Pass the Fortinet Fortinet Certified Professional Security Operations FCP_FAZ_AN-7.6 Questions and answers with CertsForce

Exact Extract: Study Guide p.39 and p.63: FortiView displays analytics logs, while archive logs are offline and data policy controls retention.

Technical Deep Dive: The correct answers are C and D. If a specific security log is not visible in FortiView, the analyst should verify whether the ADOM data policy has purged or moved analytics logs outside the available window and check the logs through the appropriate log-browsing/search interface. Option A is wrong because .gz archive logs are offline and are not directly opened in FortiView. Option B is too aggressive as a first troubleshooting step; rebuilding the SQL database is not the normal explanation when the issue may simply be retention or archive status.

Exact Extract: Study Guide p.21-p.24: HA is not supported on supervisors; members provide analyzer features and supervisor visibility does not require log forwarding to supervisor storage.

Technical Deep Dive: The correct answers are B and C. Fabric members must retain analyzer capabilities such as events and reports; collector mode lacks Incidents and Events and reporting, so member devices operate with analyzer functionality. The supervisor provides centralized visibility into logs collected on members rather than requiring members to forward all logs into supervisor storage. Option A is false because HA is not available for the supervisor. Option D is false because the guide states members do not have to share the supervisor time zone.

Exact Extract: Study Guide p.82: Contained means the risk source is isolated; antivirus quarantine is the example.

Technical Deep Dive: The correct answer is A. An AV log with action=quarantine indicates the detected file or object has been isolated, so FortiAnalyzer classifies the event status as Contained. An IPS action=pass is Unhandled because the risk was not stopped. WebFilter dropped and AppControl blocked are enforcement outcomes, so they align with Mitigated rather than Contained. The distinction matters in SOC triage because Contained still deserves review, but the immediate source/object has already been isolated.