What is the purpose of playbook trigger variables?

1. A. To display statistics about the playbook runtime
2. B. To use information from the trigger to filter the action in a task
3. C. To provide the trigger information to make the playbook start running
4. D. To store the start the times of playbooks with On_Schedule triggers

Correct Answer: B

When managing incidents on FortiAnlyzer, what must an analyst be aware of?

1. A. You can manually attach generated reports to incidents.
2. B. The status of the incident is always linked to the status of the attach event.
3. C. Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour.
4. D. Incidents must be acknowledged before they can be analyzed.

Correct Answer: A
In FortiAnalyzer's incident management system, analysts have the option to manually manage incidents, which includes attaching relevant reports to an incident for further investigation and documentation. This feature allows analysts to consolidate information, such as detailed reports on suspicious activity, into an incident record, providing a comprehensive view for incident response.
Let's review the other options to clarify why they are incorrect:
Option A: You can manually attach generated reports to incidents
This is correct. FortiAnalyzer allows analysts to manually attach reports to incidents, which is beneficial for providing additional context, evidence, or analysis related to the incident. This functionality is part of the incident management process and helps streamline information for tracking and resolution.
Option B: The status of the incident is always linked to the status of the attached event
This is incorrect. The status of an incident on FortiAnalyzer is managed independently of the status of any attached events. An incident can contain multiple events, each with different statuses, but the incident itself is tracked separately.
Option C: Severity incidents rated with the level High have an initial service-level agreement (SLA) response time of 1 hour
This is incorrect. While incidents have severity levels, specific SLA response times are typically set according to the organization??s incident response policy, and FortiAnalyzer does not impose a default
SLA response time of 1 hour for high-severity incidents.
Option D: Incidents must be acknowledged before they can be analyzed
This is incorrect. Incidents on FortiAnalyzer can be analyzed even if they are not yet acknowledged. Acknowledging an incident is often part of the workflow to mark it as being actively addressed, but it is not a prerequisite for analysis.
Reference: According to FortiAnalyzer documentation, analysts can attach reports to incidents manually, making option A correct. This feature enables better tracking and documentation within the incident management system on FortiAnalyzer.

What is the purpose of using data selectors when configuring event handlers?

1. A. They filter the types of logs that FortiAnalyzer can accept from registered devices.
2. B. They download new filters can be used in event handlers.
3. C. They apply their filter criteria to the entire event handler so that you don??t have to configure the same criteria in the individual rules.
4. D. They are common filters that can be appliedsimultaneously to all event handlers.

Correct Answer: C

(An analyst is using FortiAI on FortiAnalyzer to simplify certain tasks but is worried about exceeding the monthly token limit. Which query will take the fewest FortiAI tokens? (Choose one answer))

1. A. Show logs for 192.168.1.10 (past week)
2. B. Show all logs from the past week
3. C. Can you show me all the log entries for the endpoint 192.168.1.10?
4. D. Show logs for 192.168.1.10

Correct Answer: A
From Exact Extract of knowledge of FortiAnalyzer 7.6 Study guide documents:
The study guide explains that FortiAI token usage includesboth the prompt (input) and the response (output), and that ??generally, more text in the query and response results in using more tokens.?? It provides two comparison examples and concludes that the more verbose request for ??all the log entries?? consumes more tokens because it hasmore textand also triggers alarger response; whereas limiting the query to a time range (for example, ??(past week)??) reduces output volume and therefore token usage.
Applying that guidance to the options:
* Cis the most verbose and explicitly requests ??all the log entries,?? which drives higher input and output token usage.
* Brequests ??all logs?? for the week (broad scope), which typically increases output tokens.
* Dis short, but it doesnotconstrain the time range, which can increase the response size (output tokens).
* Ais concise and includes a time constraint ??(past week),?? matching the study guide??s example of a lower-token query pattern.

Which statement describes archive logs on FortiAnalyzer?

1. A. Logs that are indexed and stored in the SQL database
2. B. Logs a FortiAnalyzer administrator can access in FortiView
3. C. Logs compressed and saved in files with the .gz extension
4. D. Logs previously collected from devices that are offline

Correct Answer: C
In FortiAnalyzer, archive logs refer to logs that have been compressed and stored to save space. This process involves compressing the raw log files into the .gz format, which is a common compression format used in Fortinet systems for archived data. Archiving is essential in FortiAnalyzer to optimize storage and manage long-term retention of logs without impacting performance.
Let's examine each option for clarity:
Option A: Logs that are indexed and stored in the SQL database
This is incorrect. While some logs are indexed and stored in an SQL database for quick access and searchability, these are not classified as archive logs. Archived logs are typically moved out of the database and compressed.
Option B: Logs a FortiAnalyzer administrator can access in FortiView
This is incorrect because FortiView primarily accesses logs that are active and indexed, not archived logs. Archived logs are stored for long-term retention but are not readily available for immediate analysis in FortiView.
Option C: Logs compressed and saved in files with the .gz extension
This is correct. Archive logs on FortiAnalyzer are stored in compressed .gz files to reduce space usage. This archived format is used for logs that are no longer immediately needed in the SQL database but are retained for historical or compliance purposes.
Option D: Logs previously collected from devices that are offline
This is incorrect. Although archived logs may include data from devices that are no longer online, this is not a defining characteristic of archive logs.
Reference: FortiAnalyzer 7.4.1 documentation and configuration guides outline that archived logs are stored in compressed files with the .gz extension to conserve storage space, ensuring FortiAnalyzer can handle a larger volume of logs over extended periods​.