Fortinet FCP_FAZ_AN-7.6 Practice Test 14
Question 130
A report query fails after quota pressure while raw archived records remain available. The observed fault is: Assuming archived bytes are immediately report-queryable can create false negative historical findings. How should the administrator restore and verify the intended state?
- The corrective action is to use an unrelated graph color setting to extend retention.
- The corrective action is to delete archived records because analytics search returned no rows.
- The corrective action is to assume a full index means the original raw log cannot exist.
- The corrective action is to locate archived evidence or restore supported indexing and document coverage gaps.
Explanation
Correct Answer
D:Recheck analytics and archive storage status, indexed date range, retention settings and log retrieval outcome. Long-term archive availability and immediate indexed analytics search are different storage functions.
Incorrect Answers
A:Use an unrelated graph color setting to extend retention. Assuming archived bytes are immediately report-queryable can create false negative historical findings. Instead, locate archived evidence or restore supported indexing and document coverage gaps.
B:Delete archived records because analytics search returned no rows. Assuming archived bytes are immediately report-queryable can create false negative historical findings. Instead, locate archived evidence or restore supported indexing and document coverage gaps.
C:Assume a full index means the original raw log cannot exist. Assuming archived bytes are immediately report-queryable can create false negative historical findings. Instead, locate archived evidence or restore supported indexing and document coverage gaps.
Question 131
A regional FortiAnalyzer starts overwriting older security logs after new branch firewalls are added. Which configuration decision most directly resolves this situation?
- Assume the number of managed devices directly equals log bytes per day.
- Disable all log retention alerts so capacity appears stable.
- Size ADOM or device storage retention using measured log rate, available capacity and business retention requirements.
- Increase the browser session timeout as a substitute for storage capacity.
Explanation
Correct Answer
C:Durable log availability depends on ingestion volume, per-scope quotas and retention policy. This is the targeted correction for log quota and rate capacity planning.
Incorrect Answers
A:Underestimated peak rates can prematurely evict evidence needed for investigations. Use size ADOM or device storage retention using measured log rate, available capacity and business retention requirements.
B:Disable all log retention alerts so capacity appears stable. Durable log availability depends on ingestion volume, per-scope quotas and retention policy. Relevant observations are log rate trend, disk capacity, quota assignments, retention rollover and projected days.
D:Underestimated peak rates can prematurely evict evidence needed for investigations. The supported correction is size ADOM or device storage retention using measured log rate, available capacity and business retention requirements.
Question 132
A regional FortiAnalyzer starts overwriting older security logs after new branch firewalls are added. What evidence most strongly confirms the operational condition?
- Log rate trend, disk capacity, quota assignments, retention rollover and projected days.
- A marketing diagram with no member API or device log evidence.
- A single unrelated ping to the management interface.
- An appliance name without any current log delivery or synchronization state.
Explanation
Correct Answer
A:These observations directly test log quota and rate capacity planning under the actual system state. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
Incorrect Answers
B:A marketing diagram with no member API or device log evidence. The relevant evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
C:A single unrelated ping to the management interface. The relevant evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
D:An appliance name without any current log delivery or synchronization state. The relevant evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
Question 133
A regional FortiAnalyzer starts overwriting older security logs after new branch firewalls are added. What FortiAnalyzer behavior explains the correct decision?
- Any FortiAI suggestion is confirmed without source log evidence.
- Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
- Every raw log record is already normalized with identical fields across all sources.
- An ADOM display name alone enforces all necessary tenant permissions.
Explanation
Correct Answer
B:Verification depends on log rate trend, disk capacity, quota assignments, retention rollover and projected days. This is why size ADOM or device storage retention using measured log rate, available capacity and business retention requirements.
Incorrect Answers
A:Any FortiAI suggestion is confirmed without source log evidence. That generalization is incorrect in the context of log quota and rate capacity planning. The relevant behavior is durable log availability depends on ingestion volume, per-scope quotas and retention policy. Check log rate trend, disk capacity, quota assignments, retention rollover and projected days.
