2025年最新の本日更新された最新のFCP_FAZ_AN-7.4日本語のPDFにはFCP_FAZ_AN-7.4日本語テスト限定無料！ [Q23-Q38]

2025年最新の本日更新された最新のFCP_FAZ_AN-7.4日本語のPDFにはFCP_FAZ_AN-7.4日本語テスト限定無料！

完全版最新の問題集PDFで最新FCP_FAZ_AN-7.4日本語試験問題と解答

質問 # 23
展示する。

これらが FortiAnalyzer デバイス上に存在するすべてのイベントであると想定します。
このプレイブックを実行した後に作成されたインシデントに追加されるイベントの数はいくつですか?

A. 7つのイベントが追加されます
B. 4つのイベントが追加されます。
C. イベントは追加されません。
D. 11 個のイベントが追加されます。

正解：B

解説：
In the exhibit, we see a playbook in FortiAnalyzer designed to retrieve events based on specific criteria, create an incident, and attach relevant data to that incident. The "Get Event" task configuration specifies filters to match any of the following conditions:
* Severity = High
* Event Type = Web Filter
* Tag = Malware
Analysis of Events:
In the FortiAnalyzer Event Monitor list:
* We need to identify events that meet any one of the specified conditions (since the filter is set to "Match Any Condition").
Events Matching Criteria:
* Severity = High:
* There are two events with "High" severity, both with the "Event Type" IPS.
* Event Type = Web Filter:
* There are two events with the "Event Type" Web Filter. One has a "Medium" severity, and the other has a "Low" severity.
* Tag = Malware:
* There are two events tagged with "Malware," both with the "Event Type" Antivirus and
"Medium" severity.
After filtering based on these criteria, there are four distinct events:
* Two from the "Severity = High" filter.
* One from the "Event Type = Web Filter" filter.
* One from the "Tag = Malware" filter.
Conclusion:
* Correct answer: D. Four events will be added.
* This answer matches the conditions set in the playbook filter configuration and the events listed in the Event Monitor.
References:
FortiAnalyzer 7.4.1 documentation on event filtering, playbook configuration, and incident management criteria.

質問 # 24
別紙参照:

21:20 のデータポイントは何を示していますか?

A. fortilogd デーモンは 1 ログ分インデックスを先行しています。
B. 受信遅延が大きいため、SQL データベースの再構築が必要です。
C. FortiAnalyzer は、ログの受信よりも速くログのインデックスを作成しています。
D. FortiAnalyzer は受信したログを一時的にバッファリングしているので、古いログからインデックスを作成できます。

正解：C

解説：
The exhibit shows a graph that tracks two metrics over time: Receive Rate and Insert Rate. These two rates are crucial for understanding the log processing behavior in FortiAnalyzer.
Understanding Receive Rate and Insert Rate:
Receive Rate: This is the rate at which FortiAnalyzer is receiving logs from connected devices.
Insert Rate: This is the rate at which FortiAnalyzer is indexing (inserting) logs into its database for storage and analysis.
Data Point at 21:20:
At 21:20, the Insert Rate line is above the Receive Rate line, indicating that FortiAnalyzer is inserting logs into its database at a faster rate than it is receiving them. This situation suggests that FortiAnalyzer is able to keep up with the incoming logs and is possibly processing a backlog or temporarily received logs faster than new logs are coming in.
Option Analysis:
Option A - FortiAnalyzer is Indexing Logs Faster Than Logs are Being Received: This accurately describes the scenario at 21:20, where the Insert Rate exceeds the Receive Rate. This indicates that FortiAnalyzer is handling logs efficiently at that moment, with no backlog in processing.
Option B - The fortilogd Daemon is Ahead in Indexing by One Log: The data does not provide specific information about the fortilogd daemon's log count, only the rates. This option is incorrect.
Option C - SQL Database Requires a Rebuild: High receive lag would imply a backlog in receiving and indexing logs, typically visible if the Receive Rate were significantly above the Insert Rate, which is not the case here.
Option D - FortiAnalyzer is Temporarily Buffering Logs to Index Older Logs First: There is no indication of buffering in this scenario. Buffering would usually occur if the Receive Rate were higher than the Insert Rate, indicating that FortiAnalyzer is storing logs temporarily due to indexing lag.
Conclusion:
Correct Answe r : A. FortiAnalyzer is indexing logs faster than logs are being received.
The graph at 21:20 shows a higher Insert Rate than Receive Rate, indicating efficient log processing by FortiAnalyzer.
Reference:
FortiAnalyzer 7.4.1 documentation on log processing metrics, Receive Rate, and Insert Rate indicators.

