Fortinet FCP_FAZ_AN-7.6 Exam Dumps

Study Guide p.202: FortiOS connector actions require an Incoming Webhook Call trigger configured on FortiGate.

Technical Deep Dive: The correct answer is B. The FortiOS connector can appear once FortiGate is added to FortiAnalyzer, but FortiAnalyzer will not show the FortiOS automation actions until FortiGate has the proper automation rule. The trigger required is Incoming webhook/Incoming Webhook Call. A FortiAnalyzer Event Handler is a FortiAnalyzer-side event generator, not a FortiGate trigger for connector actions. Fabric Connector event and IP ban are not the trigger type required to expose FortiOS connector actions.

Study Guide p.107: more than one Fabric connector can be configured, with the same or different notification settings.

Technical Deep Dive: The correct answer is A. FortiAnalyzer can send incident status-change notifications through external platform connectors, and each connector can have its own settings. That flexibility lets a SOC notify Teams, ticketing, or other platforms differently depending on the connector and activity type. Option B is wrong because the guide permits multiple connectors. Option C confuses report output profiles with incident notifications. Option D is too narrow because notifications are not limited only to created or deleted incidents.

Official Fortinet FortiSIEM MEA guidance: after enabling the Collector MEA, it must be registered to a licensed FortiSIEM Supervisor.

Technical Deep Dive: The correct answer is D. FortiSIEM MEA on FortiAnalyzer functions as a FortiSIEM collector component and must register to a FortiSIEM Supervisor for operation. Option A describes FortiSOAR-style incident lifecycle management more than FortiSIEM MEA. Option B is wrong because the management extension runs on FortiAnalyzer rather than as a dedicated VM for the MEA itself. Option C is inaccurate because Fortinet documents CPU/RAM caps for MEAs, not a 50% disk-space cap as the defining requirement.

Study Guide p.82: Contained means the risk source is isolated; antivirus quarantine is the example.

Technical Deep Dive: The correct answer is A. An AV log with action=quarantine indicates the detected file or object has been isolated, so FortiAnalyzer classifies the event status as Contained. An IPS action=pass is Unhandled because the risk was not stopped. WebFilter dropped and AppControl blocked are enforcement outcomes, so they align with Mitigated rather than Contained. The distinction matters in SOC triage because Contained still deserves review, but the immediate source/object has already been isolated.

Study Guide p.217-p.218: exported playbooks preserve enabled/disabled status, and name conflicts are handled on import.

Technical Deep Dive: The correct answers are A and C. A playbook imported into another ADOM or FortiAnalyzer retains the enabled or disabled status it had when exported, which is why automatic playbooks should be exported disabled. If an imported playbook name already exists, FortiAnalyzer creates a new name with a timestamp to avoid conflicts, so importing with the same name is allowed. Option B is wrong because connectors can be included in the export. Option D is wrong because multiple playbooks can be exported at once.