C:Every raw log record is already normalized with identical fields across all sources. That generalization is incorrect in the context of log quota and rate capacity planning. The relevant behavior is durable log availability depends on ingestion volume, per-scope quotas and retention policy. Check log rate trend, disk capacity, quota assignments, retention rollover and projected days.
D:An ADOM display name alone enforces all necessary tenant permissions. That generalization is incorrect in the context of log quota and rate capacity planning. The relevant behavior is durable log availability depends on ingestion volume, per-scope quotas and retention policy. Check log rate trend, disk capacity, quota assignments, retention rollover and projected days.
Question 134
A regional FortiAnalyzer starts overwriting older security logs after new branch firewalls are added. An operator instead chooses this incorrect shortcut: Assume the number of managed devices directly equals log bytes per day. Which resulting risk should the reviewer identify?
- The only impact is a harmless dashboard background color.
- Underestimated peak rates can prematurely evict evidence needed for investigations.
- An accurate timestamp created all synchronization errors in the member.
- Maintaining source device provenance itself destroyed the archived log.
Explanation
Correct Answer
B:The intended preventive choice is size ADOM or device storage retention using measured log rate, available capacity and business retention requirements. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
Incorrect Answers
A:This does not account for the actual log quota and rate capacity planning weakness. The more relevant failure is underestimated peak rates can prematurely evict evidence needed for investigations.
C:This does not account for the actual log quota and rate capacity planning weakness. Confirm with log rate trend, disk capacity, quota assignments, retention rollover and projected days.
D:This does not account for the actual log quota and rate capacity planning weakness. Maintaining source device provenance itself destroyed the archived log.
Question 135
A regional FortiAnalyzer starts overwriting older security logs after new branch firewalls are added. The observed fault is: Underestimated peak rates can prematurely evict evidence needed for investigations. How should the administrator restore and verify the intended state?
- Disable all log retention alerts so capacity appears stable.
- Increase the browser session timeout as a substitute for storage capacity.
- Adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
- Assume the number of managed devices directly equals log bytes per day.
Explanation
Correct Answer
C:Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
Incorrect Answers
A:Disable all log retention alerts so capacity appears stable. Underestimated peak rates can prematurely evict evidence needed for investigations. Instead, adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
B:Increase the browser session timeout as a substitute for storage capacity. Underestimated peak rates can prematurely evict evidence needed for investigations. Instead, adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
D:Assume the number of managed devices directly equals log bytes per day. Underestimated peak rates can prematurely evict evidence needed for investigations. Instead, adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
Question 136
An SOC workload has daily bursts exceeding planned log storage despite normal average volume. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, disable all log retention alerts so capacity appears stable.
- For this FortiAnalyzer investigation, size ADOM or device storage retention using measured log rate, available capacity and business retention requirements.
- For this FortiAnalyzer investigation, increase the browser session timeout as a substitute for storage capacity.
- For this FortiAnalyzer investigation, assume the number of managed devices directly equals log bytes per day.
Explanation
Correct Answer
B:Durable log availability depends on ingestion volume, per-scope quotas and retention policy. Verify using log rate trend, disk capacity, quota assignments, retention rollover and projected days.
Incorrect Answers
A:Disable all log retention alerts so capacity appears stable. Durable log availability depends on ingestion volume, per-scope quotas and retention policy. Relevant observations are log rate trend, disk capacity, quota assignments, retention rollover and projected days.
C:Underestimated peak rates can prematurely evict evidence needed for investigations. Increase the browser session timeout as a substitute for storage capacity.
D:Underestimated peak rates can prematurely evict evidence needed for investigations. This change does not provide the specified control.
Question 137
An SOC workload has daily bursts exceeding planned log storage despite normal average volume. Which observations should the engineer inspect before declaring success?
- The supporting evidence is an old inventory list without original event time and device attribution.
- The supporting evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days.
- The supporting evidence is a marketing diagram with no member API or device log evidence.
- The supporting evidence is a single unrelated ping to the management interface.
Explanation
Correct Answer
B:These observations directly test log quota and rate capacity planning under the actual system state. The planned operation is size ADOM or device storage retention using measured log rate, available capacity and business retention requirements.
