connector event
- B. Incoming webhook
- C. FortiOS Event Log
- D. FortiAnalyzer Event Handler
正解：B
解説：
When using FortiAnalyzer to create playbooks that interact with FortiOS devices, an Incoming Webhook trigger is required on the FortiGate side to make the actions in an automation stitch accessible through the FortiOS connector. The incoming webhook trigger allows FortiAnalyzer to initiate actions on FortiGate by sending HTTP POST requests to specified endpoints, which in turn trigger automation stitches defined on the FortiGate.
質問 # 14
After a generated a repot, you notice the information you were expecting to see in not included in it. However, you confirm that the logs are there:
Which two actions should you perform? (Choose two.)
- A. Disable auto-cache.
- B. Check the time frame covered by the report.
- C. Test the dataset.
- D. Increase the report utilization quota.
正解：B、C
解説：
When a generated report does not include the expected information despite the logs being present, there are several factors to check to ensure accurate data representation in the report.
Option A - Check the Time Frame Covered by the Report:
Reports are generated based on a specified time frame. If the time frame does not encompass the period when the relevant logs were collected, those logs will not appear in the report.
Ensuring the time frame is correctly set to cover the intended logs is crucial for accurate report content.
Option D - Test the Dataset:
Datasets in FortiAnalyzer define which logs and fields are pulled into the report. If a dataset is misconfigured, it could exclude certain logs. Testing the dataset helps verify that the correct data is being pulled and that all required logs are included in the report parameters.
質問 # 15
What is included in the disk quota for each ADOM on the FortiAnalyzer?
- A. Raw logs, archive files, SQL database tables
- B. Archive logs and analytics logs
- C. SQL tables and archive files
- D. Raw logs and archive files
正解：B
質問 # 16
Refer to the exhibit. What does the data point at 12:20 indicate?
- A. The sqiplugind service is caught up with the logs
- B. The log insert log time is increasing.
- C. FortiAnalyzer is using its cache to avoid dropping logs.
- D. The performance of FortiAnalyzer is below the baseline.
正解：B
解説：
Insert Rate vs. Receive Rate is a graph that shows the rate at which raw logs reach the FortiAnalyzer (receive rate) and the rate at which they are indexed (insert rate) by the SQL database and the sqlplugind daemon. At minimum, the difference between these parameters should be generally consistent.
Log Insert Lag Time shows the amount of time between when a log was received and when it was indexed. Ideally, this parameter should be as small as possible with the occasional spikes according to the network activity being logged. A good baseline should be created to allow for the identification of possible performance issues.
質問 # 17
Which statement about the FortiSOAR management extension is correct?
- A. It runs as a docker container on FortiAnalyzer.
- B. It does not include a limited trial by default.
- C. It requires a FortiManager configured to manage FortiGate.
- D. It requires a dedicated FortiSOAR device or VM.
正解：D
解説：
The FortiSOAR management extension is designed as an independent security orchestration, automation, and response (SOAR) solution that integrates with other Fortinet products but requires its own dedicated device or virtual machine (VM) environment. FortiSOAR is not natively integrated as a container or service within FortiAnalyzer or FortiManager, and it operates separately to manage complex security workflows and incident responses across various platforms.
質問 # 18
Which two statement regarding the outbreak detection service are true? (Choose two.)
- A. It automatically downloads new event handlers and reports.
- B. Outbreak alerts are available on the root ADOM only.
- C. An additional license is required.
- D. New alerts are received by email.
正解：A、C
解説：
The FortiAnalyzer Outbreak Detection Service is a licensed feature that requires a valid license to access outbreak alerts, event handlers, and reports. Without a valid license, these features are not available, and only a default alert page is shown.
When licensed, the service automatically downloads outbreak-related event handlers and reports from FortiGuard, enabling timely detection and response to emerging malware outbreaks.
https://docs.fortinet.com/document/fortianalyzer/7.0.0/new-features/371125/fortiguard-outbreak- detection-service
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/658619/outbreak- alerts
質問 # 19
You are trying to configure a task in the playbook editor to run a report. However, when you try to select the desired playbook, you do to see it listed.
