[Q27-Q44] FCP – FortiAnalyzer 7.4 Analyst Practice Tests 2026 Pass FCP_FAZ_AN-7.4 with confidence!

admin FCP_FAZ_AN-7.4 Fortinet February 6, 2026

Rate this post

FCP – FortiAnalyzer 7.4 Analyst Practice Tests 2026 | Pass FCP_FAZ_AN-7.4 with confidence!

Practice FCP in Security Operations FCP_FAZ_AN-7.4 exam. Online Exam Practice Tests with detailed explanations!

Fortinet FCP_FAZ_AN-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	Logging: Candidates will learn about logging mechanisms, log analysis, and gathering log statistics to effectively monitor security events and incidents.
Topic 2	SOC Events and Incident Management: This domain targets Fortinet Network Analysts and focuses on managing security operations center (SOC) events. Candidates will explain SOC features on FortiAnalyzer, manage events and incidents, and understand the incident lifecycle to enhance incident response capabilities.
Topic 3	Features and Concepts: This section of the exam measures the skills of Fortinet Security Analysts and covers the fundamental concepts of FortiAnalyzer.
Topic 4	Reports: This section evaluates the skills of Fortinet Security Analysts in managing reports within FortiAnalyzer. Candidates will learn to create, troubleshoot, and optimize reports to ensure accurate data presentation and insights for security analysis.
Topic 5	Playbooks: This domain measures the skills of Fortinet Network Analysts in creating and managing playbooks. Candidates will explain playbook components and develop workflows that automate responses to security incidents, improving operational efficiency in SOC environments.

Q27. When generating reports on FortiAnalyzer, macros can be used to include additional data.
Which two statements about macros are true? (Choose two.)

Macros are abbreviated dataset queries

Macros do not need to be associated with a chart

Macros are supported in FortiGate ADOMs only

Macros cannot be customized

Q28. Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

IPsec is only enabled through the CLI on FortiAnalyzer.

Must establish an IPsec tunnel ID and pre-shared key.

Must configure the FortiAnalyzer end of the tunnel only–the FortiGate end is auto-negotiated.

IPsec cannot be enabled if SSL is enabled as well.

Q29. You need to upgrade your FortiAnalyzer firmware.
What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?

The logfiled process stores logs in offline mode

FortiGate uses the miglogd process to cache the logs

FortiAnalyzer uses log fetching to retrieve the logs when back online

Logs are dropped

Q30. Which tabs do not appear when FortiAnalyzer is operating in Collector mode?

Event Management

Device Manger

Reporting

FortiView

Q31. Which statement is true regarding Macros on FortiAnalyzer?

Macros are ADOM specific and each ADOM will have unique macros relevant to that ADO

Macros are supported only on the FortiGate ADO

Macros are useful in generating excel log files automatically based on the reports settings.

Macros are predefined templates for reports and cannot be customized.

Q32. What is the purpose of a predefined template on the FortiAnalyzer?

It specifies the report layout which contains predefined texts, charts, and macros

It can be edited and modified as required

It contains predefined data to generate mock reports

It specifies report settings which contains time period, device selection, and schedule

Q33. What is the purpose of output variables?

To store playbook execution statistics

To use the output of the previous task as the input of the current task

To display details of the connectors used by a playbook

To save all the task settings when a playbook is exported

Q34. Which statement about sending notifications with incident updates is true?

Each connector used can have different notification settings

Each incident can send notification to a single external platform.

You must configure an output profile to send notifications by email.

Notifications can be sent only when an incident is created oi deleted.

Q35. Which two statements are true regarding FortiAnalyzer log forwarding? (Choose two.)

In aggregation mode, you can forward logs to syslog and CEF servers as well.

Forwarding mode forwards logs in real time only to other FortiAnalyzer devices.

Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

Both modes, forwarding and aggregation, support encryption of logs between devices.

Q36. Exhibit.

A fortiAnalyzer analyst is customizing a SQL query to use in a report.
Which SQL query should the analyst run to get the expected results?

The requirement here is to construct a SQL query that retrieves logs with specific fields, namely “Source IP” and “Destination Port,” for entries where the source IP address matches 10.0.1.10. The correct syntax is essential for selecting, filtering, ordering, and grouping the results as shown in the expected outcome.
Analysis of the Options:
* Option A Explanation:
* SELECT srcip AS “Source IP”, dstport AS “Destination Port”: This syntax selects srcip and dstport, renaming them to “Source IP” and “Destination Port” respectively in the output.
* FROM $log: Specifies the log table as the data source.
* WHERE $filter AND srcip = ‘10.0.1.10’: This line filters logs to only include entries with srcip equal to 10.0.1.10.
* ORDER BY dstport DESC: Orders the results in descending order by dstport.
* GROUP BY srcip, dstport: Groups results by srcip and dstport, which is valid SQL syntax.
This option meets all the requirements to get the expected results accurately.
* Option B Explanation:
* WHERE $filter AND Source IP != ‘10.0.1.10’: Uses != instead of =. This would exclude logs from the specified IP 10.0.1.10, which is contrary to the expected result.
* Option C Explanation:
* The ORDER BY clause appears before the FROM clause, which is incorrect syntax. SQL requires the FROM clause to follow the SELECT clause directly.
* Option D Explanation:
* The GROUP BY clause should follow the FROM clause. However, here, it’s located after WHERE, making it syntactically incorrect.
Conclusion:
* Correct Answer:A. Option A
* This option aligns perfectly with standard SQL syntax and filters correctly for srcip = ‘10.0.1.10’, while ordering and grouping as required.
References:
* FortiAnalyzer 7.4.1 SQL query capabilities and syntax for report customization.

