Question 1

(Refer to the exhibit.Which two observations can you make after reviewing this log entry? (Choose two answers))

Options :

A : This is a normalized log.

B : This is a formatted view of the log.

C : This is the original log that FortiAnalyzer received from FortiGate.

D : This log is in a raw log format.

Answer: A,D

Question 2

(Which two parameters does FortiAnalyzer use to identify an indicator of compromise (IOC)? (Choose two answers))

Options :

A : IP address

B : URL

C : Policy ID

D : Application category

Answer: A,B

Question 3

Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

Options :

A : They are not supported in FortiView.

B : You can view playbook logs for all ADOMs in the root ADOM.

C : Event logs show system-wide information, whereas application logs are ADOM specific.

D : Event logs are available only in the root ADOM.

Answer: B,C

Question 4

As part of your analysis, you discover that a Medium severity level incident is fully remediated. You change the incident status to Closed:Remediated. Which statement about your update is true?

Options :

A : The incident can no longer be deleted.

B : The corresponding event will be marked as Mitigated.

C : The incident dashboard will be updated.

D : The incident severity will be lowered.

Answer: C

Question 5

In firmware version 7.6, how does on-premises FortiAnalyzer store logs? (Choose one answer)

Options :

A : Uses ClickHouse database

B : Uses MySQL database

C : Uses Postgres SQL database

D : Uses ElasticSeach database

Answer: A