[2025年更新]無料FCP_FAZ_AN-7.6試験問題集はパス試験は超簡単
FCP_FAZ_AN-7.6試験問題集でFCP_FAZ_AN-7.6練習テスト問題
質問 # 11
Refer to the exhibit with partial output:
Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observer the output as shown in the exhibit.
Which statement about the export is true?
- A. The export data type is zipped.
- B. The playbook is misconfigured.
- C. Your colleague put a password on the export.
- D. The option to include the connector was not selected.
正解：A
解説：
In the exhibit, the data structure shows a checksum field and a data field with a long, seemingly encoded string. This format is indicative of a file that has been compressed or encoded for storage and transfer.
Export Data Type:
The data field is likely a base64-encoded string, which is commonly used to represent binary data in text format. Base64 encoding is often applied to data that has been compressed (zipped) for easier handling and transfer. The checksum field, with an MD5 hash, provides a way to verify the integrity of the data after decompression.
質問 # 12
Exhibit. Which statement about the event displayed is correct?
- A. An incident was created from this event.
- B. The security risk was blocked or dropped.
- C. The risk source is isolated.
- D. The security event risk is considered open.
正解：B
解説：
In FortiOS and FortiAnalyzer logging systems, when an event has a status of "Mitigated" in the Event Status column, it typically indicates that the system took action to address the identified threat. In this case, the Web Filter blocked the web request to a suspicious destination, and the event status "Mitigated" confirms that the action was successfully implemented to neutralize or block the security risk.
質問 # 13
Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)
- A. Send SNMP trap
- B. Send Alert through Fabric Connectors
- C. Send Alert through FortiSIEM MEA
- D. Send SMS notification
正解：A、B
解説：
Send Alert through Fabric Connectors: This method involves creating a Fabric Connector profile and selecting the option "Send Alert through Fabric Connectors" in the event handler notification settings. Notifications are then sent in JSON format to the configured endpoint, such as Microsoft Teams or other integrated platforms.
Send SNMP trap: You can configure SNMP traps to be sent when an event triggers an incident.
This involves setting the SNMP Trap IP address, community string, trap type, and protocol in the system's analytics or incident settings.
質問 # 14
Refer to the exhibit. What can you conclude about the output?
- A. The output is not ADOM specific.
- B. The low indexing values require investigation.
- C. There are more event logs than traffic logs.
- D. The log rate higher than the message rate is not normal.
正解：D
質問 # 15
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)
- A. When new logs are received, the hard-cache data is updated automatically.
- B. The generation time for reports is decreased.
- C. FortiAnalyzer local cache is used to store generated reports.
- D. The size of newly generated reports is optimized to conserve disk space.
正解：B、C
解説：
Enabling auto-cache in FortiAnalyzer reports is designed to improve the efficiency and speed of report generation by leveraging cached data. Let's analyze each option to determine which effects are correct.
Option A - The Generation Time for Reports is Decreased:
When auto-cache is enabled, FortiAnalyzer can use previously cached data instead of reprocessing all log data from scratch each time a report is generated. This results in faster report generation times, especially for recurring reports that use similar datasets.
Option C - FortiAnalyzer Local Cache is Used to Store Generated Reports:
Auto-cache utilizes FortiAnalyzer's local cache to store data used in reports, reducing the need to retrieve and process logs repeatedly. This cached data can be reused for subsequent report generation, enhancing performance.
質問 # 16
Which statement describes archive logs on FortiAnalyzer?
- A. Logs that are indexed and stored in the SQL database
- B. Logs previously collected from devices that are offline
- C. Logs a FortiAnalyzer administrator can access in FortiView
- D. Logs compressed and saved in files with the .gz extension
正解：D
解説：
Archive logs on FortiAnalyzer are logs that have been stored in files and, once a log file reaches its size limit, it is "rolled" and compressed, becoming offline logs. These compressed archive logs are saved as files, typically with the .gz extension, and are not immediately viewable or reportable in FortiView, Log View, or Reports panes.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/761825/analytics-and- archive-logs
質問 # 17
Why must you wait for several minutes before you run a playbook that you just created?
