Fortinet FCP_FAZ_AN-7.6 Practice Exam Questions & Answers

Study Guide p.158: SELECT statements must follow clause order: SELECT, FROM, WHERE, GROUP BY, ORDER BY, LIMIT, OFFSET.

Technical Deep Dive: The correct answer is D because it is the only option that follows the expected SQL clause sequence closely enough: SELECT columns, FROM $log, WHERE condition, and GROUP BY. Even if the printed option appears to have a minor value/quotation issue, its clause order is the tested point. Option A places GROUP BY before WHERE, which is invalid. Option B lacks a proper selected column and malformed filtering syntax. Option C misspells SELECT and places WHERE before FROM, which breaks the required SQL structure.

Study Guide p.39: rolled log files are compressed, receive the .gz extension, and are known as archive logs.

Technical Deep Dive: The correct answer is C. FortiAnalyzer stores received logs first as log files and also indexes them for analytics. When the log file rolls over, FortiAnalyzer renames it, timestamps it, and compresses it into a .gz file. That compressed offline file is the archive log. Option A describes analytics logs in the SQL database. Option B is wrong because FortiView uses analytics logs, not archive logs. Option D confuses archive status with device availability; a log is archived because of the storage workflow, not because the source device is offline.

Study Guide p.130: the IOC service uses FortiGuard and analyzes web filtering, DNS, and traffic logs for breach detection.

Technical Deep Dive: The correct answers are B and D. To view compromised hosts, FortiAnalyzer needs relevant logs that expose suspicious destinations or web activity, and it needs current FortiGuard IOC intelligence. Web filtering logs are especially important because they contain URL/domain activity that can be compared with FortiGuard threat intelligence. The FortiGuard subscription keeps the threat database current. Option A may help identify devices in some FortiGate workflows, but it is not the core IOC requirement described in the Analyst guide. Option C is wrong because FortiAnalyzer does not need direct reachability to every endpoint; it evaluates logs received from FortiGate.

Study Guide p.65: FortiView threat widgets show top threats and drilldowns such as IPS events, CVEs, attack vectors, and affected hosts.

Technical Deep Dive: The correct answer is C. The FortiView top-threat view is used to identify the threat type and the affected destination/application context. The exhibit supports the conclusion that an SQL injection attack occurred against an application. Option A names a different attack and target. Option B is too broad; the widget display does not prove FortiAnalyzer logged only three IPS attack types in total. Option D is a prioritization judgment not supported by the exhibit; FortiView shows severity and counts, but the analyst still assesses business impact.

Study Guide p.54: custom views save search filters, device, and time period for repeated Log View searches.

Technical Deep Dive: The correct answer is B. A custom view is designed for exactly this use case: an analyst repeatedly searches Log View with the same filters and wants to avoid rebuilding them every time. A custom dashboard shows widgets and summary data but does not preserve a Log View search workflow. A data selector is used mainly as a reusable filter for event handlers and related features. A macro is for report data extraction, not for reusing interactive log-search parameters.