Latest [Aug 09, 2025] Fortinet FCP_FAZ_AD-7.4 Exam Practice Test To Gain Brilliante Result [Q32-Q55]

Posted On August 9, 2025

Latest [Aug 09, 2025] Fortinet FCP_FAZ_AD-7.4 Exam Practice Test To Gain Brilliante Result

Take a Leap Forward in Your Career by Earning Fortinet FCP_FAZ_AD-7.4

Q32. Refer to the exhibit.

Based on the partial outputs displayed in the exhibit, which devices are ready to be configured as peers in an HA cluster?

FortiAnalyzer1 and FortiAnalyzer3

FortiAnalyzer1 and FortiAnalyzer2

These devices cannot participate in the same cluster.

FortiAnalyzer2 and FortiAnalyzer3

Based on the provided exhibit, which shows partial outputs of the system status and global settings for FortiAnalyzer devices, the devices cannot be configured as peers in an HA (High Availability) cluster.
This is indicated by the HA Mode status being set to ‘Stand Alone’ for the displayed FortiAnalyzer device.
For devices to be part of an HA cluster, they would need to have compatible HA configurations, and usually, they should not be in ‘Stand Alone’ mode. Additionally, the exhibit only shows information for one FortiAnalyzer, so it cannot be determined if there is another device ready to form an HA cluster with it.

Q33. Which two statements about high availability (HA) on FortiAnalyzer are true? (Choose two.)

FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

FortiAnalyzer HA active-passive mode can function without VRRP.

All devices in a FortiAnalyzer HA cluster must run in the same operation mode, either analyzer mode or collector mode.

All devices in a FortiAnalyzer HA cluster must have the same available disk space.

The two correct statements about high availability (HA) on FortiAnalyzer are:
FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.
FortiAnalyzer HA synchronizes both logs and certain system configuration settings between the units in the cluster to ensure consistent operation.
All devices in a FortiAnalyzer HA cluster must run in the same operation mode, either analyzer mode or collector mode.
In an HA cluster, all devices must be configured to operat` e in the same mode – either analyzer mode or collector mode-to ensure consistency and proper functionality across the cluster.
The other options, such as VRRP, are not required for HA in FortiAnalyzer, and disk space can vary between nodes but may impact log storage capacity.

Q34. If you upgrade the FortiAnalyzer firmware, which report element can be affected?

Custom datasets

Report scheduling

Report settings

Output profiles

https://docs.fortinet.com/document/fortianalyzer/6.2.5/upgrade-guide/669300/checking-reports

Q35. Refer to the exhibit.

The exhibit shows “remoteservergroup” is an authentication server group with LDAP and RADIUS servers.
Which two statements express the significance of enabling “Match all users on remote server” when configuring a new administrator? (Choose two.)

It creates a wildcard administrator using LDAP and RADIUS servers.

Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.

Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.

It allows administrators to use two-factor authentication.

Q36. Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer? (Choose two.)

Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

Make sure all endpoints are reachable by FortiAnalyzer.

Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.

Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

In order to configure IOC, you require the following:
* A one-year subscription to IOC. Note that FortiAnalyzer does include an evaluation license, but it is restrictive and only meant to give you an idea of how the feature works.
* A web filter services subscription on FortiGate device(s)
* Web filter policies on FortiGate device(s) that send traffic to FortiAnalyzer Compromised Hosts or Indicators of Compromise service (IOC) is a licensed feature.
To view Compromised Hosts, you must turn on the UTM web filter of FortiGate devices and subscribe your FortiAnalyzer unit to FortiGuard to keep its local threat database synchronized with the FortiGuard threat database. See Subscribing FortiAnalyzer to FortiGuard.
Ref : https://docs.fortinet.com/document/fortianalyzer/6.4.0/administration-guide/137635/viewing-compromised-hosts

Q37. Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?

Antivirus logs

Web filter logs

IPS logs

Application control logs

Reference:
FortiAnalyzer_Admin_Guide/3600_FortiView/0200_Using_FortiView/1200_Compromised_hosts_page.htm?
TocPath=FortiView%7CUsing%20FortiView%7C_____6

Q38. Which statement correctly describes RAID 10 (1+0) on FortiAnalyzer?

A configuration with four disks, each with 2 TB of capacity, provides a total space of 4 TB.

11 combines mirroring striping and distributed parity to provide performance and fault tolerance

A configuration with four disks, each with 2 TB of capacity, provides a total space of 2 TB.

It uses striping to provide performance and fault tolerance.

RAID 10 combines mirroring (RAID 1) and striping (RAID 0). In a RAID 10 setup with four disks, data is mirrored across two pairs of disks, and those pairs are striped for performance. This results in improved performance and fault tolerance, but the total usable storage is 50% of the total raw storage, meaning four 2 TB disks provide 4 TB of usable space.

Q39. Refer to the exhibit.

Which image corresponds to the packet capture shown in the exhibit?

The exhibit shows a packet capture with a syslog message containing a log event from a FortiGate device. This log event includes several details such as the date, time, and event message. The corresponding image that matches this packet capture would be the one which shows that the FortiGate device has logs being received in real-time, as indicated by the highlighted section in the packet capture where it mentions “real-time”. Therefore, Option A is the correct answer because it shows logs with “Real Time” status for the FortiGate-VM64 device, indicating that this FortiAnalyzer is currently receiving real- time logs from the device, matching the activity in the packet capture.
Reference: Based on the provided exhibits and the real-time logging information, correlated with the knowledge from the FortiAnalyzer 7.2 Administrator documentation regarding log reception and device management.

Q40. Which statement describes online logs on FortiAnalyzer?