What is the reason?
- A. You must create a trigger to run the report first.
- B. The playbook is currently running and will be available after it is finished.
- C. The report does not have auto-cache and extended log filtering enabled.
- D. The report has no result and must be reconfigured.
正解：C
質問 # 20
Which statement describes archive logs on FortiAnalyzer?
- A. Logs previously collected from devices that are offline
- B. Logs a FortiAnalyzer administrator can access in FortiView
- C. Logs compressed and saved in files with the .gz extension
- D. Logs that are indexed and stored in the SQL database
正解：C
解説：
Archive logs on FortiAnalyzer are logs that have been stored in files and, once a log file reaches its size limit, it is "rolled" and compressed, becoming offline logs. These compressed archive logs are saved as files, typically with the .gz extension, and are not immediately viewable or reportable in FortiView, Log View, or Reports panes.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/761825/analytics-and- archive-logs
質問 # 21
What is the purpose of playbook trigger variables?
- A. To display statistics about the playbook runtime
- B. To use information from the trigger to filter the action in a task
- C. To provide the trigger information to make the playbook start running
- D. To store the start the times of playbooks with On_Schedule triggers
正解：A
質問 # 22
Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)
- A. Send Alert through FortiSIEM MEA
- B. Send Alert through Fabric Connectors
- C. Send SMS notification
- D. Send SNMP trap
正解：B、D
解説：
Send Alert through Fabric Connectors: This method involves creating a Fabric Connector profile and selecting the option "Send Alert through Fabric Connectors" in the event handler notification settings. Notifications are then sent in JSON format to the configured endpoint, such as Microsoft Teams or other integrated platforms.
Send SNMP trap: You can configure SNMP traps to be sent when an event triggers an incident.
This involves setting the SNMP Trap IP address, community string, trap type, and protocol in the system's analytics or incident settings.
質問 # 23
Exhibit. What can you conclude about these search results? (Choose two.)
- A. They can be downloaded to a file.
- B. They are not available for analysis in FortiView.
- C. They are sortable by columns and customizable.
- D. They were searched by using text mode.
正解：A、D
解説：
In this exhibit, we observe a search query on the FortiAnalyzer interface displaying log data with details about the connection events, including fields like date, srcip, dstip, service, and dstintf.
This setup allows for several functionalities within FortiAnalyzer.
A). They can be downloaded to a file.
The icon at the top right that looks like a download symbol suggests the results can be exported or downloaded.
D). They were searched by using text mode.
The display format of the log entries in raw text with detailed fields (e.g., date=, time=, srcip=, etc.) indicates that text mode was used for the search rather than a summarized or GUI-based log view.
質問 # 24
Which two external servers can you configure to validate administrator logins? (Choose two.)
- A. LDAP
- B. Only locally by FortiAnalyzer
- C. RADIUS
- D. Syslog
正解：A、C
質問 # 25
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?
- A. A new infected entry is added for the corresponding endpoint under Compromised Hosts.
- B. The detection engine classifies those logs as Suspicious.
- C. FortiAnalyzer flags the associated host for further analysis.
- D. The endpoint is marked as Compromised and, optionally, can be put in quarantine.
正解：A
質問 # 26
Exhibit. What is the analyst trying to create?
- A. The analyst is trying to create a report in the playbook.
- B. The analyst is trying to create an output variable to be used in the playbook.
- C. The analyst is trying to create a trigger variable to the used in the playbook.
- D. The analyst is trying to create a SOC report in the playbook.
正解：B
解説：
In the exhibit, the playbook configuration shows the analyst working with the "Attach Data" action within a playbook. Here's a breakdown of key aspects:
Incident ID: This field is linked to the "Playbook Starter," which indicates that the playbook will attach data to an existing incident.
Attachment: The analyst is configuring an attachment by selecting Run_REPORT with a placeholder ID for report_uuid. This suggests that the report's UUID will dynamically populate as part of the playbook execution.
