FCP_FAZ_AD-7.4 Exam Dumps - Fortinet Network Security Expert Questions and Answers

Events in FortiAnalyzer will be in one of four statuses. The current status will determine if more actions need to be taken by the security team or not.

The possible statuses are:

Unhandled: The security event risk is not mitigated or contained, so it is considered open.

Contained: The risk source is isolated.

Mitigated: The security risk is mitigated by being blocked or dropped.

(Blank): Other scenarios.

FortiAnalyzer_7.0_Study_Guide-Online pag. 206

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 121: The logfiled process enforces the log file size and is also responsible for disk quota enforcement by monitoring the other processes.

"One possible scenario is shown on the slide:

1. Traffic flows through the FortiGate

2. FortiGate sends logs to FortiAnalyzer

3. FortiAnalyzer detects some suspicious traffic and generates an event

4. The event triggers the execution of a playbook in FortiAnalyzer, which sends a webhook call to

FortiGate so that it runs an automation stitch

5. FortiGate runs the automation stitch with the corrective or preventive actions"

FortiAnalyzer_7.0_Study_Guide-Online page 228

In order to see the actions related to the FOS connector, you must enable an automation rule using the Incoming Webhook Call trigger on the FortiGate side. FortiAnalyzer_7.0_Study Guide page no 233

When the upstream FortiGate is performing Network Address Translation (NAT), it creates new session entries for traffic passing through it. As a result, it generates its own traffic logs for those sessions, even if the sessions were initiated on a downstream FortiGate. This is because the upstream FortiGate is altering the source IP address, making it responsible for tracking the session details.

MEA - Administration Guide, FortiSIEM 6.7.5

To run the FortiSIEM Collector management extension application, the following requirements must be met:

FortiAnalyzer 7.0.1 or above

FortiSIEM Supervisor, Worker, Collectors 6.3.0 or above.

FortiSIEM Linux Agent 6.3.0 or above.

FortiSIEM Windows Agent 4.1.2 or above.