[2026年更新]FCP_FAZ_AN-7.6.PDFの問題回答PDFサンプル問題現実的
Fortinet FCP_FAZ_AN-7.6問題集PDFはまもなく最高のベストスコア
Fortinet FCP_FAZ_AN-7.6 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 11
Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)?
(Choose two.)
- A. URL
- B. Application category
- C. Policy ID
- D. IP address
正解：A、D
解説：
FortiAnalyzer identifies IOCs by matching observable threat artifacts such as IP addresses and URLs, which are standard IOC indicators used for correlation across logs and threat intelligence sources.
質問 # 12
Which SQL query is in the correct order to query to database in the FortiAnalyzer?
- A. SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid
- B. SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'
- C. SELECT devid FROM $log WHERE 'user'=' GROUP BY devid
- D. SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid
正解：C
解説：
In FortiAnalyzer's SQL query syntax, the typical order for querying the database follows the standard SQL format, which is:
SELECT <column(s)> FROM <table> WHERE <condition(s)> GROUP BY <column(s)>
* Option D correctly follows this structure:
* SELECT devid FROM $log: This specifies that the query is selecting the devid column from the $log table.
* WHERE 'user' = ': This part of the query is intended to filter results based on a condition involving the user column. Although there appears to be a minor typographical issue (possibly missing the user value after =), it structurally adheres to the correct SQL order.
* GROUP BY devid: This groups the results by devid, which is correctly positioned at the end of the query.
Let's briefly examine why the other options are incorrect:
* Option A: SELECT devid FROM $log GROUP BY devid WHERE 'user', 'users1'
* This is incorrect because the GROUP BY clause appears before the WHERE clause, which is out of order in SQL syntax.
* Option B: SELECT FROM $log WHERE devid 'user', USER1' GROUP BY devid
* This is incorrect because it lacks a column in the SELECT statement and the WHERE clause syntax is malformed.
* Option C: SELCT devid WHERE 'user' - 'USER1' FROM $log GROUP BY devid
* This is incorrect because the SELECT keyword is misspelled as SELCT, and the WHERE condition syntax is invalid.
* FortiAnalyzer documentation for SQL queries indicates that the standard SQL order should be followed when querying logs in FortiAnalyzer. Queries should follow the format SELECT ... FROM ... WHERE ...
GROUP BY ..., as demonstrated in option D.
質問 # 13
In your role as an analyst, you frequently search the log view using the same parameters.
Instead of defining the same search filters repeatedly, what can you do to save time?
- A. Configure a custom view.
- B. Configure a custom dashboard.
- C. Configure a report template.
- D. Configure a chart template and apply it to device groups.
正解：A
解説：
In FortiAnalyzer, a custom view allows you to save frequently used search filters and parameters in Log View. This enables you to quickly reuse the same search criteria without redefining the filters each time, saving significant time during log analysis.
質問 # 14
Exhibit.
What can you conclude about these search results? (Choose two.)
- A. They were searched by using text mode.
- B. They can be downloaded to a file.
- C. They are not available for analysis in FortiView.
- D. They are sortable by columns and customizable.
正解：A、B
質問 # 15
Refer to the exhibit. What does the orange status indicator on the FortiGuard Connector indicate?
- A. The connection is disconnected.
- B. The connection is down.
- C. The connection is unknown.
- D. The connection is successful.
正解：C
解説：
An orange (amber) status indicator on a Fortinet connector signifies an unknown connection status, typically meaning FortiAnalyzer cannot verify connectivity to the service at that moment.
質問 # 16
(Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)? (Choose two answers)
- A. URL
- B. Application category
- C. Policy ID
- D. IP address
正解：A、D
解説：
Exact Extract: Study Guide p.94 and p.130-p.131: indicators include IP addresses, URLs, and domains; IOC checks use IP/domain/URL values.
