Fortinet FCP_FAZ_AN-7.4 Practice Exams
Last updated on Oct 01,2026- Exam Code: FCP_FAZ_AN-7.4
- Exam Name: Fortinet FCP - FortiAnalyzer 7.4 Analyst
- Certification Provider: Fortinet
- Latest update: Oct 01,2026
Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally? (Choose two.)
- A . Mail server
- B . Output profile
- C . SFTP server
- D . Report scheduling
A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails.
What will be the status of the playbook after it is run?
- A . Running
- B . Failed
- C . Upstream_failed
- D . Success
Refer to the exhibit.
Which image corresponds to the packet capture shown in the exhibit?
A)
B)
C)
D)
- A . Option A
- B . Option B
- C . Option C
- D . Option D
When managing incidents on FortiAnlyzer, what must an analyst be aware of?
- A . You can manually attach generated reports to incidents.
- B . The status of the incident is always linked to the status of the attach event.
- C . Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.
- D . Incidents must be acknowledged before they can be analyzed.
As part of your analysis, you discover that a Medium severity level incident is fully remediated.
You change the incident status to Closed:Remediated.
Which statement about your update is true?
- A . The incident can no longer be deleted.
- B . The corresponding event will be marked as Mitigated.
- C . The incident dashboard will be updated.
- D . The incident severity will be lowered.
Exhibit.
What does the data point at 12:20 indicate?
- A . The log insert log time is increasing.
- B . FortiAnalyzer is using its cache to avoid dropping logs.
- C . The performance of FortiAnalyzer is below the baseline.
- D . The sqiplugind service is caught up with the logs
View the exhibit.
What does the data point at 14:35 tell you?
- A . FortiAnalyzer is dropping logs.
- B . The sqlplugind daemon is ahead in indexing by one log.
- C . FortiAnalyzer has temporarily stopped receiving logs so older logs’ can be indexed.
- D . FortiAnalyzer is indexing logs faster than logs are being received.
Which statements are correct regarding FortiAnalyzer reports? (Choose two)
- A . FortiAnalyzer provides the ability to create custom reports.
- B . FortiAnalyzer glows you to schedule reports to run.
- C . FortiAnalyzer includes pre-defined reports only.
- D . FortiAnalyzer allows reporting for FortiGate devices only.
Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)
- A . FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.
- B . SSL encryption levels are globally set on FortiAnalyzer.
- C . SSL can send logs in real-time only.
- D . SSL is the default setting.
- E . SSL communications are auto-negotiated between the two devices.
Which two statements are true regarding ADOM modes? (Choose two.)
- A . You can only change ADOM modes through CL
- B . In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADO
- C . In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.
- D . Normal mode is the default ADOM mode.