FCP-FAZ-AD-7-4 FCP - FortiAnalyzer 7.4 Administrator Practice Questions

This combination directly addresses all requirements. Reliable logging (OFTPS) uses TCP to ensure guaranteed delivery. The store-and-upload option allows the FortiGate to cache logs locally if the FortiAnalyzer is unreachable and upload them once connectivity is restored, preventing log loss. Enabling compression minimizes the amount of data sent over the limited bandwidth WAN links.

The FortiAnalyzer HA synchronization process is efficient. After an initial full sync, the primary unit does not send the entire dataset repeatedly. Instead, it tracks changes to its configuration and new logs it receives, and it synchronizes only these deltas to the secondary unit. This minimizes the traffic over the HA heartbeat/sync link.

Macros are placeholder variables that can be used in report layouts to insert dynamic information. This is useful for creating reusable report templates. Examples include %%datetime%% to insert the report generation timestamp, %%adom%% for the ADOM name, or %%device%% for the device serial number.

The SQL schema for FortiAnalyzer logs uses specific, often abbreviated, column names. The correct column name for source IP is srcip and for the firewall action is action. Therefore, the correct syntax is WHERE srcip='10.10.10.5' AND action='deny'. Using incorrect column names like source_ip will result in a query error.

RAID 10 (a stripe of mirrors) provides the best write performance among the redundant RAID levels because it does not require parity calculations for writes. It also offers redundancy for a single disk failure within each mirrored pair. RAID 5 has a write penalty due to parity calculations. RAID 6 has an even higher write penalty. RAID 1 offers redundancy but not the performance benefits of striping found in RAID 10.

The diagnose test application oftps 1 command specifically tests the connection and log upload status to the FortiAnalyzer. It provides detailed output about the OFTPS (Over Fortinet Transfer Protocol Secure) connection state, including connection status, encryption settings, and log upload statistics, which is ideal for this troubleshooting scenario. Other commands are less specific to the FortiAnalyzer logging process.

Standard report charts have limited filtering capabilities. To achieve complex filtering, such as by specific LDAP user groups, the correct method is to first create a custom dataset. This involves writing a SQL query that selects the required log data and uses a WHERE clause to filter on the usergroup field. Once this dataset is created and tested, it can be used as the source for a custom chart within a new report.

When using a wildcard RADIUS administrator, FortiAnalyzer can dynamically assign ADOM access based on vendor-specific attributes (VSAs) returned by the RADIUS server during authentication. By configuring the RADIUS server to send the Fortinet-ADOM-Name VSA containing the specific ADOM(s) an engineer is authorized to access, the MSP can enforce granular, per-user ADOM restrictions without creating multiple accounts on the FortiAnalyzer itself.

A key distinction is how VDOMs are handled. In Normal mode, the FortiGate device is the unit of assignment, so all of its VDOMs must belong to one ADOM. Advanced mode provides more flexibility, allowing an administrator to assign individual VDOMs from a single physical FortiGate to multiple different ADOMs, which is essential for complex multi-tenant environments.