Fortinet FCP_FAZ_AN-7.6 Exam With Confidence Using Practice Dumps

Exact Extract: Study Guide p.78 and p.81: a data selector is a common filter applied before every rule in the event handler.

Technical Deep Dive: The correct answer is C. Data selectors prevent analysts from repeating the same filtering logic in each event-handler rule. They narrow the data evaluated by the handler using device, subnet, and log-field criteria before individual rules are processed. Option A is wrong because data selectors do not control what FortiAnalyzer accepts from registered devices. Option B is invented; they do not download filters. Option D is too broad because a data selector is applied to selected handlers, not automatically to all event handlers at the same time.

Exact Extract: Study Guide p.22-p.24: analyzer is the default mode; collector mode forwards logs, including to syslog/CEF, and mixed deployments improve scale.

Technical Deep Dive: The correct answers are A and D. In collector mode, FortiAnalyzer collects logs and forwards them to another analyzer, syslog server, or CEF server depending on forwarding mode. A topology using both collectors and analyzers can improve performance and regional scalability by offloading collection and keeping analysis/reporting on analyzer devices. Option B is wrong because analyzer mode is the default, not collector mode. Option C is wrong because collector mode has fewer features and does not provide reporting or event-management capabilities.

Exact Extract: Study Guide p.39 and p.63: FortiView displays analytics logs, while archive logs are offline and data policy controls retention.

Technical Deep Dive: The correct answers are C and D. If a specific security log is not visible in FortiView, the analyst should verify whether the ADOM data policy has purged or moved analytics logs outside the available window and check the logs through the appropriate log-browsing/search interface. Option A is wrong because .gz archive logs are offline and are not directly opened in FortiView. Option B is too aggressive as a first troubleshooting step; rebuilding the SQL database is not the normal explanation when the issue may simply be retention or archive status.