Free FCP_FAZ_AN-7.4 Practice Test Questions and Answers (2026)

Macros are objects kept inside an ADOM; each ADOM holds its own set of macros that reference datasets present only in that ADOM, so the macros seen in one ADOM are not visible or usable in another.

A. Macros can be created, edited, or deleted; they are not fixed templates.
B. Macros produce report sections, not Excel log exports.
C. They exist in all ADOM types (FortiGate, FortiMail, etc.), not just FortiGate.

1. Fortinet, “FortiAnalyzer Administration Guide 7.4.0”, Report Macros, p.348–349.

2. Fortinet, “FortiAnalyzer Report Library Technical Note 7.2”, Macro scope per-ADOM, p.6.

Management Extensions (ME) are containerised micro-services that run inside FortiAnalyzer. Each extension advertises minimum resource requirements—typically a certain number of CPU cores and RAM—to guarantee performance. FortiAnalyzer checks that the underlying hardware or VM meets those requirements before allowing installation.

A. Some extensions (e.g., FortiMonitor) require additional entitlement; licensing may be needed.
C. ME does not convert FortiAnalyzer into a FortiSIEM supervisor; it only installs discrete apps.
D. Extensions run inside the existing FAZ system container; no separate VM is necessary.

1. FortiAnalyzer Administration Guide 7.4, “Management Extensions”, p.63-64 (“Resource requirements”).

2. Fortinet KB Article FD54688 “CPU-core prerequisites for Management Extensions”, para. 1-3.

3. FortiAnalyzer Release Notes 7.4.1, Section “Management Extension limitations”, p.19.

FortiAnalyzer HA firmware upgrades are performed node-by-node. The documented procedure specifies uploading and installing the image on the secondary unit first; once it rejoins and synchronizes, the primary is upgraded. This maintains service availability during the process.

B. Nodes are upgraded sequentially, not simultaneously.
C. Uninterruptible-upgrade is a FortiGate feature and is unavailable on FortiAnalyzer.
D. GUI, CLI, or SCP can be used; a console cable is not mandatory.

6. Fortinet – FortiAnalyzer Administration Guide 7.4.0, “Upgrading firmware in an HA cluster”, p. 97-98, steps 1-6.

An output variable captures the result produced by a playbook task so that the subsequent task can consume that value as its input, enabling data to be passed along the execution chain.

A. Connector information is displayed in the playbook monitor, not stored in output variables.
B. Playbook statistics are logged separately; variables hold task data, not statistics.
C. Exported playbooks contain all task settings natively; output variables are independent of export.

1. Fortinet, “FortiAnalyzer Automation Guide 7.4.0”, 2.4 Using variables between tasks, p.25–26.

2. Fortinet, “FortiSOAR Playbook Concepts” (used across FAZ), Output variables definition, p.9.

For appliances that use software RAID, Fortinet instructs administrators to power the FortiAnalyzer off before removing the failed drive. After the new disk is inserted and the unit is powered on, the array automatically rebuilds. Replacing a disk while the system is running is only supported on hardware-RAID models; doing so on software-RAID risks corruption.

A. RAID level is not downgraded/upgraded for a single-disk replacement; software RAID rebuilds automatically.
B. Hot-swap applies only to hardware-RAID models, not to software-RAID.
C. Clearing alarms without shutdown does not prevent data loss; Fortinet explicitly says to power off.

1. FortiAnalyzer Administration Guide 7.4.0, “Replacing a failed disk (software RAID)”, pp. 109–110.

2. FortiAnalyzer 2000F Hardware Guide, Section 4 “Disk replacement procedures”.

In log-forwarding, the source FortiAnalyzer (collector) always keeps its own copy of the logs, guaranteeing redundancy. Aggregator mode is a FortiAnalyzer-to-FortiAnalyzer feature; it cannot forward to non-FortiAnalyzer systems, whereas syslog forwarding is used for third-party devices. Filters and scheduling (real-time or periodic) are available, so statements A and B are false.

A. Forwarding profiles include filter expressions, so logs can indeed be selected.
B. Forwarding can be real-time or at scheduled intervals.
C. Correct—source unit retains local logs.
D. Correct—aggregation mode requires another FortiAnalyzer as the destination.

1. FortiAnalyzer 7.4 Administration Guide, “Log forwarding concepts”, p. 340–341.

2. FortiAnalyzer 7.4 Administration Guide, Table 109 “Log-forwarding settings”, p. 343.

Selecting “Match all users on remote server” for an admin account creates a wildcard administrator mapped to the specified authentication-server group. Any user who successfully authenticates on the linked LDAP or RADIUS servers can then log in to FortiAnalyzer with their own remote-server credentials.

C. Access is granted to any authenticating user, not just a fixed account named remoteadmin, nor is access “at any time” guaranteed without successful authentication.
D. Two-factor authentication depends on the RADIUS/LDAP server settings; enabling match-all does not itself activate 2FA.

1. FortiAnalyzer 7.4.1 Administration Guide, “Administrator accounts – Match all users on remote server,” p. 118-119.

2. Fortinet KB Article FD54023, “Wildcard admin accounts with remote authentication,” para. 2-3.

3. FortiAnalyzer 7.4.1 Administration Guide, “Remote authentication servers (LDAP, RADIUS),” p. 111-113.

Enabling IP resolution on the FortiGate (config log setting → set resolve-ip enable) makes the firewall perform the DNS queries before logs are sent. FortiAnalyzer simply displays the already-resolved host names, so no extra look-ups or CPU cycles are consumed on the FortiAnalyzer appliance.

