Fortinet • FCP_FAZ_AD-7.4
Validates expertise in deploying, configuring, and administering FortiAnalyzer, including device registration, high availability, log management, and reporting. Earns credit toward the NSE 6 Network Security Specialist certification.
Questions
600
Duration
65 minutes
Passing Score
Pass/Fail
Difficulty
ProfessionalLast Updated
May 2026
The FCP - FortiAnalyzer 7.4 Administrator (FCP_FAZ_AD-7.4) exam validates applied knowledge and expertise in deploying, configuring, and administering FortiAnalyzer 7.4, Fortinet's centralized log management and network analytics platform. The exam tests candidates on real-world operational scenarios spanning system configuration, device registration, high availability, RAID management, log data handling, report generation, and administrative domain (ADOM) management. It is based on FortiOS 7.4.1 and FortiAnalyzer 7.4.1 and is available in English, Japanese, and French.
This certification is part of the Fortinet Certified Professional (FCP) - Network Security track, where it serves as one of six elective exam options alongside a required core FortiGate Administrator exam. Passing FCP_FAZ_AD-7.4 also earns credit toward the NSE 6 Network Security Specialist credential. The exam is delivered through Pearson VUE, both at physical test centers and via the OnVUE online proctoring platform.
This exam is designed for network security engineers, security operations professionals, and system administrators who are responsible for the deployment, daily administration, maintenance, and troubleshooting of FortiAnalyzer appliances in enterprise or managed service provider environments. It is particularly relevant for professionals working in SOC (Security Operations Center) roles who rely on FortiAnalyzer for centralized log collection, threat analysis, and compliance reporting across Fortinet device estates.
Candidates typically hold roles such as network security administrator, security analyst, or Fortinet infrastructure engineer, and are looking to formalize their FortiAnalyzer expertise as part of advancing toward the FCP Network Security or NSE 6 Network Security Specialist certifications.
Fortinet does not mandate formal prerequisites for this exam, but strongly recommends that candidates have a solid understanding of all topics covered in the FortiGate Operator course or possess equivalent hands-on experience with FortiGate products before attempting the exam. Familiarity with core networking concepts—such as routing, firewall policies, and log management fundamentals—is also expected.
The recommended preparation path is to complete the official FCP - FortiAnalyzer 7.4 Administrator instructor-led or self-paced training course, which includes approximately 4 hours of lecture and 3 hours of hands-on lab exercises. Reviewing the FortiAnalyzer 7.4.1 Administration Guide and the FortiAnalyzer 7.4.0 New Features Guide, both available through Fortinet's documentation portal, is also strongly advised.
The FCP_FAZ_AD-7.4 exam consists of 35 scored questions and must be completed within 65 minutes. Question types include multiple-choice and scenario-based operational questions that test applied knowledge rather than purely theoretical recall. The exam is delivered through Pearson VUE, available at authorized test centers worldwide or via the OnVUE online proctoring platform.
The exam uses a pass/fail scoring model; Fortinet does not publicly disclose the specific passing score threshold. No partial credit is awarded. The exam costs $200 USD and was listed as available until October 14, 2025—candidates should verify current availability and any successor exam version on the Fortinet Training Institute website before scheduling.
Earning the FCP_FAZ_AD-7.4 credential positions professionals for roles in network security administration and security operations, where FortiAnalyzer is widely deployed for centralized log management, threat correlation, and compliance reporting. As an elective exam within the Fortinet Certified Professional (FCP) - Network Security certification, passing this exam—combined with the core FCP FortiGate Administrator exam—earns the full FCP designation, which is associated with salaries in the $110,000–$135,000 range for mid-level security professionals in 2025.
The credential also earns credit toward the NSE 6 Network Security Specialist certification, a recognized industry marker for advanced Fortinet specialization. Organizations running Fortinet security fabrics actively seek administrators with verified FortiAnalyzer expertise, as the platform is central to their visibility and compliance workflows. For professionals already working in Fortinet-heavy environments, this certification provides a concrete, vendor-validated credential that differentiates them for senior administrator, security analyst, and SOC engineer roles.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 600 questions.
1. Litware Inc. runs a two-unit FortiAnalyzer HA cluster where both units are actively ingesting logs from 120 FortiGate devices across multiple sites. A critical security patch requires upgrading both cluster members from firmware 7.2 to 7.4 with zero log loss and continuous availability. Which upgrade sequence should the administrator follow? (Select one!)