質問 # 25
分析の一環として、重大度レベルが「中」のインシデントが完全に修復されたことがわかりました。
インシデントのステータスを「Closed: Remediated」に変更します。
アップデートに関するどの記述が正しいですか?

A. インシデントを削除できなくなりました。
B. 対応するイベントは「軽減済み」としてマークされます。
C. インシデントダッシュボードが更新されます。
D. インシデントの重大度が引き下げられます。

正解：C

質問 # 26
FortiAnalyzer のローカルログに関する次の 2 つの記述のうち正しいものはどれですか。(2 つ選択してください。)

A. イベントログにはシステム全体の情報が表示されますが、アプリケーションログは ADOM 固有です。
B. FortiView ではサポートされていません。
C. ルート ADOM 内のすべての ADOM のプレイブックログを表示できます。
D. イベントログはルート ADOM でのみ使用できます。

正解：A、C

解説：
FortiAnalyzer manages and stores various types of logs, including local logs, across different ADOMs (Administrative Domains). Each type of log serves specific purposes, with some logs being ADOM-specific and others providing system-wide information.
Option A - Local Logs Not Supported in FortiView:
Local logs are indeed supported in FortiView. FortiView provides visibility and analytics for different log types across the system, including local logs, allowing users to view and analyze data efficiently.
Conclusion: Incorrect.
Option B - Playbook Logs for All ADOMs in the Root ADOM:
FortiAnalyzer allows centralized viewing of playbook logs across all ADOMs from the root ADOM. This feature provides an overarching view of playbook executions, facilitating easier monitoring and management for administrators.
Conclusion: Correct.
Option C - Event Logs vs. Application Logs:
Event Logs provide information about system-wide events, such as login attempts, configuration changes, and other critical activities that impact the overall system. These logs apply across the FortiAnalyzer instance.
Application Logs are more specific to individual ADOMs, capturing details that pertain to ADOM-specific applications and configurations.
Conclusion: Correct.
Option D - Event Logs Only in Root ADOM:
Event logs are available across different ADOMs, not exclusively in the root ADOM. They capture system-wide events, but they can be accessed within specific ADOM contexts as needed.
Conclusion: Incorrect.
Conclusion:
Correct Answe r : B. You can view playbook logs for all ADOMs in the root ADOM and C. Event logs show system-wide information, whereas application logs are ADOM specific.
These answers correctly describe the characteristics and visibility of local logs within FortiAnalyzer.
Reference:
FortiAnalyzer 7.4.1 documentation on log types, ADOM configuration, and FortiView functionality.

質問 # 27
インシデントの更新を通知する送信に関する正しい記述はどれですか?

A. 複数の外部プラットフォームに通知を送信できます。
B. 通知は電子メールでのみ送信できます。
C. 複数のファブリックコネクタを使用する場合は、すべてのコネクタの設定が同じである必要があります。
D. インシデントが更新または削除された場合にのみ通知を送信できます。

正解：A

解説：
In FortiOS and FortiAnalyzer, incident notifications can be sent to multiple external platforms, not limited to a single method such as email. Fortinet's security fabric and integration capabilities allow notifications to be sent through various fabric connectors and third-party integrations. This flexibility is designed to ensure that incident updates reach relevant personnel or systems using preferred communication channels, such as email, Syslog, SNMP, or integration with SIEM platforms.
Let's review each answer option for clarity:
Option A: You can send notifications to multiple external platforms
This is correct. Fortinet's notification system is capable of sending updates to multiple platforms, thanks to its support for fabric connectors and external integrations. This includes options such as email, Syslog, SNMP, and others based on configured connectors.
Option B: Notifications can be sent only by email
This is incorrect. Although email is a common method, FortiOS and FortiAnalyzer support multiple notification methods through various connectors, allowing notifications to be directed to different platforms as per the organization's setup.
Option C: If you use multiple fabric connectors, all connectors must have the same settings This is incorrect. Each fabric connector can have its unique configuration, allowing different connectors to be tailored for specific notification and integration requirements.
Option D: Notifications can be sent only when an incident is updated or deleted This is incorrect. Notifications can be sent upon the creation of incidents, as well as upon updates or deletion, depending on the configuration.

