必ず合格できるFortinet FCP_FAZ_AN-7.4試験の正確な58問題と解答あります
最新 [2025年04月20日]2025年最新の実際にある検証済みのFCP_FAZ_AN-7.4問題集
Fortinet FCP_FAZ_AN-7.4 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 21
Which log will generate an event with the status Unhandled?
- A. An AV log with action=quarantine.
- B. A WebFilter log will action=dropped.
- C. An IPS log with action=pass.
- D. An AppControl log with action=blocked.
正解：C
解説：
In FortiOS 7.4.1 and FortiAnalyzer 7.4.1, the "Unhandled" status in logs typically signifies that the FortiGate encountered a security event but did not take any specific action to block or alter it. This usually occurs in the context of Intrusion Prevention System (IPS) logs.
IPS logs with action=pass: When the IPS engine inspects traffic and determines that it does not match any known attack signatures or violate any configured policies, it assigns the action "pass". Since no action is taken to block or modify this traffic, the status is logged as "Unhandled." Let's look at why the other options are incorrect:
An AV log with action=quarantine: Antivirus (AV) logs with the action "quarantine" indicate that a file was detected as malicious and moved to quarantine. This is a definitive action, so the status wouldn't be "Unhandled." A WebFilter log will action=dropped: WebFilter logs with the action "dropped" indicate that web traffic was blocked according to the configured web filtering policies. Again, this is a specific action taken, not an "Unhandled" event.
An AppControl log with action=blocked: Application Control logs with the action "blocked" mean that an application was denied access based on the defined application control rules. This is also a clear action, not "Unhandled."
質問 # 22
A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer.
What can you do on FortiAnalyzer to accomplish this?
- A. Click Task Monitor and view the tasks performed by that administrator.
- B. Click FortiView and generate a report for that administrator.
- C. Click Log View and generate a report for that administrator.
- D. Click Fabric View and view the tasks performed by the rogue administrator.
正解：A
質問 # 23
It is a best practice to upload FortiAnalyzer local logs to a remote server.
Which three remote servers are supported for the upload? (Choose three.)
- A. TCP
- B. FTP
- C. UDP
- D. SCP
- E. SFTP
正解：B、D、E
質問 # 24
Exhibit.
Based on the partial outputs displayed, which devices can be members of a FotiAnalyzer Fabric?
- A. All devices listed can be members.
- B. FortiAnalyzer1 and FortiAnalyzer2
- C. FortiAnalyzer2 and FortiAnalyzer3
- D. FortiAnalayzer1 and FortiAnalyzer3
正解：A
解説：
In a FortiAnalyzer Fabric, devices can participate in a cluster or grouping if they meet specific compatibility criteria. Based on the outputs provided, let's evaluate these criteria:
All three devices, FortiAnalyzer1, FortiAnalyzer2, and FortiAnalyzer3, are running version v7.4.1-build0238, which is the same across the board. This version alignment is crucial because FortiAnalyzer Fabric requires that devices run compatible firmware versions for seamless communication and management.
Platform Type and Configuration:
All three devices are configured as Standalone in the HA mode, which allows them to operate independently but does not restrict their participation in a FortiAnalyzer Fabric. Each device is also on the FAZVM64-KVM platform type, ensuring hardware compatibility.
Global Settings:
Key settings such as adm-mode, adm-status, and adom-mode are consistent across all devices (adm-mode: normal, adm-status: enable, adom-mode: normal), which aligns with requirements for fabric integration and role assignment flexibility.
Each device also has the log-forward-cache-size set, which is relevant for forwarding logs within a fabric environment.
Based on the above analysis, all devices (FortiAnalyzer1, FortiAnalyzer2, and FortiAnalyzer3) meet the requirements to be part of a FortiAnalyzer Fabric.
質問 # 25
Which SQL query is in the correct order to query to database in the FortiAnalyzer?
- A. SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'
- B. SELECT devid FROM $log WHERE 'user'=' GROUP BY devid
- C. SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid
- D. SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid
正解：B
解説：
In FortiAnalyzer's SQL query syntax, the typical order for querying the database follows the standard SQL format, which is:
SELECT <column(s)> FROM <table> WHERE <condition(s)> GROUP BY <column(s)> Option D correctly follows this structure:
SELECT devid FROM $log: This specifies that the query is selecting the devid column from the $log table.
WHERE 'user' = ': This part of the query is intended to filter results based on a condition involving the user column. Although there appears to be a minor typographical issue (possibly missing the user value after =), it structurally adheres to the correct SQL order.
GROUP BY devid: This groups the results by devid, which is correctly positioned at the end of the query.
Let's briefly examine why the other options are incorrect:
Option A: SELECT devid FROM $log GROUP BY devid WHERE 'user', 'users1'
This is incorrect because the GROUP BY clause appears before the WHERE clause, which is out of order in SQL syntax.
Option B: SELECT FROM $log WHERE devid 'user', USER1' GROUP BY devid
This is incorrect because it lacks a column in the SELECT statement and the WHERE clause syntax is malformed.
Option C: SELCT devid WHERE 'user' - 'USER1' FROM $log GROUP BY devid
This is incorrect because the SELECT keyword is misspelled as SELCT, and the WHERE condition syntax is invalid.
質問 # 26
You are trying to configure a task in the playbook editor to run a report.
However, when you try to select the desired playbook, you do to see it listed.
What is the reason?
- A. The report has no result and must be reconfigured.
- B. The playbook is currently running and will be available after it is finished.
- C. You must create a trigger to run the report first.
- D. The report does not have auto-cache and extended log filtering enabled.
正解：D
質問 # 27
What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?
- A. The detection engine classifies those logs as Suspicious
- B. The endpoint is marked as Compromised and. optionally, can be put in quarantine.
