FCP_FAZ_AN-7.4 FCP - FortiAnalyzer 7.4 Analyst Questions and Answers

FortiAnalyzer offers several features for monitoring, alerting, and incident management, each serving different purposes. Let's examine each option to determine which one best supports a proactive security approach.

Option A - FortiView Monitor:

FortiView is a visualization tool that provides real-time and historical insights into network traffic, threats, and logs. While it gives visibility into network activity, it is generally more reactive than proactive, as it relies on existing log data and incidents.

Conclusion: Incorrect.

Option B - Outbreak Alert Services:

Outbreak Alert Services in FortiAnalyzer notify administrators of emerging threats and outbreaks based on FortiGuard intelligence. This is beneficial for awareness of potential threats but does not offer a hands-on, investigative approach. It’s more of a notification service rather than an active, proactive investigation tool.

Conclusion: Incorrect.

Option C - Incidents Dashboard:

The Incidents Dashboard provides a summary of incidents and current security statuses within the network. While it assists with ongoing incident response, it is used to manage and track existing incidents rather than proactively identifying new threats.

Conclusion: Incorrect.

Option D - Threat Hunting:

Threat Hunting in FortiAnalyzer enables security analysts to actively search for hidden threats or malicious activities within the network by leveraging historical data, analytics, and intelligence. This is a proactive approach as it allows analysts to seek out threats before they escalate into incidents.

Conclusion: Correct.

Conclusion:

Correct Answer: D. Threat hunting

Threat hunting is the most proactive feature among the options, as it involves actively searching for threats within the network rather than reacting to already detected incidents.

References:

FortiAnalyzer 7.4.1 documentation on Threat Hunting and proactive security measures.

When you frequently use the same search parameters in FortiAnalyzer’s Log View, setting up a reusable filter or view can save considerable time. Here’s an analysis of each option:

Option A - Configure a Custom Dashboard:

Custom dashboards are useful for displaying a variety of widgets and summaries on network activity, performance, and threat data, but they are not designed for storing specific search filters for log views.

Conclusion: Incorrect.

Option B - Configure a Custom View:

Custom views in FortiAnalyzer allow analysts to save specific search filters and configurations. By setting up a custom view, you can retain your frequently used search parameters and quickly access them without needing to reapply filters each time. This option is specifically designed to streamline the process of recurring log searches.

Conclusion: Correct.

Option C - Configure a Data Selector:

Data selectors are used to define specific types of data for FortiAnalyzer reports and widgets. They are useful in reports but are not meant for saving and reusing log search parameters in Log View.

Conclusion: Incorrect.

Option D - Configure a Macro and Apply It to Device Groups:

Macros in FortiAnalyzer are generally used for automation tasks, not for saving log search filters. Applying macros to device groups does not fulfill the requirement of saving specific log view search parameters.

Conclusion: Incorrect.

Conclusion:

Correct Answer: B. Configure a custom view.

Custom views allow you to save specific search filters, enabling quick access to frequently used parameters in Log View.

References:

FortiAnalyzer 7.4.1 documentation on creating and using custom views for log searches.

To view Compromised Hosts on FortiAnalyzer, certain configurations need to be in place on both FortiGate and FortiAnalyzer. Compromised Host data on FortiAnalyzer relies on log information from FortiGate to analyze threats and compromised activities effectively. Here’s why the selected answers are correct:

Option A: Enable device detection on the FortiGate devices that are sending logs to FortiAnalyzer

Enabling device detection on FortiGate allows it to recognize and log devices within the network, sending critical information about hosts that could be compromised. This is essential because FortiAnalyzer relies on these logs to determine which hosts may be at risk based on suspicious activities observed by FortiGate. This setting enables FortiGate to provide device-level insights, which FortiAnalyzer uses to populate the Compromised Hosts view.

Option B: Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer

Web filtering is crucial in identifying potentially compromised hosts since it logs any access to malicious sites or blocked categories. FortiAnalyzer uses these web filter logs to detect suspicious or malicious web activity, which can indicate compromised hosts. By ensuring that FortiGate sends these web filtering logs to FortiAnalyzer, the administrator enables FortiAnalyzer to analyze and identify hosts engaging in risky behavior.