質問 # 28
FortiSOAR 管理拡張機能に関する正しい記述はどれですか?

A. 専用の FortiSOAR デバイスまたは VM が必要です。
B. デフォルトでは限定トライアルは含まれません。
C. FortiAnalyzer 上で Docker コンテナとして実行されます。
D. FortiGate を管理するには FortiManager が設定されている必要があります。

正解：A

解説：
The FortiSOAR management extension is designed as an independent security orchestration, automation, and response (SOAR) solution that integrates with other Fortinet products but requires its own dedicated device or virtual machine (VM) environment. FortiSOAR is not natively integrated as a container or service within FortiAnalyzer or FortiManager, and it operates separately to manage complex security workflows and incident responses across various platforms.
Let's examine each option to determine the correct answer:
* Option A: It requires a FortiManager configured to manage FortiGate
* This is incorrect. FortiSOAR operates independently of FortiManager. While FortiSOAR can receive input or data from FortiGate (often managed by FortiManager), it does not require FortiManager to be part of its setup.
* Option B: It runs as a docker container on FortiAnalyzer
* This is incorrect. FortiSOAR does not run as a container within FortiAnalyzer. It requires its own dedicated environment, either as a physical device or a virtual machine, due to the resource requirements and specialized functions it performs.
* Option C: It requires a dedicated FortiSOAR device or VM
* This is correct. FortiSOAR is deployed as a standalone device or VM, which enables it to handle the intensive processing needed for orchestrating security operations, integrating with third-party tools, and automating responses across an organization's security infrastructure.
* Option D: It does not include a limited trial by default
* This is incorrect. FortiSOAR installations may come with trial options or demos in specific scenarios, especially for evaluation purposes. This depends on licensing and deployment policies.
* The FortiSOAR platform, as outlined in Fortinet product documentation, is a standalone SOAR solution that requires a dedicated device or VM for deployment. It integrates with Fortinet's Security Fabric but operates separately from FortiAnalyzer, FortiManager, and FortiGate, focusing on advanced incident management and security automation.

質問 # 29
展示する。

これらが FortiAnalyzer デバイス上に存在するすべてのイベントであると想定します。
このプレイブックを実行した後に作成されたインシデントに追加されるイベントの数はいくつですか?

A. 7つのイベントが追加されます
B. 4つのイベントが追加されます。
C. イベントは追加されません。
D. 11 個のイベントが追加されます。

正解：B

解説：
In the exhibit, we see a playbook in FortiAnalyzer designed to retrieve events based on specific criteria, create an incident, and attach relevant data to that incident. The "Get Event" task configuration specifies filters to match any of the following conditions:
Severity = High
Event Type = Web Filter
Tag = Malware
Analysis of Events:
In the FortiAnalyzer Event Monitor list:
We need to identify events that meet any one of the specified conditions (since the filter is set to "Match Any Condition").
Events Matching Criteria:
Severity = High:
There are two events with "High" severity, both with the "Event Type" IPS.
Event Type = Web Filter:
There are two events with the "Event Type" Web Filter. One has a "Medium" severity, and the other has a "Low" severity.
Tag = Malware:
There are two events tagged with "Malware," both with the "Event Type" Antivirus and "Medium" severity.
After filtering based on these criteria, there are four distinct events:
Two from the "Severity = High" filter.
One from the "Event Type = Web Filter" filter.
One from the "Tag = Malware" filter.
Conclusion:
Correct Answe r : D. Four events will be added.
This answer matches the conditions set in the playbook filter configuration and the events listed in the Event Monitor.
Reference:
FortiAnalyzer 7.4.1 documentation on event filtering, playbook configuration, and incident management criteria.