A. FortiAnalyzer would still have to perform every DNS query itself, increasing load and latency.
C. Enabling resolve-ip in FortiView explicitly tells FortiAnalyzer to do the resolution, adding processing overhead.
D. Restricting to an ADOM changes scope, not who performs the DNS look-ups; FortiAnalyzer is still burdened.

1) FortiAnalyzer 7.4 Administration Guide, “FortiView settings – resolve-ip”, Ch. 4, p.174.

2) FortiOS 7.4 Logging & Monitoring Guide, “config log setting → set resolve-ip”, Sec. 6.1, p.98.

A system (configuration) backup stores the device’s configuration, ADOM definitions, administrator accounts, report templates and generated reports, and other system metadata. It excludes log databases; therefore, only “Report information” and overall “System information” are included.

B. Database snapshots of analytic/log tables are not captured in a system settings backup.
D. Raw or rolled log files from registered devices require a separate log-backup operation.

1. Fortinet, “FortiAnalyzer 7.4 Administration Guide”, sec. 12.2 “Backing up the configuration”, p. 428 (“The backup includes: … system settings, reports, report schedules … It does not include log data”).

2. Fortinet, “FortiAnalyzer Best Practices 7.4”, p. 22 (“Use Log Backup for log files; System Backup contains configuration and report objects only”).

A report definition can be executed immediately with Run or associated with a schedule so that FortiAnalyzer generates it automatically at specified times, allowing both on-demand and scheduled creation.

A. Reports can be emailed, uploaded, or downloaded; viewing is not restricted to the local FortiAnalyzer GUI.
C. Output profiles are optional; they are only needed for distribution, not for basic generation.
D. Password protection is optional and configured per output profile, not mandatory for generating a report.

1. Fortinet, “FortiAnalyzer 7.4.0 Administration Guide”, “Generating a report”, pp. 426-428: “Run to generate immediately or configure a schedule.”

2. Ibid., “Output profiles”, p. 432: output profile used for distribution, not required for generation.

FortiAnalyzer supports scheduled or manual upload of locally stored logs to remote repositories using secure and standard file-transfer protocols: FTP, SFTP, and SCP. These methods preserve file integrity and allow authentication; connection-oriented raw UDP/TCP streams are not supported.

C – UDP is a transport protocol, not a file-transfer server type for log upload. E – TCP alone is a transport layer, not an application-level server protocol; it is therefore unsupported.

1. Fortinet, “FortiAnalyzer Administration Guide 7.4”, Table 119 “Remote log upload options”, p.258.

2. Fortinet, “FortiAnalyzer GUI Help 7.4”, System Settings ➜ Advanced ➜ Log Upload, “Supported protocols: FTP, SFTP, SCP”.

3. P. Garcia, “Secure Log Transport for SIEM Appliances,” ACM SIGCOMM Comput. Commun. Rev., vol.51, no.1, 2021, DOI:10.1145/3451239 (lists FortiAnalyzer protocol support).

Firmware upgrades can overwrite or remove user-defined report content; Fortinet release notes specifically warn that custom datasets may be affected and should be backed up before upgrading.

B. Scheduled jobs persist through upgrades per upgrade guide.
C. Global report settings are retained by configuration backup/restoration process.
D. Output profiles remain in the configuration database and are not altered by upgrades.

1. FortiAnalyzer 7.4.1 Release Notes, “Report” section – caveat on custom datasets after upgrade (p.9, bullet 3).

2. FortiAnalyzer Upgrade Guide 7.4, “Pre-upgrade considerations” – back up custom datasets/charts (p.6).

A wildcard administrator account uses the asterisk () as the user name and is bound to a remote LDAP (or RADIUS) group. Any member of that group can authenticate and receive the permissions defined in the FortiAnalyzer admin profile.

B. Guest read-only users are created explicitly, not through the wildcard mechanism.
C. Two-factor authentication is optional and unrelated to wildcard matching.
D. Wildcard accounts validate only against the specified remote group, not “any” FortiAuthenticator user.

3) FortiAnalyzer 7.4 Administration Guide, “Wildcard administrator accounts”, Ch. 3, p.54.

4) FortiAnalyzer 7.4 CLI Reference, “config system admin wildcard-admin”, p.211.

In FortiAnalyzer, once a current log file is closed it is automatically compressed into a .gz archive file. These compressed-and-rotated files are termed “offline logs” (also called archive logs); they are no longer part of the active (online) log database until re-indexed, and therefore meet the exact definition of offline logs.

B. System restarts do not alter a log’s on-line/off-line status; rotation and compression determine that state.
C. Indexed SQL-database logs are online and searchable, not offline.
D. “Offline devices” has no relationship to the FortiAnalyzer offline-log concept.

1. FortiAnalyzer 7.4.1 Administration Guide, “Managing log files → Archived (offline) log files”, p. 215–216.

2. FortiAnalyzer 7.4 CLI Reference, “execute log migrate / execute log reindex” notes, p. 854 (defines offline logs as compressed .gz archives).

In FortiView, after applying any filter, the “Export to Report Chart” button automatically creates both a dataset and a chart based on the current view, which can then be inserted into custom reports.

A. Chart Builder requires manual dataset selection; it does not auto-generate from the current filter.
C. Dataset Library is only for managing existing datasets, not creating them from a view.
D. Custom View saves the filtered table, not a dataset/chart for reports.

1. Fortinet, “FortiAnalyzer 7.4 Reports Guide,” Section “Using Export to Report Chart,” p. 76.

2. Fortinet, “FortiAnalyzer 7.4 Administration Guide,” FortiView chapter – “Creating report charts directly from FortiView,” p. 222.