Exam for engine

To automatically send generated reports by email, you must configure and enable an output profile on each report. The output profile defines the delivery method, including email recipients, and ensures that reports are sent when they are generated according to their schedule.

The commands shown are:
diagnose fortilogd lograte → shows the log receiving/indexing rate
diagnose fortilogd msgrate → shows the message processing rate
In the output, both rates are very low over the last 5, 30, and 60 seconds. This indicates that FortiAnalyzer is almost finished processing (indexing) incoming logs and messages, with no significant backlog.

Exact Extract: Study Guide p.82: ” Unhandled ” indicates the security event risk is considered open.
Technical Deep Dive: The displayed event is best interpreted as open/unhandled, so the correct answer is C.
In FortiAnalyzer, event status is not just a label; it tells the analyst whether the risk still requires action. A risk source being isolated would map to Contained, while traffic being blocked or dropped maps to Mitigated. An incident being created from an event is a separate workflow action and cannot be concluded from the event status alone unless the exhibit explicitly shows the incident linkage.

In FortiOS and FortiAnalyzer, incident notifications can be sent to multiple external platforms, not limited to a single method such as email. Fortinet’s security fabric and integration capabilities allow notifications to be sent through various fabric connectors and third-party integrations. This flexibility is designed to ensure that incident updates reach relevant personnel or systems using preferred communication channels, such as email, Syslog, SNMP, or integration with SIEM platforms.
Let’s review each answer option for clarity:
* Option A: You can send notifications to multiple external platforms
* This is correct. Fortinet’s notification system is capable of sending updates to multiple platforms, thanks to its support for fabric connectors and external integrations. This includes options such as email, Syslog, SNMP, and others based on configured connectors.
* Option B: Notifications can be sent only by email
* This is incorrect. Although email is a common method, FortiOS and FortiAnalyzer support multiple notification methods through various connectors, allowing notifications to be directed to different platforms as per the organization’s setup.
* Option C: If you use multiple fabric connectors, all connectors must have the same settings
* This is incorrect. Each fabric connector can have its unique configuration, allowing different connectors to be tailored for specific notification and integration requirements.
* Option D: Notifications can be sent only when an incident is updated or deleted
* This is incorrect. Notifications can be sent upon the creation of incidents, as well as upon updates or deletion, depending on the configuration.
* According to FortiOS and FortiAnalyzer 7.4.1 documentation, notifications for incidents can be configured across various platforms by using multiple connectors, and they are not limited to email alone. This capability is part of the Fortinet Security Fabric, allowing for a broad range of integrations with external systems and platforms for effective incident response.

Exact Extract: Study Guide p.107: FortiAnalyzer can send incident notifications to external platforms using Fabric connectors; more than one connector can be added.
Technical Deep Dive: The correct answer is A. Incident update notifications are not restricted to email.
FortiAnalyzer can use configured Fabric connectors to notify external collaboration or response platforms, and each connector can be configured for the incident activities that should trigger a notification. Option B is too narrow because email is only one possible delivery model. Option C is wrong because multiple connectors do not have to share identical settings. Option D is wrong because notification triggers are configurable for different incident activities, not only update or delete events.

Comprehensive and Detailed Explanation From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
FortiAnalyzer 7.6 stores on-premises logs in a ClickHouse SQL database (not MySQL, Postgres, or Elasticsearch). Fortinet’s FortiAnalyzer 7.6 SQL Query documentation explicitly states that log data is inserted into the SQL database and that “FortiAnalyzer uses a ClickHouse SQL database.” This is consistent with how the study guide describes the storage/analytics pipeline in 7.6: it explains that FortiAnalyzer indexes incoming raw logs (insert rate) “by the SQL database and the sqlplugind daemon.” This “SQL database” in 7.6 corresponds to the ClickHouse-backed log database described in the Fortinet documentation.

Exact Extract: Study Guide p.184: reports and charts can be imported/exported between same-type ADOMs; chart exports include associated datasets.
Technical Deep Dive: The correct answers are A and C. FortiAnalyzer requires the source and destination ADOMs to be the same type when moving reports or charts. Reports contain charts, and exported charts carry their associated datasets, so the reporting dependency comes across with the import workflow. Option B describes name-conflict behavior for playbook imports, not the report-moving requirement tested here. Option D is wrong because reports can be imported/exported directly; converting them to templates first is not required.

Playbook jobs that include one or more failed tasks are labeled as Failed in Playbook Monitor. A failed status, however, does not mean that all tasks failed. Some individual actions may have completed successfully.

FortiAnalyzer’s IOC engine identifies common network-based indicators such as domains, URLs, and IP addresses, which are used for correlation and threat detection across logs.

Study Guide p.141: Log Insert Lag Time is the time between log receipt and indexing.
Technical Deep Dive: The correct answer is A. A rising data point on the Log Insert Lag Time graph means the delay between receiving logs and indexing them is increasing. That indicates the database/indexing pipeline is falling behind at that moment. Option B is wrong because the chart is not proving cache use to avoid drops. Option C might become true if lag exceeds baseline persistently, but a single point only shows lag behavior. Option D is the opposite: if sqlplugind were caught up, lag would be low or decreasing.