質問 # 30
別紙参照:

クライアント 1 は、Web 閲覧のためにインターネットにアクセスしようとしています。
トポロジ内のすべてのFortiGateデバイスは、FortiAnalyzerへのログ記録が設定されたセキュリティファブリックの一部です。すべてのファイアウォールポリシーでログ記録が有効になっています。すべてのWebフィルタプロファイルは、違反のみをログに記録するように設定されています。
この特定のトラフィックフローのログ記録動作に関する次の記述のうち正しいものはどれですか。

A. FGT-B は FGT-A の MAC アドレスを宛先として認識し、このフローをログに記録するように FGT-A に通知します。
B. FGT-B のみがトラフィックログを作成します。
C. FGT B はトラフィックログを作成し、違反を検出すると Web フィルタログを作成します。
D. 違反を検出した場合、FGT-A のみが Web フィルタログを作成します。

正解：C

解説：
The topology shows a Security Fabric setup involving FortiGate devices (FGT-A and FGT-B) and a FortiAnalyzer for centralized logging. Let's break down the logging and traffic flow behavior:
* Traffic Flow Analysis:
* Client-1 initiates web traffic directed to the internet, which is routed through FGT-B and then FGT-A before reaching the internet. This is indicated by the direction of the red-dashed arrow from Client-1 through FGT-B to FGT-A.
* Policy and NAT Settings:
* On FGT-B, NAT is disabled, meaning it will pass the traffic through without altering the source IP. This device has a Web Filter enabled with a policy to log violations only.
* On FGT-A, NAT is enabled, and a Web Filter profile is also applied. Like FGT-B, it logs only violations for web filtering.
* Logging Behavior:
* Since both FortiGate devices have logging enabled for traffic and web filtering, they can create logs if conditions are met.
* FGT-B will log all traffic, as per its configuration, and will also create web filter logs if it detects a violation, as the web filter profile is applied. Because NAT is disabled on FGT-B, it processes the traffic but doesn't perform any address translation, allowing it to see the original source IP of Client-1.
* FGT-A, as the Security Fabric root, will handle NAT and forward the traffic to the internet.
However, in this case, the question is focused on where the traffic and web filter logs would be generated first, particularly by FGT-B.
* Option Analysis:
* Option A - Only FGT-B will create traffic logs: This is incorrect because FGT-B can create both traffic logs and web filter logs if it detects a violation.
* Option B - FGT-B will see the MAC address of FGT-A and notify FGT-A to log: This is not how logging works in this setup. Each FortiGate logs independently based on configured policies.
* Option C - FGT-B will create traffic logs and will create web filter logs if it detects a violation: This is correct, as FGT-B has logging enabled and will log traffic and web filter violations.
* Option D - Only FGT-A will create web filter logs if it detects a violation: This is incorrect, as FGT-B can also log web filter violations independently.
Conclusion:
* Correct answer: C. FGT-B will create traffic logs and will create web filter logs if it detects a violation.
* FGT-B is responsible for logging the traffic from Client-1 and will generate web filter logs if there is a policy violation, as configured.
References:
FortiOS 7.4.1 documentation on Security Fabric logging behavior and FortiAnalyzer log integration.

質問 # 31
構成されたイベントハンドラーに一致するイベントが発生したときに通知を送信するには、どの 2 つの方法を使用できますか? (2 つ選択してください)。