Q37. Refer to the exhibits.

How many events will be added to the incident created after running this playbook?

No events will be added.

Ten events will be added.

Five events will be added.

Thirteen events will be added.

Q38. Which statement about SQL SELECT queries is true?

They can be used to purge log entries from the database.

They must be followed immediately by a WHERE clause.

They can be used to display the database schema.

They are not used in macros.

Option A – Purging Log Entries:
A SELECT query in SQL is used to retrieve data from a database and does not have the capability to delete or purge log entries. Purging logs typically requires a DELETE or TRUNCATE command.
Conclusion: Incorrect.
Option B – WHERE Clause Requirement:
In SQL, a SELECT query does not require a WHERE clause. The WHERE clause is optional and is used only when filtering results. A SELECT query can be executed without it, meaning this statement is false.
Conclusion: Incorrect.
Option C – Displaying Database Schema:
A SELECT query retrieves data from specified tables, but it is not used to display the structure or schema of the database. Commands like DESCRIBE, SHOW TABLES, or SHOW COLUMNS are typically used to view schema information.
Conclusion: Incorrect.
Option D – Usage in Macros:
FortiAnalyzer and similar systems often use macros for automated functions or specific query-based tasks. SELECT queries are typically not included in macros because macros focus on procedural or repetitive actions, rather than simple data retrieval.
Conclusion: Correct.
Conclusion:
Correct Answe r : D. They are not used in macros.
This aligns with typical SQL usage and the specific functionalities of FortiAnalyzer.
Reference:
FortiAnalyzer 7.4.1 documentation on SQL queries, database operations, and macro usage.

Q39. Exhibit.

What can you conclude from this output?

There is not disk quota allocated to quarantining files.

FGT_B is the Security Fabric root.

The allocated disk quote to ADOM1 is 3 GB.

Archive logs are using more space than analytic logs.

The exhibit displays a diagnose log device output on a FortiAnalyzer, showing details about disk space usage and quotas for different FortiGate devices and ADOMs (Administrative Domains). Here’s a breakdown of key details:
Disk Quota for Quarantined Files:
The output includes columns labeled for used space in categories such as “logs,” “quarantine,” “content,” and “DB.” For each device, the quarantine column consistently shows 0.0KB used, indicating that there is no disk quota allocated or utilized for quarantining files.
Conclusion: Correct.
FGT_B as Security Fabric Root:
There is no direct indication from this output that specifies FGT_B is the root of the Security Fabric. Information on Security Fabric topology or root designation would typically come from a Security Fabric configuration command rather than a disk usage summary.
Conclusion: Incorrect.
Allocated Disk Quota for ADOM1:
The output shows the quota for ADOM1 is “unlimited,” not a fixed 3 GB quota. Therefore, there is no set 3 GB limit for ADOM1.
Conclusion: Incorrect.
Comparison of Archive Logs and Analytic Logs:
The output does not differentiate between archive logs and analytic logs; it only shows overall disk usage by type (e.g., logs, quarantine). Therefore, no conclusion can be made about which type of logs (archive or analytic) is using more space.
Conclusion: Incorrect.
Conclusion:
Correct Answe r : A. There is no disk quota allocated to quarantining files.
This answer aligns with the observed data, where no disk space is used or allocated for quarantine files.
Reference:
FortiAnalyzer 7.4.1 documentation on diagnose log device command usage and disk quota settings.

Q40. Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?

Web filter logs

IPS logs

Application control logs

Antivirus logs

Q41. Which log will generate an event with the status Unhandled?

An AV log with action=quarantine.

An IPS log with action=pass.

A WebFilter log will action=dropped.

An AppControl log with action=blocked.

In FortiOS 7.4.1 and FortiAnalyzer 7.4.1, the “Unhandled” status in logs typically signifies that the FortiGate encountered a security event but did not take any specific action to block or alter it. This usually occurs in the context of Intrusion Prevention System (IPS) logs.
IPS logs with action=pass: When the IPS engine inspects traffic and determines that it does not match any known attack signatures or violate any configured policies, it assigns the action “pass”. Since no action is taken to block or modify this traffic, the status is logged as “Unhandled.” Let’s look at why the other options are incorrect:
An AV log with action=quarantine: Antivirus (AV) logs with the action “quarantine” indicate that a file was detected as malicious and moved to quarantine. This is a definitive action, so the status wouldn’t be “Unhandled.” A WebFilter log will action=dropped: WebFilter logs with the action “dropped” indicate that web traffic was blocked according to the configured web filtering policies. Again, this is a specific action taken, not an “Unhandled” event.
An AppControl log with action=blocked: Application Control logs with the action “blocked” mean that an application was denied access based on the defined application control rules. This is also a clear action, not “Unhandled.”

Q42. You are trying to configure a task in the playbook editor to run a report.
However, when you try to select the desired playbook, you do to see it listed.
What is the reason?

The report does not have auto-cache and extended log filtering enabled.

The playbook is currently running and will be available after it is finished.

You must create a trigger to run the report first.

The report has no result and must be reconfigured.

Q43. It is a best practice to upload FortiAnalyzer local logs to a remote server.
Which three remote servers are supported for the upload? (Choose three.)

SFTP

SCP

FTP

UDP

TCP

Q44. How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

Use administrative profiles

Use secure protocols

Use trusted hosts

Use static routes

Loading …