In FortiAnalyzer’s SQL query syntax, the typical order for querying the database follows the standard SQL format, which is:
SELECT <column(s)> FROM <table> WHERE <condition(s)> GROUP BY <column(s)>
* Option D correctly follows this structure:
* SELECT devid FROM $log: This specifies that the query is selecting the devid column from the $log table.
* WHERE ‘user’ = ‘: This part of the query is intended to filter results based on a condition involving the user column. Although there appears to be a minor typographical issue (possibly missing the user value after =), it structurally adheres to the correct SQL order.
* GROUP BY devid: This groups the results by devid, which is correctly positioned at the end of the query.
Let’s briefly examine why the other options are incorrect:
* Option A: SELECT devid FROM $log GROUP BY devid WHERE ‘user’, ‘users1’
* This is incorrect because the GROUP BY clause appears before the WHERE clause, which is out of order in SQL syntax.
* Option B: SELECT FROM $log WHERE devid ‘user’, USER1′ GROUP BY devid
* This is incorrect because it lacks a column in the SELECT statement and the WHERE clause syntax is malformed.
* Option C: SELCT devid WHERE ‘user’ – ‘USER1’ FROM $log GROUP BY devid
* This is incorrect because the SELECT keyword is misspelled as SELCT, and the WHERE condition syntax is invalid.
* FortiAnalyzer documentation for SQL queries indicates that the standard SQL order should be followed when querying logs in FortiAnalyzer. Queries should follow the format SELECT … FROM … WHERE …
GROUP BY …, as demonstrated in option D.

Study Guide p.59: root ADOM shows local event logs; application logs are ADOM-specific.
Technical Deep Dive: The correct answers are B and D. Local event logs are available from the root ADOM and provide system-wide FortiAnalyzer information. Application logs, including logs generated by FortiAnalyzer applications such as playbooks and incident management, are ADOM-specific. Option A is wrong because local logs are accessible in Log View. Option C is wrong because playbook/application logs are not all simply placed in the root ADOM for every ADOM; non-root ADOMs show application logs relevant to that ADOM.

Exact Extract: Study Guide p.211: output variables use the output from a preceding task as input to the current task.
Technical Deep Dive: The correct answer is B. The exhibit shows the analyst referencing output from an earlier task, such as a generated report identifier, so a later task can attach that result to an incident. That is an output variable. A trigger variable would pull values from the event or incident that started the playbook. The analyst is not creating the report object itself, nor creating a SOC report definition; the report task has already produced data, and the current task is consuming that output dynamically.

Exact Extract: Study Guide p.141: Log Insert Lag Time is the time between log receipt and indexing.
Technical Deep Dive: The correct answer is A. A rising data point on the Log Insert Lag Time graph means the delay between receiving logs and indexing them is increasing. That indicates the database/indexing pipeline is falling behind at that moment. Option B is wrong because the chart is not proving cache use to avoid drops. Option C might become true if lag exceeds baseline persistently, but a single point only shows lag behavior. Option D is the opposite: if sqlplugind were caught up, lag would be low or decreasing.

Enabling auto-cache in FortiAnalyzer reports is designed to improve the efficiency and speed of report generation by leveraging cached data. Let’s analyze each option to determine which effects are correct.
Option A – The Generation Time for Reports is Decreased:
When auto-cache is enabled, FortiAnalyzer can use previously cached data instead of reprocessing all log data from scratch each time a report is generated. This results in faster report generation times, especially for recurring reports that use similar datasets.
Option C – FortiAnalyzer Local Cache is Used to Store Generated Reports:
Auto-cache utilizes FortiAnalyzer’s local cache to store data used in reports, reducing the need to retrieve and process logs repeatedly. This cached data can be reused for subsequent report generation, enhancing performance.

Exact Extract: Study Guide p.188: diagnose sql status sqlreportd checks SQL query connections and hcache status for reports.
Technical Deep Dive: The correct answer is C. The sqlreportd diagnostic is a report troubleshooting command focused on SQL query connections and hcache status. It is useful when reports are slow because report generation depends heavily on hcache and SQL query execution. Option A is handled by scheduled report listing commands. Option B maps to diagnose sql process list. Option D maps more closely to sqlplugind insertion status, not sqlreportd.

To view Compromised Hosts on FortiAnalyzer, certain configurations need to be in place on both FortiGate and FortiAnalyzer. Compromised Host data on FortiAnalyzer relies on log information from FortiGate to analyze threats and compromised activities effectively. Here’s why the selected answers are correct:
* Option A: Enable device detection on the FortiGate devices that are sending logs to FortiAnalyzer
* Enabling device detection on FortiGate allows it to recognize and log devices within the network, sending critical information about hosts that could be compromised. This is essential because FortiAnalyzer relies on these logs to determine which hosts may be at risk based on suspicious activities observed by FortiGate. This setting enables FortiGate to provide device-level insights, which FortiAnalyzer uses to populate the Compromised Hosts view.
* Option B: Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer
* Web filtering is crucial in identifying potentially compromised hosts since it logs any access to malicious sites or blocked categories. FortiAnalyzer uses these web filter logs to detect suspicious or malicious web activity, which can indicate compromised hosts. By ensuring that FortiGate sends these web filtering logs to FortiAnalyzer, the administrator enables FortiAnalyzer to analyze and identify hosts engaging in risky behavior.
Let’s review the other options for clarity:
* Option C: Make sure all endpoints are reachable by FortiAnalyzer
* This is incorrect. FortiAnalyzer does not need direct access to all endpoints. Instead, it collects data indirectly from FortiGate logs. FortiGate devices are the ones that interact with endpoints and then forward relevant logs to FortiAnalyzer for analysis.
* Option D: Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date
* Although subscribing to FortiGuard helps keep threat intelligence updated, it is not a requirement specifically to view compromised hosts. FortiAnalyzer primarily uses logs from FortiGate (such as web filtering and device detection) to detect compromised hosts.
* According to FortiOS and FortiAnalyzer documentation, device detection on FortiGate and enabling web filtering logs are both recommended steps for populating the Compromised Hosts view on FortiAnalyzer.
These logs provide insights into device behaviors and web activity, which are essential for identifying and tracking potentially compromised hosts.