FCP_FAZ_AD-7.4 Exam PDF [2026] Tests Free Updated Today with Correct 185 Questions [Q81-Q103]

Rate this post

FCP_FAZ_AD-7.4 Exam PDF [2026] Tests Free Updated Today with Correct 185 Questions

Fortinet FCP_FAZ_AD-7.4 Exam Preparation Guide and PDF Download

Fortinet FCP_FAZ_AD-7.4 Exam Syllabus Topics:

Topic	Details
Topic 1	Device Management: Here, Fortinet network and security analysts are evaluated on their ability to handle devices linked to FortiAnalyzer. This includes adding new devices, managing them efficiently, and troubleshooting communication issues.
Topic 2	System Configuration: This section assesses the capabilities of network and security analysts in managing FortiAnalyzer systems. It includes tasks like performing initial configurations, setting up high-availability systems, and configuring RAID for storage.
Topic 3	Logs and Reports Management: This part of the exam measures the candidate’s ability to handle log data and generate reports using FortiAnalyzer. Network and security analysts must show proficiency in managing, analyzing, and reviewing logs to ensure effective system monitoring and auditing processes are in place.
Topic 4	Administration: This section evaluates the ability of network and security analysts to configure administrative access and manage Administrative Domains (ADOMs). It covers tasks such as setting user permissions, managing backups, and disk quotas, and ensuring secure and efficient management of administrative privileges within FortiAnalyzer systems.

Q81. An administrator has configured the following settings:
config system fortiview settings
set resolve-ip enable
end
What is the significance of executing this command?

Use this command only if the source IP addresses are not resolved on FortiGate.

It resolves the source and destination IP addresses to a hostname in FortiView on FortiAnalyzer.

You must configure local DNS servers on FortiGate for this command to resolve IP addresses on Forti Analyzer.

It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.

Q82. For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

Use DNS

Use host name resolution

Use real-time forwarding

Use an NTP server

Q83. Which two parameters impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)

Total quota

License type

RAID level

Disk size

Q84. Which two statements regarding ADOM modes are true? (Choose two.)

In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advanced mode, the disk quota of the ADOM is flexible.

You can change ADOM modes only through the CLI.

In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

Q85. Which statement is true about ADOMs?

A fabric ADOM can include all the device types supported by FortiAnalyzer.

When a FortiAnalyzer Fabric is implemented the default ADOM mode is set to advanced.

In normal mode, you cannot change the disk quota of the ADOM after its creation.

You can change the ADOM mode only through the GUI.

Q86. What are offline logs on FortiAnalyzer?

Compressed logs, also known as archive logs

Logs that are indexed and stored in the SQL database

Any logs collected from offline devices after they boot up

Real-time logs that are not yet indexed

Q87. How are logs forwarded when FortiAnalyzer is using aggregation mode?

Logs are forwarded as they are received and content files are uploaded at a scheduled time.

Logs and content files are stored and uploaded at a scheduled time.

Logs are forwarded as they are received.

Logs and content files are forwarded as they are received.

Q88. FortiAnalyzer uses the Optimized Fabric Transfer Protocok (OFTP) over SSL for what purpose?

To upload logs to an SFTP server

To prevent log modification during backup

To send an identical set of logs to a second logging server

To encrypt log communication between devices

Q89. Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy.
What is the most likely problem?

CPU resources are too high

Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device

The total disk space is insufficient and you need to add other disk

The ADOM disk quota is set too low, based on log rates

Q90. Which two of the available registration methods place the device automatically in its assigned ADOM?
(Choose two.)

Request from the device

Serial number

Fabric Authorization

Pre-shared key

Q91. What can you do on FortiAnalyzer to restrict administrative access from specific locations?

Configure trusted hosts for that administrator.

Enable geo-location services on accessible interface.

Configure two-factor authentication with a remote RADIUS server.

Configure an ADOM for respective location.

Q92. Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate to FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

An administrator group

A local wildcard administrator account

A trusted host profile that restricts access to the LDAP group

A remote LDAP server

Q93. Which two statement are true regardless initial Logs sync and Log Data Sync for Ha on FortiAnalyzer?

By default, Log Data Sync is disabled on all backup devise.

Log Data Sync provides real-time log synchronization to all backup devices.

With initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

When Logs Data Sync is turned on, the backup device will reboot and then rebuilt the log database with the synchronized logs.

Q94. How are logs forwarded when FortiAnalyzer is using aggregation mode?

Logs are forwarded as they are received and content files are uploaded at a scheduled time.

Logs and content files are stored and uploaded at a scheduled time.

Logs are forwarded as they are received.

Logs and content files are forwarded as they are received.

Q95. Which two statements are true regarding the log synchronization states for HA on FortiAnalyzer?
(Choose two.)

With Initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

Log Data Sync provides real-time log synchronization to all backup devices.

When Log Data Sync is turned on, the backup device reboots and then rebuilds the log database with the synchronized logs.

By default. Log Data Sync is disabled on all backup devices.

Q96. Refer to the exhibit.

Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than “admin”, and coming from Laptop1.
Which filter will achieve the desired result?

operation-login & dstip==10.1.1.210 & user!-admin

operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

operation-login & performed_on==”GUI(10.1.1.210)” & user!=admin

operation-login & performed_on==”GUI(10.1.1.100)” & user!=admin

Q97. Which two statements about high availability (HA) on FortiAnalyzer are true? (Choose two.)

FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

FortiAnalyzer HA active-passive mode can function without VRRP.

All devices in a FortiAnalyzer HA cluster must run in the same operation mode, either analyzer mode or collector mode.

All devices in a FortiAnalyzer HA cluster must have the same available disk space.

Q98. Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally?
(Choose two.)

Mail server

Output profile

SFTP server

Report scheduling

Q99. What happens when a log file saved on FortiAnalyzer disks reaches the size specified in the device log settings?

The log file is stored as a raw log and is available for analytic support.

The log file rolls over and is archived.

The log file is purged from the database.

The log file is overwritten.

Q100. If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

The configured IP address is checked first.

The active port number is checked first.

The firmware version is checked first.

The configured priority is checked first

Q101. Which statement about the FortiSIEM management extension is correct?

Allows you to manage the entire life cycle of a threat or breach.

Its use of the available disk space is capped at 50%.

It requires a licensed FortiSIEM supervisor.

It can be installed as a dedicated VM.

Q102. Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Log upload

Indicators of Compromise

Log forwarding an aggregation mode

Log fetching

Q103. Which SQL query is in the correct order to query the database in the FortiAnslyzer?

SELECT devid FROM Slog GROOP BY devid WHERE * user’ =* USERl’

SELECT devid WHERE ‘u3er’=’USERl’ FROM $ log GROUP BY devid

SELECT devid FROM Slog- WHERE *user’ =’ USERl’ GROUP BY devid

FROM Slog WHERE ‘user* =’ USERl’ SELECT devid GROUP BY devid

Verified & Correct FCP_FAZ_AD-7.4 Practice Test Reliable Source May 21, 2026 Updated: https://www.prepawaytest.com/Fortinet/FCP_FAZ_AD-7.4-practice-exam-dumps.html

Fortinet FCP_FAZ_AD-7.4 Exam Syllabus Topics:

Leave a Reply Cancel reply