FCP_FAZ_AN-7.6 Exam Dumps : Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst

Exact Extract: Study Guide p.200-p.203: playbooks run from a trigger and tasks can filter events before adding them to an incident.

Technical Deep Dive: The correct answer is D. The playbook task is filtering events using the configured criteria, and only the events that match those criteria are added to the incident. Because the task is configured to match any of the listed conditions, the analyst must count unique events matching severity, event type, or tag filters. The exhibit contains four unique matching events. Options A and B overcount by treating all or most events as matching. Option C is wrong because the filter is not empty and the exhibit shows events that meet the task criteria.

Exact Extract: Study Guide p.107: more than one Fabric connector can be configured, with the same or different notification settings.

Technical Deep Dive: The correct answer is A. FortiAnalyzer can send incident status-change notifications through external platform connectors, and each connector can have its own settings. That flexibility lets a SOC notify Teams, ticketing, or other platforms differently depending on the connector and activity type. Option B is wrong because the guide permits multiple connectors. Option C confuses report output profiles with incident notifications. Option D is too narrow because notifications are not limited only to created or deleted incidents.

Exact Extract: Study Guide p.189: for missing report data, check the report time frame and test the dataset.

Technical Deep Dive: The correct answers are A and D. If the logs exist but the generated report lacks expected information, the first checks are whether the report time frame includes those logs and whether the dataset query returns the expected rows. Reports are only as accurate as their time filter and SQL dataset. Disabling auto-cache is not the normal fix; cache improves performance and scheduled reports use it. Increasing a quota does not correct a wrong time range or broken SQL query unless the report fails for resource reasons, which is not the scenario described.