Online Access Free FCP_FAZ_AN-7.6 Practice Test

Refer to the exhibit.

An analyst is using FortiView to examine the top threats observed over the last 2 hours. What can the analyst conclude from the exhibit?

• A.A cross-site scripting (XSS) attack occurred on a DNS server.
• B.FortiAnalyzer has logged only three types of IPS attacks.
• C.Malware attacks should be prioritized over IPS attacks.
• D.An SQL injection attack occurred on an application

When managing incidents on FortiAnalyzer, what must an analyst be aware of?

• A.You can manually attach generated reports to incidents.
• B.Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.
• C.Incidents must be acknowledged before they can be analyzed.
• D.The status of the incident is always linked to the status of the attached event.

You discover that a few reports are taking a long time to generate. Which two steps can you take to troubleshoot? (Choose two.)

• A.Increase the ADOM reports quota
• B.Review report diagnostics
• C.Remove old reports from the hcache
• D.Enable auto-cache and run the reports again

As part of your analysis, you discover that an incident is a false positive.
You change the incident status to Closed: False Positive.
Which statement about your update is true?

• A.The corresponding event will be marked as mitigated.
• B.The audit history log will be updated.
• C.The incident will be deleted.
• D.The incident number will be changed

Which SQL query is in the correct order to query the database in the FortiAnalyzer?

• A.SELECT FROM $log WHERE devid 'user',, USER1' GROUP BY devid
• B.SELECT devid FROM $log GROUP BY devid WHERE 'user',,' users1'
• C.SELECT devid FROM $log WHERE 'user'=' GROUP BY devid
• D.SELCT devid WHERE 'user'-' USER1' FROM $log GROUP By devid