A. SNMPトラップを送信する
B. SMS通知を送信する
C. FortiSIEM MEA経由でアラートを送信
D. ファブリックコネクタを介してアラートを送信する

正解：A、B

解説：
In FortiAnalyzer, event handlers can be configured to trigger specific notifications when an event matches defined criteria. These notifications are designed to alert administrators in real time about critical events.
* Option B - Send SNMP Trap:
* FortiAnalyzer supports sending SNMP traps as one of the notification methods when an event matches an event handler. This allows integration with SNMP-enabled network management systems, which can then trigger further alerts or actions based on the trap received.
* Conclusion: Correct.
* Option C - Send SMS Notification:
* FortiAnalyzer also supports SMS notifications, enabling alerts to be sent via SMS to predefined recipients. This method is useful for administrators who require immediate alerts but may not have access to email or other notification systems at all times.
* Conclusion: Correct.
* Option A - Send Alert through Fabric Connectors:
* While Fabric Connectors allow FortiAnalyzer to interact with other parts of the Security Fabric, they are primarily used for data sharing and automation rather than directly for sending alerts or notifications.
* Conclusion: Incorrect.
* Option D - Send Alert through FortiSIEM MEA:
* FortiSIEM integration allows for data sharing and further analysis within the Fortinet ecosystem, but it does not directly act as a notification method from FortiAnalyzer itself.
* Conclusion: Incorrect.
Conclusion:
* Correct answer: B. Send SNMP trap and C. Send SMS notification
* These options represent valid notification methods for FortiAnalyzer's event handler configuration.
References:
FortiAnalyzer 7.4.1 documentation on event handler configuration and available notification methods.

質問 # 32
FortiSOAR 管理拡張機能に関する正しい記述はどれですか?

A. 専用の FortiSOAR デバイスまたは VM が必要です。
B. デフォルトでは限定トライアルは含まれません。
C. FortiAnalyzer 上で Docker コンテナとして実行されます。
D. FortiGate を管理するには FortiManager が設定されている必要があります。

正解：A

解説：
The FortiSOAR management extension is designed as an independent security orchestration, automation, and response (SOAR) solution that integrates with other Fortinet products but requires its own dedicated device or virtual machine (VM) environment. FortiSOAR is not natively integrated as a container or service within FortiAnalyzer or FortiManager, and it operates separately to manage complex security workflows and incident responses across various platforms.
Let's examine each option to determine the correct answer:
Option A: It requires a FortiManager configured to manage FortiGate
This is incorrect. FortiSOAR operates independently of FortiManager. While FortiSOAR can receive input or data from FortiGate (often managed by FortiManager), it does not require FortiManager to be part of its setup.
Option B: It runs as a docker container on FortiAnalyzer
This is incorrect. FortiSOAR does not run as a container within FortiAnalyzer. It requires its own dedicated environment, either as a physical device or a virtual machine, due to the resource requirements and specialized functions it performs.
Option C: It requires a dedicated FortiSOAR device or VM
This is correct. FortiSOAR is deployed as a standalone device or VM, which enables it to handle the intensive processing needed for orchestrating security operations, integrating with third-party tools, and automating responses across an organization's security infrastructure.
Option D: It does not include a limited trial by default
This is incorrect. FortiSOAR installations may come with trial options or demos in specific scenarios, especially for evaluation purposes. This depends on licensing and deployment policies.

質問 # 33
SQL SELECT クエリに関する正しい記述はどれですか?

A. データベーススキーマを表示するために使用できます。
B. データベースからログエントリを消去するために使用できます。
C. マクロでは使用されません。
D. 直後に WHERE 句を続ける必要があります。

正解：C

解説：
* Option A - Purging Log Entries:
* A SELECT query in SQL is used to retrieve data from a database and does not have the capability to delete or purge log entries. Purging logs typically requires a DELETE or TRUNCATE command.
* Conclusion: Incorrect.
* Option B - WHERE Clause Requirement:
* In SQL, a SELECT query does not require a WHERE clause. The WHERE clause is optional and is used only when filtering results. A SELECT query can be executed without it, meaning this statement is false.
* Conclusion: Incorrect.
* Option C - Displaying Database Schema:
* A SELECT query retrieves data from specified tables, but it is not used to display the structure or schema of the database. Commands like DESCRIBE, SHOW TABLES, or SHOW COLUMNS are typically used to view schema information.
* Conclusion: Incorrect.
* Option D - Usage in Macros:
* FortiAnalyzer and similar systems often use macros for automated functions or specific query- based tasks. SELECT queries are typically not included in macros because macros focus on procedural or repetitive actions, rather than simple data retrieval.
* Conclusion: Correct.
Conclusion:
* Correct answer: D. They are not used in macros.
* This aligns with typical SQL usage and the specific functionalities of FortiAnalyzer.
References:
FortiAnalyzer 7.4.1 documentation on SQL queries, database operations, and macro usage.