Technical Deep Dive: The correct answers are A and B. FortiAnalyzer identifies IOC matches by checking log artifacts such as IP addresses, domains, and URLs against FortiGuard threat intelligence. IP address and URL are explicitly listed as indicator types and IOC comparison parameters. Policy ID identifies which FortiGate policy matched traffic, but it is not an IOC artifact. Application category describes application classification, not a compromise indicator used for FortiGuard IOC matching.
質問 # 17
Which two statements about playbook execution are true? (Choose two.)
- A. FortiAnalyzer will commit changes made by a Failed playbook.
- B. The Playbook Monitor provides troubleshooting logs.
- C. If the playbook status is Failed, all individual tasks in the playbook will fail.
- D. You can run the default debugging playbook to investigate playbook errors.
正解：B、D
解説：
FortiAnalyzer provides a default debugging playbook that can be used to help investigate and troubleshoot playbook execution errors. The Playbook Monitor displays execution details and logs, which assist in identifying the cause of failures and analyzing task behavior during playbook runs.
質問 # 18
Refer to the exhibit.
An analyst is trying to create a dataset to pull all gambling websites that were visited by end users.
Which SQL query on FortiAnalyzer will give the result shown in the exhibit?
- A. select srcip as " SourceIPv6 " , dstip as " DestIPv6 " , url from $log where catdesc = ' Gambling '
- B. [Selected] select srcip as " SourceIP " , dstip as " DestIP " , url from $log where catdesc = ' Gambling '
- C. select srcip as " SourceIP " , dstip as " DestIP " , url from $log where catdesc = ' Dating '
- D. select srcip as " SourceIP " , dstip as " DestIP " , url from ' Gambling ' where catdesc = $log
正解：B
解説：
Exact Extract: Study Guide p.157-p.159: datasets are SQL SELECT queries over $log, and WHERE filters narrow returned log rows.
Technical Deep Dive: The correct answer is A. The required dataset must select source IP, destination IP, and URL from $log, then filter web-filter logs where the category description equals Gambling. Option A uses the correct fields and catdesc filter. Option B incorrectly uses IPv6 aliases that do not match the expected output.
Option C filters Dating instead of Gambling. Option D reverses the table and filter logic by placing Gambling in the FROM position and $log in the WHERE expression, which is invalid for the intended dataset.
質問 # 19
Which database language does FortiAnalyzer support for the purposes of logging and reporting?
- A. XML
- B. SQL
- C. SSH
- D. LDAP
正解：A
質問 # 20
Which three types of indicators can FortiAnalyzer identify? (Choose three.)
- A. URL
- B. Email address
- C. Domain
- D. Host name
- E. IP address
正解：A、C、E
解説：
FortiAnalyzer's IOC engine identifies common network-based indicators such as domains, URLs, and IP addresses, which are used for correlation and threat detection across logs.
質問 # 21
Refer to the exhibits.
The event shown in the exhibit has been escalated to an incident.
Which SOC role is responsible for handling the escalated incident?
- A. Threat hunter
- B. Security analyst
- C. SOC engineer
- D. Incident responder
正解：D
解説：
Exact Extract: Study Guide p.9: Tier 2 Incident Responder investigates escalated alerts in more depth for response.
Technical Deep Dive: The correct answer is D. When an event is escalated into an incident, the SOC role responsible for deeper handling and response is the incident responder. Tier 1 security analysts handle monitoring and triage. Threat hunters proactively search for complex or hidden threats rather than owning every escalated incident. SOC engineers maintain tools such as SIEM/SOAR platforms but are not the primary incident-handling role. The guide's SOC role model places escalated response work with the Incident Responder.
質問 # 22
Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?
- A. FortiView Monitor
- B. Outbreak alert services
- C. Incidents dashboard
- D. Threat hunting
正解：D
解説：
FortiAnalyzer offers several features for monitoring, alerting, and incident management, each serving different purposes. Let's examine each option to determine which one best supports a proactive security approach.
* Option A - FortiView Monitor:
* FortiView is a visualization tool that provides real-time and historical insights into network traffic, threats, and logs. While it gives visibility into network activity, it is generally more reactive than proactive, as it relies on existing log data and incidents.
