Fortinet Network Security Analyst NSE5_FAZ-6.0 Questions & Answers

• Question 1:

  Logs are being deleted from one of your ADOMs earlier than the configured setting for archiving in your data policy.

  What is the most likely problem?

  A. The total disk space is insufficient and you need to add other disk.

  B. CPU resources are too high.

  C. The ADOM disk quota is set too low based on log rates.

  D. Logs in that ADOM are being forwarded in real-time to another FortiAnalyzer device.

  Correct Answer: C

• Question 2:

  What is the purpose of the following CLI command?

  

  A. To add a log file checksum

  B. To add the MD5's hash value and authentication code

  C. To add a unique tag to each log to prove that it came from this FortiAnalyzer

  D. To encrypt log communications

  Correct Answer: A

• Question 3:

  View the exhibit.

  

  What does the data point at 14:35 tell you?

  A. FortiAnalyzer is dropping logs.

  B. FortiAnalyzer is indexing logs faster than logs are being received.

  C. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.

  D. The sqlplugind daemon is ahead in indexing by one log.

  Correct Answer: D

• Question 4:

  How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

  A. Use static routes

  B. Use administrative profiles

  C. Use trusted hosts

  D. Use secure protocols

  Correct Answer: C

• Question 5:

  What purposes does the auto-cache setting on reports serve? (Choose two.)

  A. To reduce report generation time

  B. To automatically update the hcache when new logs arrive

  C. To reduce the log insert lag rate

  D. To provide diagnostics on report generation time

  Correct Answer: AB

• Question 6:

  If you upgrade your FortiAnalyzer firmware, what report elements can be affected?

  A. Output profiles

  B. Report settings

  C. Report scheduling

  D. Custom datasets

  Correct Answer: D

• Question 7:

  How does FortiAnalyzer retrieve specific log data from the database?

  A. SQL FROM statement

  B. SQL GET statement

  C. SQL SELECT statement

  D. SQL EXTRACT statement

  Correct Answer: C

• Question 8:

  On FortiAnalyzer, what is a wildcard administrator account?

  A. An account that permits access to members of an LDAP group

  B. An account that allows guest access with read-only privileges

  C. An account that requires two-factor authentication

  D. An account that validates against any user account on a FortiAuthenticator

  Correct Answer: D

• Question 9:

  For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

  A. Use DNS

  B. Use host name resolution

  C. Use real-time forwarding

  D. Use an NTP server

  Correct Answer: D

• Question 10:

  What FortiGate process caches logs when FortiAnalyzer is not reachable?

  A. logfiled

  B. sqlplugind

  C. oftpd

  D. miglogd

  Correct Answer: D