Logs that reached a specific size and were rolled over

Logs that can be used to create reports

Logs that can be viewed using Log Browse

Logs that are saved to disk, compressed, and available in FortiView

Q41. Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate on FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

A local wildcard administrator account

One or more remote LDAP servers

An administrator group

LDAP servers IP addresses added as trusted hosts

A wildcard administrator account allows any user from the specified LDAP group to authenticate, and the remote LDAP servers must be configured to validate those user credentials. The combination of these settings enables authentication via LDAP for non-local users.

Q42. Which item must you configure on FortiAnalyzer to email generated reports automatically?

Output profile

Report scheduling

SFTP server

SNMP server

Q43. What are analytics logs on FortiAnalyzer?

Logs that are saved in the active log file with the. log extension.

Logs that are compressed and saved to a log file with the, gz extension.

Logs that are rolled over when the log file reaches a specific size.

Logs that are indexed and stored in the SQL database.

Analytics logs on FortiAnalyzer are those that are indexed and stored in the SQL database.
These logs are considered online and provide real-time access for analysis and reporting.
https://help.fortinet.com/fa/faz50hlp/56/5-6-2/FortiAnalyzer_Admin_Guide/0300_Key_concepts/0600_Log_Storage/0400_Archive_analytics_logs.htm

Q44. Which two statements about creating ADOMs are true1? (Choose two.)

An administrator with the default standard_User profile can create ADOMs.

Disk quotas can be defined per device inside the ADOM.

FortiAnalyzer creates default ADOMs when ADOMs are enabled.

The ADOM type you create must match the device type you are planning to add.

Q45. Why run the command diagnose sql status sqlplugind?

To list the current SQL processes running

To check what is the database log insertion status

To display the SOL query connections and hcache status

To view the current hcache size

Q46. Refer to the exhibit.

Which image corresponds to the packet capture shown in the exhibit?

Option A

Option B

Option C

Option D

FortiAnalyzer Administrator 7.2 Study Guide p. 183 OFTP is used over SSL when information is synchronized between FortiAnalyzer and FortiGate. OFTP listens on port TCP/514. Port UDP/514 is used for unencrypted log communication.

Q47. Which statement is true about ADOMs?

A fabric ADOM can include all the device types supported by FortiAnalyzer.

When a FortiAnalyzer Fabric is implemented the default ADOM mode is set to advanced.

In normal mode, you cannot change the disk quota of the ADOM after its creation.

You can change the ADOM mode only through the GUI.

Q48. In Log View, you can use the Chart Builder feature to build a dataset and chart based on the filtered search results.
Similarly, which feature you can use for FortiView?

Export to Report Chart

Export to PDF

Export to Chart Builder

Export to Custom Chart

Reference:
Similar to the Chart Builder feature in Log View, you can export a chart from a FortiView. The chart export includes any filters you set on the FortiView. FortiAnalyzer_7.0_Study_Guide-Online pag. 292.

Q49. An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.
What should the administrator do to solve this issue?

Use the execute sql-local rebuild-db command to rebuild all ADOM databases.

Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.

Use the execute sql-report run ADOM1 command to run a report.

Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

Q50. What is the recommended method of expanding disk space on a FortiAnalyzer VM?

From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage

From the VM host manager, expand the size of the existing virtual disk

From the VM host manager, expand the size of the existing virtual disk and use the # execute format disk command to reformat the disk

From the VM host manager, add an additional virtual disk and rebuild your RAID array

https://kb.fortinet.com/kb/documentLink.do?externalID=FD40848

Q51. What does the disk status Degraded mean for RAID management?

One or more drives are missing from the FortiAnalyzer unit. The drive is no longer available to the operating system.

The FortiAnalyzer device is writing to all the hard drives on the device in order to make the array fault tolerant.

The FortiAnalyzer device is writing data to a newly added hard drive in order to restore the hard drive to an optimal state.

The hard driveiIs no longer being used by the RAID controller

Q52. What are offline logs on FortiAnalyzer?

Compressed logs, which are also known as archive logs, are considered to be offline logs.

When you restart FortiAnalyzer. all stored logs are considered to be offline logs.

Logs that are indexed and stored in the SQL database.

Logs that are collected from offline devices after they boot up.

Reference:
Logs are received and saved in a log file on the FortiAnalyzer disks. Eventually, when the log file reaches a configured size, or at a set schedule, it is rolled over by being renamed. These files (rolled or otherwise) are known as archive logs and are considered offline so they don’t offer immediate analytic support. Combined, they count toward the archive quota and retention limits, and they are deleted based on the ADOM data policy. FortiAnalyzer_7.0_Study_Guide-Online page 140

Q53. How can you attach a report to an incident?

By attaching it to an event handler alert

By editing the settings of the desired report

From the properties of an existing incident

Saving it in JSON format, and then importing it

Q54. Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy.
What is the most likely problem?

CPU resources are too high

Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device

The total disk space is insufficient and you need to add other disk

The ADOM disk quota is set too low, based on log rates

Reference:
20logs.htm

Q55. You are using RAID with a FortiAnalyzer that supports software RAID, and one of the hard disks on FortiAnalyzer has failed.
What is the recommended method to replace the disk?

Shut down FortiAnalyzer and then replace the disk

Downgrade your RAID level, replace the disk, and then upgrade your RAID level

Clear all RAID alarms and replace the disk while FortiAnalyzer is still running

Perform a hot swap

https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-How-to-swap-Hard-Disk-on-FortiAnalyzer/ta-p/194997?externalID=FD41397#:~:text=If%20a%20hard%20disk%20on,process%20known%20as%20hot%20swapping

Loading …