Let’s review the other options for clarity:

Option C: Make sure all endpoints are reachable by FortiAnalyzer

This is incorrect. FortiAnalyzer does not need direct access to all endpoints. Instead, it collects data indirectly from FortiGate logs. FortiGate devices are the ones that interact with endpoints and then forward relevant logs to FortiAnalyzer for analysis.

Option D: Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date

Although subscribing to FortiGuard helps keep threat intelligence updated, it is not a requirement specifically to view compromised hosts. FortiAnalyzer primarily uses logs from FortiGate (such as web filtering and device detection) to detect compromised hosts.

References: According to FortiOS and FortiAnalyzer documentation, device detection on FortiGate and enabling web filtering logs are both recommended steps for populating the Compromised Hosts view on FortiAnalyzer. These logs provide insights into device behaviors and web activity, which are essential for identifying and tracking potentially compromised hosts​.

In FortiOS and FortiAnalyzer, incident notifications can be sent to multiple external platforms, not limited to a single method such as email. Fortinet's security fabric and integration capabilities allow notifications to be sent through various fabric connectors and third-party integrations. This flexibility is designed to ensure that incident updates reach relevant personnel or systems using preferred communication channels, such as email, Syslog, SNMP, or integration with SIEM platforms.

Let’s review each answer option for clarity:

Option A: You can send notifications to multiple external platforms

This is correct. Fortinet’s notification system is capable of sending updates to multiple platforms, thanks to its support for fabric connectors and external integrations. This includes options such as email, Syslog, SNMP, and others based on configured connectors.

Option B: Notifications can be sent only by email

This is incorrect. Although email is a common method, FortiOS and FortiAnalyzer support multiple notification methods through various connectors, allowing notifications to be directed to different platforms as per the organization’s setup.

Option C: If you use multiple fabric connectors, all connectors must have the same settings

This is incorrect. Each fabric connector can have its unique configuration, allowing different connectors to be tailored for specific notification and integration requirements.

Option D: Notifications can be sent only when an incident is updated or deleted

This is incorrect. Notifications can be sent upon the creation of incidents, as well as upon updates or deletion, depending on the configuration.

References: According to FortiOS and FortiAnalyzer 7.4.1 documentation, notifications for incidents can be configured across various platforms by using multiple connectors, and they are not limited to email alone. This capability is part of the Fortinet Security Fabric, allowing for a broad range of integrations with external systems and platforms for effective incident response​.

In the exhibit, the data structure shows a checksum field and a data field with a long, seemingly encoded string. This format is indicative of a file that has been compressed or encoded for storage and transfer.

Export Data Type:

The data field is likely a base64-encoded string, which is commonly used to represent binary data in text format. Base64 encoding is often applied to data that has been compressed (zipped) for easier handling and transfer. The checksum field, with an MD5 hash, provides a way to verify the integrity of the data after decompression.

Option Analysis:

A. The export data type is zipped: Correct. The compressed and encoded format of the data suggests that the export is in a zipped format, allowing for efficient storage and transfer.

B. The playbook is misconfigured: There is no indication of misconfiguration in this exhibit. The presence of the checksum and data fields aligns with standard export practices.

C. The option to include the connector was not selected: There is no evidence in the output to conclude that connectors are missing. Connectors are typically listed separately and would not directly affect the checksum and encoded data structure.

D. Your colleague put a password on the export: There’s no indication of password protection in the exhibit. Password protection would likely alter the data structure, and there would be some mention of encryption.

Conclusion:

Correct Answer: A. The export data type is zipped.

This answer is consistent with the typical use of base64 encoding for compressed (zipped) data exports in FortiAnalyzer.

References:

FortiAnalyzer 7.4.1 documentation on exporting playbooks and data compression methods.

FortiAnalyzer has two primary operating modes: Analyzer mode and Collector mode. Each mode serves specific purposes and has distinct capabilities.

Option A - Forwarding Logs to a Syslog Server in Collector Mode:

In Collector mode, FortiAnalyzer collects logs from Fortinet devices but does not process or analyze them. Instead, it forwards the logs to other FortiAnalyzer units in Analyzer mode or to specific storage locations. However, forwarding logs to a syslog server is not a function of Collector mode. Logs are generally stored or sent to other FortiAnalyzer devices.

