FCP_FAZ_AN-7.6 Exam Dumps : Fortinet NSE 5 - FortiAnalyzer 7.6 Analyst

Exact Extract: Study Guide p.94 and p.130-p.131: indicators include IP addresses, URLs, and domains; IOC checks use IP/domain/URL values.

Technical Deep Dive: The correct answers are A and B. FortiAnalyzer identifies IOC matches by checking log artifacts such as IP addresses, domains, and URLs against FortiGuard threat intelligence. IP address and URL are explicitly listed as indicator types and IOC comparison parameters. Policy ID identifies which FortiGate policy matched traffic, but it is not an IOC artifact. Application category describes application classification, not a compromise indicator used for FortiGuard IOC matching.

Exact Extract: Study Guide p.98: blocking suspicious indicators requires an authorized FortiManager connector and updates a FortiManager External Resource list.

Technical Deep Dive: The correct answer is B. FortiAnalyzer does not directly push the block to FortiGate from the indicator page. It uses a FortiManager connector; the Block_indicator playbook periodically sends blocked indicators to FortiManager, where they are added to an External Resource list. FortiManager policies or threat feeds can then be used to push enforcement to FortiGate. Option A skips FortiManager, which is the documented control point. Options C and D use the wrong integration mechanism for indicator blocking.

Exact Extract: Study Guide p.22-p.24: analyzer is the default mode; collector mode forwards logs, including to syslog/CEF, and mixed deployments improve scale.

Technical Deep Dive: The correct answers are A and D. In collector mode, FortiAnalyzer collects logs and forwards them to another analyzer, syslog server, or CEF server depending on forwarding mode. A topology using both collectors and analyzers can improve performance and regional scalability by offloading collection and keeping analysis/reporting on analyzer devices. Option B is wrong because analyzer mode is the default, not collector mode. Option C is wrong because collector mode has fewer features and does not provide reporting or event-management capabilities.