Fortinet FCP_FAZ_AN-7.6 Based on Real Exam Environment

Exact Extract: Study Guide p.202: FortiOS connector actions require an Incoming Webhook Call trigger configured on FortiGate.

Technical Deep Dive: The correct answer is B. The FortiOS connector can appear once FortiGate is added to FortiAnalyzer, but FortiAnalyzer will not show the FortiOS automation actions until FortiGate has the proper automation rule. The trigger required is Incoming webhook/Incoming Webhook Call. A FortiAnalyzer Event Handler is a FortiAnalyzer-side event generator, not a FortiGate trigger for connector actions. Fabric Connector event and IP ban are not the trigger type required to expose FortiOS connector actions.

Exact Extract: Study Guide p.200-p.203: playbooks run from a trigger and tasks can filter events before adding them to an incident.

Technical Deep Dive: The correct answer is D. The playbook task is filtering events using the configured criteria, and only the events that match those criteria are added to the incident. Because the task is configured to match any of the listed conditions, the analyst must count unique events matching severity, event type, or tag filters. The exhibit contains four unique matching events. Options A and B overcount by treating all or most events as matching. Option C is wrong because the filter is not empty and the exhibit shows events that meet the task criteria.

Exact Extract: Study Guide p.59: root ADOM shows local event logs; application logs are ADOM-specific.

Technical Deep Dive: The correct answers are B and D. Local event logs are available from the root ADOM and provide system-wide FortiAnalyzer information. Application logs, including logs generated by FortiAnalyzer applications such as playbooks and incident management, are ADOM-specific. Option A is wrong because local logs are accessible in Log View. Option C is wrong because playbook/application logs are not all simply placed in the root ADOM for every ADOM; non-root ADOMs show application logs relevant to that ADOM.

Exact Extract: Study Guide p.139: one log message can consist of multiple logs in LZ4 format, explaining the log-rate/message-rate difference.

Technical Deep Dive: The correct answer is A. In the diagnostic output, the message rate being lower than the log rate is normal because FortiAnalyzer can receive a compressed log message that contains multiple individual logs. The log rate counts logs, while the message rate counts received log messages. Option B is not supported because the output does not prove indexing is almost finished. Option C cannot be inferred unless the command output breaks down traffic versus event log counts. Option D is wrong because these fortilogd rate commands are general logging statistics rather than an ADOM-specific view.