* Conclusion: Incorrect.
* Option B - Outbreak Alert Services:
* Outbreak Alert Services in FortiAnalyzer notify administrators of emerging threats and outbreaks based on FortiGuard intelligence. This is beneficial for awareness of potential threats but does not offer a hands-on, investigative approach. It's more of a notification service rather than an active, proactive investigation tool.
* Conclusion: Incorrect.
* Option C - Incidents Dashboard:
* The Incidents Dashboard provides a summary of incidents and current security statuses within the network. While it assists with ongoing incident response, it is used to manage and track existing incidents rather than proactively identifying new threats.
* Conclusion: Incorrect.
* Option D - Threat Hunting:
* Threat Hunting in FortiAnalyzer enables security analysts to actively search for hidden threats or malicious activities within the network by leveraging historical data, analytics, and intelligence.
This is a proactive approach as it allows analysts to seek out threats before they escalate into incidents.
* Conclusion: Correct.
Conclusion:
* Correct Answer: D. Threat hunting
* Threat hunting is the most proactive feature among the options, as it involves actively searching for threats within the network rather than reacting to already detected incidents.
References:
FortiAnalyzer 7.4.1 documentation on Threat Hunting and proactive security measures.
質問 # 23
Refer to Exhibit. Client-1 is trying to access the internet for web browsing. All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured. All firewall policies have logging enabled. All web filter profiles are configured to log only violations.
Which statement about the logging behavior for this specific traffic flow is true?
- A. Only FGT-B will create traffic logs.
- B. Only FGT-A will create web filter logs if it detects a violation.
- C. FGT-B will see the MAC address of FGT-A as the destination and notifies FGT-A to log this flow.
- D. FGT B will create traffic logs and will create web filter logs if it detects a violation.
正解：D
解説：
The topology shows a Security Fabric setup involving FortiGate devices (FGT-A and FGT-B) and a FortiAnalyzer for centralized logging. Let's break down the logging and traffic flow behavior:
Traffic Flow Analysis:
Client-1 initiates web traffic directed to the internet, which is routed through FGT-B and then FGT- A before reaching the internet. This is indicated by the direction of the red-dashed arrow from Client-1 through FGT-B to FGT-A.
Policy and NAT Settings:
On FGT-B, NAT is disabled, meaning it will pass the traffic through without altering the source IP.
This device has a Web Filter enabled with a policy to log violations only. On FGT-A, NAT is enabled, and a Web Filter profile is also applied. Like FGT-B, it logs only violations for web filtering.
Logging Behavior:
Since both FortiGate devices have logging enabled for traffic and web filtering, they can create logs if conditions are met.
FGT-B will log all traffic, as per its configuration, and will also create web filter logs if it detects a violation, as the web filter profile is applied. Because NAT is disabled on FGT-B, it processes the traffic but doesn't perform any address translation, allowing it to see the original source IP of Client-1. FGT-A, as the Security Fabric root, will handle NAT and forward the traffic to the internet. However, in this case, the question is focused on where the traffic and web filter logs would be generated first, particularly by FGT-B.
質問 # 24
Exhibit.
Which statement about the event displayed is correct?
- A. An incident was created from this event.
- B. The security risk was blocked or dropped.
- C. The risk source is isolated.
- D. The security event risk is considered open.
正解：D
質問 # 25
An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer.
Which item must you configure on FortiAnalyzer so that emails are sent when the reports are generated?
- A. Enable an output profile on the reports.
- B. Enable email notification under the report calendar.
- C. Enable the option to email all repots under the mail server.
- D. Add a mailto:<email address> option within the report layouts.
正解：A
解説：
In FortiAnalyzer, reports can be sent by email only if an output profile is configured and assigned to them. The output profile defines the delivery method (such as email), and uses the already configured mail server to send the reports.
質問 # 26
Refer to Exhibit:
Client-1 is trying to access the internet for web browsing.
All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured.
