What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

• A. The endpoint is marked as Compromised and. optionally, can be put in quarantine.
• B. A new Infected entry is added for the corresponding endpoint.
• C. The detection engine classifies those logs as Suspicious
• D. FortiAnalyzer flags the associated host for further analysis.

Which two statements are correct regarding the export and import of playbooks? (Choose two.)

• A. Playbooks can be exported and imported only within the same FortiAnaryzer.
• B. A playbook that was disabled when it was exported, will be disabled when it is imported.
• C. You can export only one playbook at a time.
• D. You can import a playbook even if there is another one with the same name in the destination.

When working with FortiAnalyzer reports, what is the purpose of a dataset?

• A. To retrieve data from the database
• B. To provide the layout used for reports
• C. To set the data included in templates
• D. To define the chart type to be used

Which two purposes does the auto cache setting on reports serve? (Choose two.)

• A. It reduces the log insert lag rate.
• B. It automatically updates the hcache when new logs arrive.
• C. It reduces report generation time.
• D. It provides diagnostics on report generation time.

Which statement about sending notifications with incident updates is true?

• A. You must configure an output profile to send notifications by email.
• B. Each incident can send notifications to a single external platform.
• C. Each connector used can have different notification settings.
• D. Notifications can be sent only when an incident is created or deleted.