FCP_FAZ_AD-7.4 無料問題集「Fortinet FCP - FortiAnalyzer 7.4 Administrator」

（A）Logs that are indexed and stored in the SQL database

（B）Any logs collected from offline devices after they boot up

（C）Compressed logs, also known as archive logs

（D）Real-time logs that are not yet indexed

（A）CPU resources are too high.

（B）The ADOM disk quota is set too low based on log rates.

（C）Logs in that ADOM are being forwarded in real-time to another FortiAnalyzer device.

（D）The total disk space is insufficient and you need to add other disk.

（A）ADOMs are not enabled on FortiAnalyzer.

（B）ADOM mode should be set to advanced, in order to register the FortiClient EMS device.

（C）A separate license is required on FortiAnalyzer in order to register the FortiClient EMS device.

（D）FortiAnalyzer is in an HA cluster.

（A）FortiOS Event Log

（B）FortiAnalyzer Event Handler

（C）Fabric Connector event

（D）Incoming webhook

（A）Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

（B）Make sure all endpoints are reachable by FortiAnalyzer.

（C）Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.

（D）Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

（A）This FortiAnalyzer is configured to receive logs in its port1.

（B）After joining to the cluster, this FortiAnalyzer will keep an updated log database.

（C）This FortiAnalyzer will join to the existing HA cluster as the primary.

（D）This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.

（A）FortiAnalyzer needs that time to ensure there are no other playbooks running.

（B）FortiAnalyzer needs that time to parse the new playbook.

（C）FortiAnalyzer needs that time to debug the new playbook.

（D）FortiAnalyzer needs that time to back up the current playbooks.

（A）System information

（B）Logs from registered devices

（C）Database snapshot

（D）Report information

（A）operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin

（B）operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

（C）operation-login & dstip==10.1.1.210 & user!-admin

（D）operation-login & performed_on=="GUI(10.1.1.210)" & user!=admin

（A）ADOMs are enabled by default.

（B）Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM.

（C）ADOMs constrain other administrator's access privileges to a subset of devices in the device list.

（D）All administrators can create ADOMs--not just the admin administrator.