質問 # 34
チームの管理者が複数のレポートを定期的に実行するように設定しました。経営陣からは、新たに生成されたすべてのレポートを社内メールの受信トレイに送信してアクセスしやすくしてほしいという追加の依頼がありました。メールサーバーはFortiAnalyzerで既に設定されています。
レポートが生成されたときに電子メールが送信されるようにするには、FortiAnalyzer でどの項目を構成する必要がありますか?

A. レポートカレンダーで電子メール通知を有効にします。
B. レポートの出力プロファイルを有効にします。
C. レポートレイアウト内に mailto:<email address> オプションを追加します。
D. メールサーバーの下にあるすべてのレポートを電子メールで送信するオプションを有効にします。

正解：B

解説：
To ensure that reports generated by FortiAnalyzer are automatically sent to an email inbox, you need to set up an output profile for the reports. Output profiles specify where and how reports should be delivered, including the option to send them via email.
Option A - Enable the Option to Email All Reports Under the Mail Server:
The mail server configuration allows FortiAnalyzer to send emails but does not automatically enable email distribution for reports. This setting alone does not specify which reports to send or to whom.
Conclusion: Incorrect.
Option B - Add a mailto:<email address> Option Within the Report Layouts:
Adding an email address within the report layout is not a standard configuration option for report distribution. Report layouts define the format and content of the report but not its distribution method.
Conclusion: Incorrect.
Option C - Enable Email Notification Under the Report Calendar:
The report calendar is used to schedule when reports are generated. While it triggers report generation at specific times, it does not handle email distribution. Emailing reports requires a configured output profile.
Conclusion: Incorrect.
Option D - Enable an Output Profile on the Reports:
An output profile can be configured on FortiAnalyzer to define delivery options, including emailing the report to specified recipients. This setup ensures that every time a report is generated according to the schedule, it is automatically emailed to the configured address.
Conclusion: Correct.
Conclusion:
Correct Answe r : D. Enable an output profile on the reports.
Configuring an output profile is the correct way to set up automatic email distribution of generated reports in FortiAnalyzer.
Reference:
FortiAnalyzer 7.4.1 documentation on configuring output profiles and report distribution settings.

質問 # 35
FortiAnalyzer でデータベースにクエリを実行する場合、どの SQL クエリが正しい順序ですか?

A. $log から devid を選択し、 GROUP BY devid WHERE 'user',,' users1' を指定します。
B. SELECT DEVID WHERE 'user'-' USER1' FROM $log GROUP By DEVID
C. $log から devid 'user',, USER1' を GROUP BY devid で選択
D. $log から devid を選択し、 'user' = ' GROUP BY devid

正解：D

解説：
In FortiAnalyzer's SQL query syntax, the typical order for querying the database follows the standard SQL format, which is:
SELECT <column(s)> FROM <table> WHERE <condition(s)> GROUP BY <column(s)>
* Option D correctly follows this structure:
* SELECT devid FROM $log: This specifies that the query is selecting the devid column from the $log table.
* WHERE 'user' = ': This part of the query is intended to filter results based on a condition involving the user column. Although there appears to be a minor typographical issue (possibly missing the user value after =), it structurally adheres to the correct SQL order.
* GROUP BY devid: This groups the results by devid, which is correctly positioned at the end of the query.
Let's briefly examine why the other options are incorrect:
* Option A: SELECT devid FROM $log GROUP BY devid WHERE 'user', 'users1'
* This is incorrect because the GROUP BY clause appears before the WHERE clause, which is out of order in SQL syntax.
* Option B: SELECT FROM $log WHERE devid 'user', USER1' GROUP BY devid
* This is incorrect because it lacks a column in the SELECT statement and the WHERE clause syntax is malformed.
* Option C: SELCT devid WHERE 'user' - 'USER1' FROM $log GROUP BY devid
* This is incorrect because the SELECT keyword is misspelled as SELCT, and the WHERE condition syntax is invalid.
* FortiAnalyzer documentation for SQL queries indicates that the standard SQL order should be followed when querying logs in FortiAnalyzer. Queries should follow the format SELECT ... FROM ... WHERE ...
GROUP BY ..., as demonstrated in option D.

