Question 1

Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

Options :

A : They are not supported in FortiView.

B : You can view playbook logs for all ADOMs in the root ADOM.

C : Event logs show system-wide information, whereas application logs are ADOM specific.

D : Event logs are available only in the root ADOM.

Answer: B,C

Question 2

As part of your analysis, you discover that a Medium severity level incident is fully remediated. You change the incident status to Closed:Remediated. Which statement about your update is true?

Options :

A : The incident can no longer be deleted.

B : The corresponding event will be marked as Mitigated.

C : The incident dashboard will be updated.

D : The incident severity will be lowered.

Answer: C

Question 3

(Refer to the exhibit.Which two observations can you make after reviewing this log entry? (Choose two answers))

Options :

A : This is a normalized log.

B : This is a formatted view of the log.

C : This is the original log that FortiAnalyzer received from FortiGate.

D : This log is in a raw log format.

Answer: A,D

Question 4

In firmware version 7.6, how does on-premises FortiAnalyzer store logs? (Choose one answer)

Options :

A : Uses ClickHouse database

B : Uses MySQL database

C : Uses Postgres SQL database

D : Uses ElasticSeach database

Answer: A

Question 5

When managing incidents on FortiAnlyzer, what must an analyst be aware of?

Options :

A : You can manually attach generated reports to incidents.

B : The status of the incident is always linked to the status of the attach event.

C : Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.

D : Incidents must be acknowledged before they can be analyzed.

Answer: A