Complete FCP_FAZ_AN-7.4 Fortinet Materials

In FortiAnalyzer, event handlers can be configured to trigger specific notifications when an event matches defined criteria. These notifications are designed to alert administrators in real time about critical events.

Option B - Send SNMP Trap:

FortiAnalyzer supports sending SNMP traps as one of the notification methods when an event matches an event handler. This allows integration with SNMP-enabled network management systems, which can then trigger further alerts or actions based on the trap received.

Conclusion: Correct.

Option C - Send SMS Notification:

FortiAnalyzer also supports SMS notifications, enabling alerts to be sent via SMS to predefined recipients. This method is useful for administrators who require immediate alerts but may not have access to email or other notification systems at all times.

Conclusion: Correct.

Option A - Send Alert through Fabric Connectors:

While Fabric Connectors allow FortiAnalyzer to interact with other parts of the Security Fabric, they are primarily used for data sharing and automation rather than directly for sending alerts or notifications.

Conclusion: Incorrect.

Option D - Send Alert through FortiSIEM MEA:

FortiSIEM integration allows for data sharing and further analysis within the Fortinet ecosystem, but it does not directly act as a notification method from FortiAnalyzer itself.

Conclusion: Incorrect.

Conclusion:

Correct Answer: B. Send SNMP trap and C. Send SMS notification

These options represent valid notification methods for FortiAnalyzer’s event handler configuration.

References:

FortiAnalyzer 7.4.1 documentation on event handler configuration and available notification methods.

FortiAnalyzer manages and stores various types of logs, including local logs, across different ADOMs (Administrative Domains). Each type of log serves specific purposes, with some logs being ADOM-specific and others providing system-wide information.

Option A - Local Logs Not Supported in FortiView:

Local logs are indeed supported in FortiView. FortiView provides visibility and analytics for different log types across the system, including local logs, allowing users to view and analyze data efficiently.

Conclusion: Incorrect.

Option B - Playbook Logs for All ADOMs in the Root ADOM:

FortiAnalyzer allows centralized viewing of playbook logs across all ADOMs from the root ADOM. This feature provides an overarching view of playbook executions, facilitating easier monitoring and management for administrators.

Conclusion: Correct.

Option C - Event Logs vs. Application Logs:

Event Logs provide information about system-wide events, such as login attempts, configuration changes, and other critical activities that impact the overall system. These logs apply across the FortiAnalyzer instance.

Application Logs are more specific to individual ADOMs, capturing details that pertain to ADOM-specific applications and configurations.

Conclusion: Correct.

Option D - Event Logs Only in Root ADOM:

Event logs are available across different ADOMs, not exclusively in the root ADOM. They capture system-wide events, but they can be accessed within specific ADOM contexts as needed.

Conclusion: Incorrect.

Conclusion:

Correct Answer: B. You can view playbook logs for all ADOMs in the root ADOM and C. Event logs show system-wide information, whereas application logs are ADOM specific.

These answers correctly describe the characteristics and visibility of local logs within FortiAnalyzer.

References:

FortiAnalyzer 7.4.1 documentation on log types, ADOM configuration, and FortiView functionality.