Free Fortinet FCP_FAZ_AN-7.6 Practice Exam with Questions & Answers | Set: 3

Exact Extract: Study Guide p.141: Log Insert Lag Time is the time between log receipt and indexing.

Technical Deep Dive: The correct answer is A. A rising data point on the Log Insert Lag Time graph means the delay between receiving logs and indexing them is increasing. That indicates the database/indexing pipeline is falling behind at that moment. Option B is wrong because the chart is not proving cache use to avoid drops. Option C might become true if lag exceeds baseline persistently, but a single point only shows lag behavior. Option D is the opposite: if sqlplugind were caught up, lag would be low or decreasing.

Exact Extract: Study Guide p.58: Log View search results can be downloaded, and raw/text filtering helps with exact field syntax.

Technical Deep Dive: The correct answers are A and D. FortiAnalyzer Log View allows administrators to download filtered logs as text or CSV, so the displayed search results can be exported to a file. The exhibit also indicates a text-mode search/filter rather than a purely GUI-built filter. Option B would be true for formatted log tables in general, but the question asks what can be concluded from the displayed search results. Option C is not supported; whether FortiView can analyze related data depends on whether the logs are analytics logs, not merely on the search display.

Exact Extract: Study Guide p.39: rolled log files are compressed, receive the .gz extension, and are known as archive logs.

Technical Deep Dive: The correct answer is C. FortiAnalyzer stores received logs first as log files and also indexes them for analytics. When the log file rolls over, FortiAnalyzer renames it, timestamps it, and compresses it into a .gz file. That compressed offline file is the archive log. Option A describes analytics logs in the SQL database. Option B is wrong because FortiView uses analytics logs, not archive logs. Option D confuses archive status with device availability; a log is archived because of the storage workflow, not because the source device is offline.