- A. FortiAnalyzer needs that time to ensure there are no other playbooks running.
- B. FortiAnalyzer needs that time to debug the new playbook.
- C. FortiAnalyzer needs that time to parse the new playbook.
- D. FortiAnalyzer needs that time to back up the current playbooks.
正解：C
解説：
When a new playbook is created on FortiAnalyzer, the system requires some time to parse and validate the playbook before it can be executed. Parsing involves checking the playbook's structure, ensuring that all syntax and logic are correct, and preparing the playbook for execution within FortiAnalyzer's automation engine. This initial parsing step is necessary for FortiAnalyzer to load the playbook into its operational environment correctly.
質問 # 18
Refer to Exhibit. Client-1 is trying to access the internet for web browsing. All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured. All firewall policies have logging enabled. All web filter profiles are configured to log only violations.
Which statement about the logging behavior for this specific traffic flow is true?
- A. FGT B will create traffic logs and will create web filter logs if it detects a violation.
- B. Only FGT-A will create web filter logs if it detects a violation.
- C. FGT-B will see the MAC address of FGT-A as the destination and notifies FGT-A to log this flow.
- D. Only FGT-B will create traffic logs.
正解：A
解説：
The topology shows a Security Fabric setup involving FortiGate devices (FGT-A and FGT-B) and a FortiAnalyzer for centralized logging. Let's break down the logging and traffic flow behavior:
Traffic Flow Analysis:
Client-1 initiates web traffic directed to the internet, which is routed through FGT-B and then FGT- A before reaching the internet. This is indicated by the direction of the red-dashed arrow from Client-1 through FGT-B to FGT-A.
Policy and NAT Settings:
On FGT-B, NAT is disabled, meaning it will pass the traffic through without altering the source IP.
This device has a Web Filter enabled with a policy to log violations only. On FGT-A, NAT is enabled, and a Web Filter profile is also applied. Like FGT-B, it logs only violations for web filtering.
Logging Behavior:
Since both FortiGate devices have logging enabled for traffic and web filtering, they can create logs if conditions are met.
FGT-B will log all traffic, as per its configuration, and will also create web filter logs if it detects a violation, as the web filter profile is applied. Because NAT is disabled on FGT-B, it processes the traffic but doesn't perform any address translation, allowing it to see the original source IP of Client-1. FGT-A, as the Security Fabric root, will handle NAT and forward the traffic to the internet. However, in this case, the question is focused on where the traffic and web filter logs would be generated first, particularly by FGT-B.
質問 # 19
What is the purpose of using data selectors when configuring event handlers?
- A. They are common filters that can be applied simultaneously to all event handlers.
- B. They filter the types of logs that FortiAnalyzer can accept from registered devices.
- C. They download new filters can be used in event handlers.
- D. They apply their filter criteria to the entire event handler so that you don't have to configure the same criteria in the individual rules.
正解：D
質問 # 20
Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin", and coming from Laptop1.
Which filter will achieve the desired result?
- A. Operation-login and dstip==10.1.1.210 and user!-admin
- B. Operation-login and performed_on==''GUI(10.1.1.100)' and user!=admin
- C. Operation-login and performed_on==''GU (10.1.1.120)' and user!=admin
- D. Operation-login and srcip== 10.1.1.100 and dstip==10.1.1.1.210 and user==admin
正解：B
解説：
On there the task was to create a filter for failed logins from any other location but the local computer:
"Add the text performed_on!~10.0.1.10.
This includes any attempts coming from devices with an IP address that is not the one configured on the Local-Client computer."
質問 # 21
Which two actions should an administrator take to vide Compromised Hosts on FortiAnalyzer?
(Choose two.)
- A. Enable device detection on the FotiGate device that are sending logs to FortiAnalyzer.
- B. Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to fortiAnalyzer.
- C. Make sure all endpoints are reachable by FortiAnalyzer.
- D. Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.
正解：A、B
解説：
To view Compromised Hosts on FortiAnalyzer, certain configurations need to be in place on both FortiGate and FortiAnalyzer. Compromised Host data on FortiAnalyzer relies on log information from FortiGate to analyze threats and compromised activities effectively.