Incorrect Answers
A:An old inventory list without original event time and device attribution. The relevant evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
C:A marketing diagram with no member API or device log evidence. The relevant evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
D:A single unrelated ping to the management interface. The relevant evidence is log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
Question 138
An SOC workload has daily bursts exceeding planned log storage despite normal average volume. Which platform statement is MOST accurate for this scenario?
- The governing concept is that durable log availability depends on ingestion volume, per-scope quotas and retention policy.
- The governing concept is that an ADOM display name alone enforces all necessary tenant permissions.
- The governing concept is that any FortiAI suggestion is confirmed without source log evidence.
- The governing concept is that a visible device inventory object guarantees current threat log delivery.
Explanation
Correct Answer
A:Verification depends on log rate trend, disk capacity, quota assignments, retention rollover and projected days. Durable log availability depends on ingestion volume, per-scope quotas and retention policy.
Incorrect Answers
B:An ADOM display name alone enforces all necessary tenant permissions. That generalization is incorrect in the context of log quota and rate capacity planning. The relevant behavior is durable log availability depends on ingestion volume, per-scope quotas and retention policy. Check log rate trend, disk capacity, quota assignments, retention rollover and projected days.
C:Any FortiAI suggestion is confirmed without source log evidence. That generalization is incorrect in the context of log quota and rate capacity planning. The relevant behavior is durable log availability depends on ingestion volume, per-scope quotas and retention policy. Check log rate trend, disk capacity, quota assignments, retention rollover and projected days.
D:A visible device inventory object guarantees current threat log delivery. That generalization is incorrect in the context of log quota and rate capacity planning. The relevant behavior is durable log availability depends on ingestion volume, per-scope quotas and retention policy. Check log rate trend, disk capacity, quota assignments, retention rollover and projected days.
Question 139
An SOC workload has daily bursts exceeding planned log storage despite normal average volume. An operator instead chooses this incorrect shortcut: Assume the number of managed devices directly equals log bytes per day. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that maintaining source device provenance itself destroyed the archived log.
- The material failure is that underestimated peak rates can prematurely evict evidence needed for investigations.
- The material failure is that an authorized review of ADOM permissions caused every unrelated FortiGate failure.
- The material failure is that an accurate timestamp created all synchronization errors in the member.
Explanation
Correct Answer
B:The intended preventive choice is size ADOM or device storage retention using measured log rate, available capacity and business retention requirements. Underestimated peak rates can prematurely evict evidence needed for investigations.
Incorrect Answers
A:This does not account for the actual log quota and rate capacity planning weakness. In this specific situation, an SOC workload has daily bursts exceeding planned log storage despite normal average volume.
C:This does not account for the actual log quota and rate capacity planning weakness. An authorized review of ADOM permissions caused every unrelated FortiGate failure.
D:This does not account for the actual log quota and rate capacity planning weakness. An accurate timestamp created all synchronization errors in the member.
Question 140
An SOC workload has daily bursts exceeding planned log storage despite normal average volume. The observed fault is: Underestimated peak rates can prematurely evict evidence needed for investigations. Which remediation best corrects the root cause?
- The corrective action is to adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
- The corrective action is to increase the browser session timeout as a substitute for storage capacity.
- The corrective action is to assume the number of managed devices directly equals log bytes per day.
- The corrective action is to disable all log retention alerts so capacity appears stable.
Explanation
Correct Answer
A:Recheck log rate trend, disk capacity, quota assignments, retention rollover and projected days.
Incorrect Answers
B:Increase the browser session timeout as a substitute for storage capacity. Underestimated peak rates can prematurely evict evidence needed for investigations. Instead, adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
C:Assume the number of managed devices directly equals log bytes per day. Underestimated peak rates can prematurely evict evidence needed for investigations. Instead, adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
D:Disable all log retention alerts so capacity appears stable. Underestimated peak rates can prematurely evict evidence needed for investigations. Instead, adjust quotas or capacity with monitoring and confirm coverage over representative peak days.