Option B - Creating an Output Variable:
The field Attachment with a report_uuid placeholder suggests that the analyst is defining an output variable that will store the report data or ID, allowing it to be attached to the incident. This variable can then be referenced or passed within the playbook for further actions or reporting.
質問 # 27
What is the purpose of using data selectors when configuring event handlers?
- A. They download new filters can be used in event handlers.
- B. They are common filters that can be applied simultaneously to all event handlers.
- C. They filter the types of logs that FortiAnalyzer can accept from registered devices.
- D. They apply their filter criteria to the entire event handler so that you don't have to configure the same criteria in the individual rules.
正解：D
質問 # 28
Exhibit. Assume these are all the events that exist on the FortiAnalyzer device. How many events will be added to the incident created after running this playbook?
- A. Seven events will be added
- B. No events will be added.
- C. Eleven events will be added.
- D. Four events will be added.
正解：D
解説：
In the exhibit, we see a playbook in FortiAnalyzer designed to retrieve events based on specific criteria, create an incident, and attach relevant data to that incident. The "Get Event" task configuration specifies filters to match any of the following conditions:
Severity = High
Event Type = Web Filter
Tag = Malware
Analysis of Events:
In the FortiAnalyzer Event Monitor list:
We need to identify events that meet any one of the specified conditions (since the filter is set to
"Match Any Condition").
Events Matching Criteria:
Severity = High:
There are two events with "High" severity, both with the "Event Type" IPS.
Event Type = Web Filter:
There are two events with the "Event Type" Web Filter. One has a "Medium" severity, and the other has a "Low" severity.
Tag = Malware:
There are two events tagged with "Malware," both with the "Event Type" Antivirus and "Medium" severity.
After filtering based on these criteria, there are four distinct events:
Two from the "Severity = High" filter.
One from the "Event Type = Web Filter" filter.
One from the "Tag = Malware" filter.
質問 # 29
Exhibit. A fortiAnalyzer analyst is customizing a SQL query to use in a report. Which SQL query should the analyst run to get the expected results?
- A.
- B.
- C.
- D.
正解：A
解説：
The requirement here is to construct a SQL query that retrieves logs with specific fields, namely
"Source IP" and "Destination Port," for entries where the source IP address matches 10.0.1.10.
The correct syntax is essential for selecting, filtering, ordering, and grouping the results as shown in the expected outcome.
質問 # 30
You discover that a few reports are taking a long tine lo generate. Which two steps can you Like to troubleshoot? (Choose two.)
- A. Enable auto-cache and run the reports again
- B. Review report diagnostics
- C. Increase the ADOM reports quota
- D. Remove old reports from the hcache
正解：A、D
質問 # 31
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)
- A. FortiAnalyzer local cache is used to store generated reports.
- B. The generation time for reports is decreased.
- C. When new logs are received, the hard-cache data is updated automatically.
- D. The size of newly generated reports is optimized to conserve disk space.
正解：A、B
解説：
Enabling auto-cache in FortiAnalyzer reports is designed to improve the efficiency and speed of report generation by leveraging cached data. Let's analyze each option to determine which effects are correct.
Option A - The Generation Time for Reports is Decreased:
When auto-cache is enabled, FortiAnalyzer can use previously cached data instead of reprocessing all log data from scratch each time a report is generated. This results in faster report generation times, especially for recurring reports that use similar datasets.
Option C - FortiAnalyzer Local Cache is Used to Store Generated Reports:
Auto-cache utilizes FortiAnalyzer's local cache to store data used in reports, reducing the need to retrieve and process logs repeatedly. This cached data can be reused for subsequent report generation, enhancing performance.
質問 # 32
......
FCP_FAZ_AN-7.6認定ガイド問題と解答トレーニングにはFast2test：https://jp.fast2test.com/FCP_FAZ_AN-7.6-premium-file.html
FCP_FAZ_AN-7.6認定お試しPDFで最新FCP_FAZ_AN-7.6問題集：https://drive.google.com/open?id=16MzJwznuPAf54dhsh4TFirn-90nO1xu3