Option A: Enable device detection on the FortiGate devices that are sending logs to FortiAnalyzer Enabling device detection on FortiGate allows it to recognize and log devices within the network, sending critical information about hosts that could be compromised. This is essential because FortiAnalyzer relies on these logs to determine which hosts may be at risk based on suspicious activities observed by FortiGate. This setting enables FortiGate to provide device-level insights, which FortiAnalyzer uses to populate the Compromised Hosts view.
Option B: Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer Web filtering is crucial in identifying potentially compromised hosts since it logs any access to malicious sites or blocked categories. FortiAnalyzer uses these web filter logs to detect suspicious or malicious web activity, which can indicate compromised hosts. By ensuring that FortiGate sends these web filtering logs to FortiAnalyzer, the administrator enables FortiAnalyzer to analyze and identify hosts engaging in risky behavior.
質問 # 22
Refer to the exhibit. What does the data point at 12:20 indicate?
- A. FortiAnalyzer is using its cache to avoid dropping logs.
- B. The sqiplugind service is caught up with the logs
- C. The log insert log time is increasing.
- D. The performance of FortiAnalyzer is below the baseline.
正解：C
解説：
Insert Rate vs. Receive Rate is a graph that shows the rate at which raw logs reach the FortiAnalyzer (receive rate) and the rate at which they are indexed (insert rate) by the SQL database and the sqlplugind daemon. At minimum, the difference between these parameters should be generally consistent.
Log Insert Lag Time shows the amount of time between when a log was received and when it was indexed. Ideally, this parameter should be as small as possible with the occasional spikes according to the network activity being logged. A good baseline should be created to allow for the identification of possible performance issues.
質問 # 23
Which two statements about local logs on FortiAnalyzer are true? (Choose two.)
- A. Event logs are available only in the root ADOM.
- B. They are not supported in FortiView.
- C. Event logs show system-wide information, whereas application logs are ADOM specific.
- D. You can view playbook logs for all ADOMs in the root ADOM.
正解：C、D
解説：
Playbook logs, which relate to automated incident response actions, can be viewed centrally in the root ADOM, allowing visibility across all ADOMs.
Event logs on FortiAnalyzer typically provide system-wide information applicable to the entire FortiAnalyzer unit, while application logs are specific to each ADOM, reflecting the logs related to devices and activities managed within that ADOM.
https://docs.fortinet.com/document/fortianalyzer/7.6.3/administration-guide/208717/enabling-and- disabling-the-adom-feature
質問 # 24
When generating reports on FortiAnalyzer, macros can be used to include additional data. Which two statements about macros are true? (Choose two.)
- A. Macros cannot be customized
- B. Macros are supported in FortiGate ADOMs only
- C. Macros are abbreviated dataset queries
- D. Macros do not need to be associated with a chart
正解：C、D
質問 # 25
Which log will generate an event with the status Unhandled?
- A. An IPS log with action=pass.
- B. An AV log with action=quarantine.
- C. An AppControl log with action=blocked.
- D. A WebFilter log will action=dropped.
正解：A
解説：
In FortiOS 7.4.1 and FortiAnalyzer 7.4.1, the "Unhandled" status in logs typically signifies that the FortiGate encountered a security event but did not take any specific action to block or alter it. This usually occurs in the context of Intrusion Prevention System (IPS) logs. IPS logs with action=pass: When the IPS engine inspects traffic and determines that it does not match any known attack signatures or violate any configured policies, it assigns the action "pass". Since no action is taken to block or modify this traffic, the status is logged as "Unhandled."
質問 # 26
......
FCP_FAZ_AN-7.6試験問題集でFCP_FAZ_AN-7.6練習テスト問題：https://www.jpntest.com/shiken/FCP_FAZ_AN-7.6-mondaishu
無料FCP_FAZ_AN-7.6学習問題集ガイド試験問題解答はここ：https://drive.google.com/open?id=1xcWGjyUTZg-mqQnVutV6zLp4rh0Ljdq7