FCP FortiAnalyzer 7.4 study plan

Map the FortiAnalyzer 7.4 deployment topologies (standalone, HA primary/secondary, collector/analyzer split) and write a one-paragraph tradeoff note for each

Diagram the ADOM concept and list the ADOM modes (normal, backup, collector, analyzer) with the operational role of each

Identify the licensing and VM resource sizing inputs (log rate, retention days, disk) that drive hardware or VM selection

Walk through the initial setup wizard steps in a lab VM and record every decision point you had to make

Configure administrative profiles, admin users, and remote authentication (LDAP/RADIUS) in the lab and verify role separation

Set up an HA pair of FortiAnalyzers in the lab and force a failover to observe what state transfers

Configure system settings that affect operations: NTP, DNS, mail server, and FortiAnalyzer logging of its own events

Practice backup and restore of configuration and explain what is and is not included in a config backup

Register a FortiGate to FortiAnalyzer and confirm logs arrive, distinguishing device registration from log forwarding authorization

Compare log forwarding modes (real-time vs. store-and-forward, reliable vs. best-effort) and predict behavior when the analyzer is unreachable

Configure disk quotas and log retention settings per ADOM and verify the effect on stored log volume

Trace a single session's logs from FortiGate through to FortiAnalyzer and confirm the fields survive the trip

Explain log parsing: how FortiAnalyzer identifies log type, maps fields, and where parsers or log-type definitions matter

Use log search filters and structured queries to isolate traffic, event, and security logs by device and time window

Configure and verify a log-forwarding destination from FortiAnalyzer to a syslog or secondary analyzer target

Practice troubleshooting a device that registers but produces no searchable logs, listing the checkpoints in order

Build a custom report from scratch: choose a dataset, bind it to a chart, and lay out the report page

Create a scheduled report with a defined time period, output format, and email delivery, then confirm it fires

Differentiate built-in datasets from custom SQL datasets and write one simple custom dataset against your lab logs

Configure report templates and explain how templates differ from finished reports in reuse

Design a report pack for a compliance-style audience and justify each chart against a security question it answers

Explain report output formats and storage locations, and verify where generated reports are retained and for how long

Configure an event handler that triggers on a log condition and sends an alert, then tune it to reduce noise

Distinguish events, incidents, and alerts in FortiAnalyzer 7.4 and map which console area handles each

Investigate a simulated incident end to end: start from an alert, pivot into logs, build a timeline, and record findings

Use the incident investigation workflow to attach evidence, add notes, and change incident status

Configure automated playbooks or automation stitches that respond to a detected event and verify the action fires

Explain how indicators of compromise and threat feeds feed into event detection on FortiAnalyzer

Re-run every lab from weeks 1 to 7 from a clean snapshot without notes and log each step you could not recall

Build a one-page cheat sheet of commands, settings paths, and limits that you kept forgetting

Take a timed practice set across all four domains and review every wrong answer back to the source concept

Rehearse explaining three configuration choices out loud as if defending them to a colleague