Fortinet FCP_FAZ_AN-7.4 Exam Dumps

B.   An IPS log with action=pass.

Answer DescriptionExplanation: In FortiOS 7.4.1 and FortiAnalyzer 7.4.1, the "Unhandled" status in logs typically signifies that the FortiGate encountered a security event but did not take any specific action to block or alter it. This usually occurs in the context of Intrusion Prevention System (IPS) logs.
IPS logs with action=pass: When the IPS engine inspects traffic and determines that it does not match any known attack signatures or violate any configured policies, it assigns the action "pass". Since no action is taken to block or modify this traffic, the status is logged as "Unhandled."
Let's look at why the other options are incorrect:
An AV log with action=quarantine: Antivirus (AV) logs with the action "quarantine" indicate that a file was detected as malicious and moved to quarantine. This is a definitive action, so the status wouldn't be "Unhandled."
A WebFilter log will action=dropped: WebFilter logs with the action "dropped" indicate that web traffic was blocked according to the configured web filtering policies. Again, this is a specific action taken, not an "Unhandled" event.
An AppControl log with action=blocked: Application Control logs with the action "blocked" mean that an application was denied access based on the defined application control rules. This is also a clear action, not "Unhandled."

D.   Four events will be added.

A.   The generation time for reports is decreased.


C.   FortiAnalyzer local cache is used to store generated reports.

A.   You can manually attach generated reports to incidents.

Answer DescriptionExplanation: In FortiAnalyzer's incident management system, analysts have the option to manually manage incidents, which includes attaching relevant reports to an incident for further investigation and documentation. This feature allows analysts to consolidate information, such as detailed reports on suspicious activity, into an incident record, providing a comprehensive view for incident response.
Let's review the other options to clarify why they are incorrect:
Option A: You can manually attach generated reports to incidents Option B: The status of the incident is always linked to the status of the attached event
Option C: Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour
Option D: Incidents must be acknowledged before they can be analyzed
References: According to FortiAnalyzer documentation, analysts can attach reports to incidents manually, making option A correct. This feature enables better tracking and documentation within the incident management system on FortiAnalyzer.

C.   You can import a playbook even if there is another one win the same name in the destination


D.   You can export only one playbook at a time.

A.   The ADOMs must be compatible types.


C.   All charts and datasets associated with the report will be imported together.

C.   FGT B will create traffic logs and will create web filter logs if it detects a violation.

A.   The message rate being lower that the log rate is normal.