All firewall policies have logging enabled. All web filter profiles are configured to log only violations.
Which statement about the logging behavior for this specific traffic flow is true?
- A. Only FGT-A will create web filter logs if it detects a violation.
- B. Only FGT-B will create traffic logs.
- C. FGT-B will see the MAC address of FGT-A as the destination and notifies FGT-A to log this flow.
- D. FGT B will create traffic logs and will create web filter logs if it detects a violation.
正解：A
解説：
The study guide explains that in a Security Fabric, traffic logging is not duplicated across FortiGates for the same session: "Traffic logging for a session ... is always carried out by the first FortiGate that handled it" and if a FortiGate receives traffic from a peer FortiGate MAC, "it does not generate a new traffic log for that session." For UTM (web filtering) logs, the study guide states: "When configured, upstream devices complete UTM logging." In the illustrated example, it further clarifies the role split: "All traffic from Client-1 is first received by FGT-B, which creates traffic logs for the initial session... [then] forwarded to FGT-A... [and] FGT-A
... applies web filtering ... and generates the relevant UTM logs as necessary." Because web filter profiles are configured to log only violations, web filter (UTM) logs will be generated only when a violation is detected-and per the study guide behavior, that UTM logging is done by the upstream FortiGate (FGT-A). Therefore, only FGT-A will create web filter logs if it detects a violation (Option D).
質問 # 27
You are trying to configure a task in the playbook editor to run a report.
However, when you try to select the desired playbook, you do to see it listed.
What is the reason?
- A. The report does not have auto-cache and extended log filtering enabled.
- B. The playbook is currently running and will be available after it is finished.
- C. The report has no result and must be reconfigured.
- D. You must create a trigger to run the report first.
正解：D
質問 # 28
You are tasked with finding logs corresponding to a suspected attack on your network. You need to use an interface where all identified threats within timeframe are listed and organized. You also need to be able to quickly export the information to a PDF file.
Where can you go to accomplish this task?
- A. FortiView
- B. Fabric View
- C. Log Browse
- D. Log View
正解：A
解説：
FortiView is a comprehensive monitoring system on FortiAnalyzer that integrates real-time and historical data into a single view, including threats. It provides intuitive summary dashboards listing top threats, sources, destinations, and more, all filterable by timeframe and other criteria.
FortiView allows drill-down into detailed threat information and supports exporting data and reports, including to PDF format, facilitating quick sharing and analysis.
https://docs.fortinet.com/document/fortigate/7.6.3/administration-guide/96300/using-the-fortiview- interface
質問 # 29
Which statement about exporting items in Report Definitions is true?
- A. Datasets can be exported.
- B. Chart exports contain associated datasets.
- C. Templates can be exported.
- D. Template exports contain associated charts and datasets.
正解：B
質問 # 30
What are event handlers?
- A. Alert notifications
- B. Specific matched conditions in the raw logs
- C. Threats identified by FortiGuard
- D. SNMP traps
正解：B
質問 # 31
Which statement about sending notifications with incident updates is true?
- A. Notifications can be sent only when an incident is created oi deleted.
- B. Each connector used can have different notification settings
- C. You must configure an output profile to send notifications by email.
- D. Each incident can send notification to a single external platform.
正解：B
解説：
Incidents will usually go through several stages during the analysis process. In most cases, it is important to make sure all parties involved are notified when the incident status is updated.
You can add more than one fabric connector, each with the same or different notification settings.
The receiving side of the connector must be configured for the notifications to be sent successfully.
質問 # 32
......
FCP_FAZ_AN-7.6試験問題集（2026年最新のPDF問題集)現実的なFCP_FAZ_AN-7.6テストエンジン：https://www.passtest.jp/Fortinet/FCP_FAZ_AN-7.6-shiken.html
Fortinet Certified Professional FCP_FAZ_AN-7.6試験と認証テストエンジン：https://drive.google.com/open?id=1afFlsimSaNu1Bb72cCE2jOxC9024Y1Hw