- C. A new Infected entry is added for the corresponding endpoint.
- D. FortiAnalyzer flags the associated host for further analysis.
正解：B
質問 # 28
For which two SAML roles can the FortiAnalyzer be configured? (Choose two.)
- A. Identity collector
- B. Principal
- C. Identity provider
- D. Service provider
正解：C、D
質問 # 29
Refer to the exhibit.
Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin" and coming from Laptop1.
Which filter will achieve the desired result?
- A. operation-login & dstip==10.1.1.210 & userl-admin
- B. operation-login & performed_on=="GUI(10.1.1.210)' & user!=admin
- C. operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin
- D. operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin
正解：C
質問 # 30
Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?
- A. Outbreak alert services
- B. FortiView Monitor
- C. Threat hunting
- D. Incidents dashboards
正解：C
質問 # 31
What is the purpose of output variables?
- A. To save all the task settings when a playbook is exported
- B. To store playbook execution statistics
- C. To use the output of the previous task as the input of the current task
- D. To display details of the connectors used by a playbook
正解：C
質問 # 32
Which two FortiAnalyzer features allow you to automatically build a dataset and chart based on a filtered search result? (Choose two.)
- A. Dataset Library
- B. Chart Builder
- C. Export to Report Chart (FortiView)
- D. Custom View
正解：B、C
質問 # 33
Refer to the exhibit.
What does the data point at 12:20 indicate?
- A. The log insert lag time is increasing.
- B. The performance of FortiAnalyzer is below the baseline.
- C. The sqlplugind service is caught up with new logs.
- D. FortiAnalyzer is using its cache to avoid dropping logs.
正解：A
質問 # 34
Which two statements about log forwarding are true? (Choose two.)
- A. Forwarded logs cannot be filtered to match specific criteria.
- B. Logs are forwarded in real-time only.
- C. You can use aggregation mode only with another FortiAnalyzer.
- D. The client retains a local copy of the logs after forwarding.
正解：C、D
質問 # 35
Refer to the exhibit.
The exhibit shows "remoteservergroup" is an authentication server group with LDAP and RADIUS servers.
Which two statements express the significance of enabling "Match all users on remote server" when configuring a new administrator? (Choose two.)
- A. Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.
- B. It allows administrators to use two-factor authentication.
- C. Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.
- D. It creates a wildcard administrator using LDAP and RADIUS servers.
正解：A、D
質問 # 36
Which statements are correct regarding FortiAnalyzer reports? (Choose two)
- A. FortiAnalyzer includes pre-defined reports only.
- B. FortiAnalyzer glows you to schedule reports to run.
- C. FortiAnalyzer provides the ability to create custom reports.
- D. FortiAnalyzer allows reporting for FortiGate devices only.
正解：B、C
質問 # 37
Which two methods are the most common methods to control and restrict administrative access on FortiAnalyzer? (Choose two.)
- A. Security Fabric.
- B. Administrative access profiles.
- C. Virtual domains.
- D. Trusted hosts.
正解：B、D
質問 # 38
What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)
- A. The size of newly generated reports is optimized to conserve disk space.
- B. The generation time for reports is decreased.
- C. FortiAnalyzer local cache is used to store generated reports.
- D. When new logs are received, the hard-cache data is updated automatically.
正解：B、C
解説：
Enabling auto-cache in FortiAnalyzer reports is designed to improve the efficiency and speed of report generation by leveraging cached data. Let's analyze each option to determine which effects are correct.
Option A - The Generation Time for Reports is Decreased:
When auto-cache is enabled, FortiAnalyzer can use previously cached data instead of reprocessing all log data from scratch each time a report is generated. This results in faster report generation times, especially for recurring reports that use similar datasets.
Conclusion: Correct.
Option B - Hard-Cache Data is Automatically Updated When New Logs are Received:
Enabling auto-cache does not immediately update the cache with every new log received. Instead, the cache is updated when reports are generated, based on the existing logs up to that point. Therefore, auto-cache does not constantly refresh with each incoming log, which would be inefficient.
Conclusion: Incorrect.
Option C - FortiAnalyzer Local Cache is Used to Store Generated Reports:
Auto-cache utilizes FortiAnalyzer's local cache to store data used in reports, reducing the need to retrieve and process logs repeatedly. This cached data can be reused for subsequent report generation, enhancing performance.
Conclusion: Correct.
Option D - The Size of Newly Generated Reports is Optimized to Conserve Disk Space:
Auto-cache does not directly impact the size of the report files themselves. It focuses on performance optimization through cached data for faster access, but it does not compress or optimize the storage size of the generated report.
Conclusion: Incorrect.
Conclusion:
Correct Answe r : A. The generation time for reports is decreased and C. FortiAnalyzer local cache is used to store generated reports.
Enabling auto-cache helps reduce report generation time by using locally cached data and optimizes report processing, though it does not impact report size or continuously update with each new log.
Reference:
FortiAnalyzer 7.4.1 documentation on report caching, auto-cache functionality, and report generation optimizations.
質問 # 39
How can you attach a report to an incident?
- A. From the properties of an existing incident
- B. Saving it in JSON format, and then importing it
- C. By editing the settings of the desired report
- D. By attaching it to an event handler alert
正解：A
質問 # 40
......
無料でゲット！2025年最新のに更新されたFortinet FCP_FAZ_AN-7.4試験問題と解答：https://www.passtest.jp/Fortinet/FCP_FAZ_AN-7.4-shiken.html
合格させるFCP_FAZ_AN-7.4試験には更新された58問題あります：https://drive.google.com/open?id=1b2UwwWNmYxeGtryEZOdovZP1UVVH8H_0