Conclusion: Incorrect.

Option B - Default Mode is Collector Mode Unless Configured for HA:

When a FortiAnalyzer is initially set up, it runs in Collector mode by default unless it is configured as part of a High Availability (HA) setup, which would set it to Analyzer mode. Collector mode prioritizes log collection and storage rather than analysis, offloading analysis to other devices in the network.

Conclusion: Correct.

Option C - Report Creation and Editing in Collector Mode:

In Collector mode, FortiAnalyzer does not have the capability to create or edit reports. This mode is focused solely on log collection and forwarding, with analysis and report generation left to FortiAnalyzer units operating in Analyzer mode.

Conclusion: Incorrect.

Option D - Performance Improvement with Both Modes in Topology:

Deploying FortiAnalyzer devices in both Collector and Analyzer modes in a network topology can enhance performance. Collector mode devices handle log collection, reducing the workload on Analyzer mode devices, which focus on log processing, analysis, and reporting. This separation of tasks can optimize resource usage and improve the overall efficiency of log management.

Conclusion: Correct.

Conclusion:

Correct Answer: B. FortiAnalyzer runs in collector mode by default unless it is configured for HA and D. A topology with FortiAnalyzer devices running in both modes can improve their performance.

These answers correctly describe the functionality and default configuration of FortiAnalyzer operating modes, along with how a mixed-mode topology can enhance performance.

References:

FortiAnalyzer 7.4.1 documentation on operating modes (Collector and Analyzer) and their respective capabilities.

In FortiOS and FortiAnalyzer logging systems, when an event has a status of "Mitigated" in the Event Status column, it typically indicates that the system took action to address the identified threat. In this case, the Web Filter blocked the web request to a suspicious destination, and the event status "Mitigated" confirms that the action was successfully implemented to neutralize or block the security risk.

Let's review the answer options:

Option A: The risk source is isolated.

This is incorrect because "isolated" would imply that FortiGate took further steps to prevent the source device from communicating with the network. There is no indication of isolation in this event status.

Option B: The security risk was blocked or dropped.

This is correct. The "Mitigated" status, along with the Web Filter event type and the accompanying description, implies that the FortiGate or FortiAnalyzer successfully blocked or dropped the suspicious web request, which corresponds to the term "mitigated."

Option C: The security event risk is considered open.

This is incorrect because an open status would indicate that no action was taken, or the threat is still present. The "Mitigated" status indicates that the threat has been addressed.

Option D: An incident was created from this event.

This option is not correct or evident based on the given display. Although FortiAnalyzer or FortiGate could escalate certain events to incidents, this is not indicated here.

References:

The FortiOS 7.4.1 and FortiAnalyzer 7.4.1 documentation specify that "Mitigated" status in logs means the identified threat was handled, usually by blocking or dropping the action associated with the event, particularly with Web Filter and Security Policy logs​.

In the exhibit, we see a playbook in FortiAnalyzer designed to retrieve events based on specific criteria, create an incident, and attach relevant data to that incident. The "Get Event" task configuration specifies filters to match any of the following conditions:

Severity = High

Event Type = Web Filter

Tag = Malware

Analysis of Events:

In the FortiAnalyzer Event Monitor list:

We need to identify events that meet any one of the specified conditions (since the filter is set to "Match Any Condition").

Events Matching Criteria:

Severity = High:

There are two events with "High" severity, both with the "Event Type" IPS.

Event Type = Web Filter:

There are two events with the "Event Type" Web Filter. One has a "Medium" severity, and the other has a "Low" severity.

Tag = Malware:

There are two events tagged with "Malware," both with the "Event Type" Antivirus and "Medium" severity.

After filtering based on these criteria, there are four distinct events:

Two from the "Severity = High" filter.

One from the "Event Type = Web Filter" filter.

One from the "Tag = Malware" filter.

Conclusion:

Correct Answer: D. Four events will be added.

This answer matches the conditions set in the playbook filter configuration and the events listed in the Event Monitor.

References:

FortiAnalyzer 7.4.1 documentation on event filtering, playbook configuration, and incident management criteria.