Fortinet FCP_FAZ_AN-7.6 Actual Free Exam Questions & Community Discussion

Exam Code/Number: FCP_FAZ_AN-7.6
Exam Name/Title: FCP - FortiAnalyzer 7.6 Analyst
Certification Provider: Fortinet
Corresponding Certification: Fortinet Certified Professional

Exam Questions: 81
Updated On: Aug 25, 2026

Question #1

Exhibit.

Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than admin'', and coming from Laptop1.
Which filter will achieve the desired result?

A. Operation-login and performed_on==''GU (10.1.1.120)' and user!=admin

B. Operation-login and dstip==10.1.1.210 and user!-admin

C. Operation-login and performed_on==''GUI(10.1.1.100)' and user!=admin

D. Operation-login and srcip== 10.1.1.100 and dstip==10.1.1.1.210 and user==admin

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #2

After generating a report, you notice the information you were expecting to see is not included in it. However, you confirm that the logs are there.

A. Disable auto-cache.

B. Increase the report utilization quota.

C. Check the time frame covered by the report.

D. Test the dataset

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #3

Refer to the exhibit.

What can you conclude about the output?

A. The log rate higher than the message rate is not normal.

B. The output is not ADOM-specific.

C. The low indexing values require investigation.

D. There are more event logs than traffic logs.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #4

Which two statements about exporting and importing playbooks are true? (Choose two.)

A. Playbooks can be imported to a different FortiAnalyzer device, but only if the connectors already exist

B. You can export only one playbook at a time.

C. You can import a playbook even if there is another one with the same name in the destination

D. A playbook that was disabled when it was exported will be disabled when it is imported.

Discussion 0

Correct Answer: C,D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #5

Exhibit.

A FortiAnalyzer analyst is customizing a SQL query to use in a report.
Which SQL query should the analyst run to get the expected results?

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #6

Exhibit.

Assume these are all the events that exist on the FortiAnalyzer device.
How many events will be added to the incident created after running this playbook?

A. No events will be added.

B. Eleven events will be added.

C. Seven events will be added

D. Four events will be added.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #7

Which log will generate an event with the status Contained?

A. A WebFilter log with action=dropped.

B. An AppControl log with action=blocked.

C. An AV log with action=quarantine.

D. An IPS log with action=pass.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #8

Which statement about the FortiSIEM management extension is correct?

A. Its use of the available disk space is capped at 50%.

B. It allows you to manage the entire life cycle of a threat or breach.

C. It requires a licensed FortiSIEM supervisor.

D. It can be installed as a dedicated VM.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Question #9

Why must you wait for several minutes before you run a playbook that you just created?

A. FortiAnalyzer needs that time to ensure there are no other playbooks running.

B. FortiAnalyzer needs that time to parse the new playbook.

C. FortiAnalyzer needs that time to back up the current playbooks.

D. FortiAnalyzer needs that time to debug the new playbook.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for EduDump members. You can sign-up / login (it's free).

Download Free Fortinet FCP_FAZ_AN-7.6 Demo

Simply submit your e-mail address below to get started with our free demo of your Fortinet FCP_FAZ_AN-7.6 exam.