質問 # 36
レポートを生成した後、期待していた情報が含まれていないことに気づきました。しかし、ログは確かに含まれていることを確認しました。

A. データセットをテストする
B. レポート使用率の割り当てを増やします。
C. 自動キャッシュを無効にします。
D. レポートの対象となる時間枠を確認します。

正解：A、D

解説：
When a generated report does not contain the expected information even though the logs are confirmed to be present, it typically indicates an issue with the report's configuration. There are a few common reasons this might happen:
* Option A - Check the Time Frame Covered by the Report:
* Reports are generated based on a specific time frame. If the report's time frame does not cover the period when the relevant logs were collected, those logs won't appear in the report output.
Verifying and adjusting the time frame is essential to ensure the report includes all relevant data.
* Conclusion: Correct.
* Option B - Disable Auto-Cache:
* Auto-cache is designed to improve report generation speed by using cached data. Disabling auto- cache would typically only be relevant if the report is pulling outdated data from cache, but it doesn't directly affect whether specific logs are included in a report.
* Conclusion: Incorrect.
* Option C - Increase the Report Utilization Quota:
* The report utilization quota is related to the resource limits for generating reports. It does not directly influence whether certain data appears in a report. Increasing this quota would help only if there are resource issues preventing the report from completing, not if specific logs are missing from the report.
* Conclusion: Incorrect.
* Option D - Test the Dataset:
* Datasets determine which logs and data fields are pulled into the report. If a dataset is configured incorrectly or does not include the required log fields, it could lead to missing information.
Testing the dataset allows you to verify that it's correctly configured and pulling the expected data.
* Conclusion: Correct.
Conclusion:
* Correct answer: A. Check the time frame covered by the report and D. Test the dataset.
* These steps directly address the issues that could lead to missing information in a report when logs are available but not displayed.
References:
FortiAnalyzer 7.4.1 documentation on report generation settings, time frames, and dataset configuration for accurate report results.

質問 # 37
ネットワークセキュリティを管理する際にプロアクティブなアプローチを使用できるようにする FortiAnalyzer の機能はどれですか?

A. アウトブレイク警報サービス
B. 脅威ハンティング
C. インシデントダッシュボード
D. FortiView モニター

正解：B

解説：
FortiAnalyzer offers several features for monitoring, alerting, and incident management, each serving different purposes. Let's examine each option to determine which one best supports a proactive security approach.
* Option A - FortiView Monitor:
* FortiView is a visualization tool that provides real-time and historical insights into network traffic, threats, and logs. While it gives visibility into network activity, it is generally more reactive than proactive, as it relies on existing log data and incidents.
* Conclusion: Incorrect.
* Option B - Outbreak Alert Services:
* Outbreak Alert Services in FortiAnalyzer notify administrators of emerging threats and outbreaks based on FortiGuard intelligence. This is beneficial for awareness of potential threats but does not offer a hands-on, investigative approach. It's more of a notification service rather than an active, proactive investigation tool.
* Conclusion: Incorrect.
* Option C - Incidents Dashboard:
* The Incidents Dashboard provides a summary of incidents and current security statuses within the network. While it assists with ongoing incident response, it is used to manage and track existing incidents rather than proactively identifying new threats.
* Conclusion: Incorrect.
* Option D - Threat Hunting:
* Threat Hunting in FortiAnalyzer enables security analysts to actively search for hidden threats or malicious activities within the network by leveraging historical data, analytics, and intelligence.
This is a proactive approach as it allows analysts to seek out threats before they escalate into incidents.
* Conclusion: Correct.
Conclusion:
* Correct answer: D. Threat hunting
* Threat hunting is the most proactive feature among the options, as it involves actively searching for threats within the network rather than reacting to already detected incidents.
References:
FortiAnalyzer 7.4.1 documentation on Threat Hunting and proactive security measures.