Explanation
The correct FortiAnalyzer HA firmware upgrade sequence requires upgrading secondary units first. The secondary unit is upgraded and allowed to rejoin the cluster before the primary unit is touched. Once the secondary is back in the cluster, the primary unit is upgraded. When the primary starts its upgrade process, it automatically transitions to the secondary role, and the already-upgraded unit is promoted to primary, maintaining uninterrupted log collection throughout. Upgrading both units simultaneously causes a complete cluster outage since neither unit can serve as primary during the upgrade window, risking log loss if FortiGate buffer capacity is exceeded. Upgrading the primary unit first leaves the cluster without a functioning primary node during the upgrade; if the upgrade fails, there is no fallback active unit and all incoming log traffic is interrupted. Disabling HA entirely creates an unnecessary outage window and risks data divergence between units during the period they operate independently, requiring a full resynchronization that can take hours on large deployments.
2. A network engineer at Fabrikam Corp is evaluating log transport options for 30 FortiGate firewalls sending logs to FortiAnalyzer across WAN links with limited bandwidth. The engineer requires encrypted transmission, client-side log buffering during FortiAnalyzer outages, and bandwidth reduction. Which two features does OFTP provide that standard UDP syslog does not? (Select two!)
Multiple correct answersExplanation
OFTP is Fortinet's proprietary log transport protocol that includes several capabilities absent from standard syslog. Built-in LZ4 compression reduces the bandwidth consumed by log transmission, which is critical for WAN deployments. Client-side buffering on FortiGate ensures that logs are queued locally when FortiAnalyzer is temporarily unreachable and are automatically retransmitted when connectivity is restored, preventing log loss during outages. OFTP uses TCP transport with built-in SSL/TLS encryption, not UDP. OFTP is a Fortinet-proprietary protocol and is not natively compatible with third-party SIEM platforms, which require standard syslog or CEF. OFTP uses built-in encryption by default, not clear-text transmission, which is one of its primary advantages over standard syslog.
3. A security administrator configures the FortiAnalyzer admin account `soc_admin` with two trusted host entries: 192.168.10.0/24 and 10.50.0.0/16. A SOC analyst working remotely from IP address 172.31.5.20 attempts to log in using the `soc_admin` account credentials. What will happen? (Select one!)
Explanation
Once any trusted host entry is configured for an administrator account, FortiAnalyzer enforces strict source IP filtering and permits access only from IP addresses matching one of the configured trusted host subnets. The source address 172.31.5.20 does not fall within 192.168.10.0/24 or 10.50.0.0/16, so the connection is denied. Trusted host restrictions apply equally to all access methods including HTTPS, SSH, and API — there is no access-method exemption. There is no grace mechanism or warn-and-permit behavior. If no trusted hosts are configured, access is permitted from any source IP. Adding even a single trusted host entry restricts all other source addresses immediately.
4. A capacity planner at Northwind Technologies is sizing a new FortiAnalyzer VM deployment. The environment generates 1,000 logs per second with an average log size of 500 bytes. Requirements specify 90 days of analytics retention and 365 days of archive retention. Using standard FortiAnalyzer storage ratios of 10:1 archive compression and 4x SQL analytics overhead, what is the approximate total storage required? (Select one!)
Explanation
Calculating storage step by step: daily raw volume equals 1,000 logs per second multiplied by 86,400 seconds per day multiplied by 500 bytes per log, divided by 1,073,741,824 bytes per GB, yielding approximately 40 GB per day of raw logs. Archive storage applies 10:1 compression, so daily archive is 4 GB per day; across 365 days the archive layer requires approximately 1,460 GB or about 1.5 TB. Analytics storage requires 4 times the raw log size for SQL indexing overhead, yielding 160 GB per day; across 90 days the analytics layer requires approximately 14,400 GB or about 14 TB. Total storage is approximately 15.5 TB, rounding to approximately 15 TB. The 2 TB option accounts only for archive storage while ignoring the much larger analytics layer. The 8 TB option underestimates the SQL indexing overhead. The 50 TB option significantly overestimates by misapplying the analytics ratio across the full 365-day retention period rather than only the 90-day analytics window.
5. Tailspin Technologies is building a custom FortiAnalyzer dataset to display the top bandwidth consumers across all traffic logs. The dataset must calculate the total bytes sent by each source IP address and return results sorted from highest to lowest. Which SQL aggregate function correctly sums the sentbyte field per source IP to produce the total bandwidth metric? (Select one!)
Explanation
The sum() aggregate function calculates the total of all values in a column across all rows that share the same GROUP BY key. Using sum(sentbyte) grouped by srcip produces the cumulative total bytes sent by each source IP address across all matching traffic sessions, which is the correct metric for identifying top bandwidth consumers. The count() function counts the number of rows per group and returns the number of sessions rather than bytes, which would identify the most active sources by connection count rather than bandwidth. The max() function returns only the highest individual value in the group, which would show the single largest session per IP rather than total consumption. The avg() function computes the mean bytes per session and systematically understates heavy users who make many small connections. The complete dataset query would be SELECT srcip, sum(sentbyte) as total_bytes FROM traffic WHERE subtype='forward' GROUP BY srcip ORDER BY total_bytes DESC LIMIT 100.
One-time access to this exam