Fortinet Fortinet Other Certification NSE5_FAZ-6.2 Questions & Answers

• Question 41:

  Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

  A. SSL is the default setting.

  B. SSL communications are auto-negotiated between the two devices.

  C. SSL can send logs in real-time only.

  D. SSL encryption levels are globally set on FortiAnalyzer.

  E. FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.

  Correct Answer: AD

• Question 42:

  What statements are true regarding the "store and upload" log transfer option between FortiAnalyzer and FortiGate? (Choose three.)

  A. All FortiGates can send logs to FortiAnalyzer using the store and upload option.

  B. Only FortiGate models with hard disks can send logs to FortiAnalyzer using the store and upload option.

  C. Both secure communications methods (SSL and IPsec) allow the store and upload option.

  D. Disk logging is enabled on the FortiGate through the CLI only.

  E. Disk logging is enabled by default on the FortiGate.

  Correct Answer: BCD

• Question 43:

  What is the purpose of the following CLI command?

  

  A. To add a log file checksum

  B. To add the MD's hash value and authentication code

  C. To add a unique tag to each log to prove that it came from this FortiAnalyzer

  D. To encrypt log communications

  Correct Answer: A

• Question 44:

  What statements are true regarding FortiAnalyzer 's treatment of high availability (HA) dusters? (Choose two)

  A. FortiAnalyzer distinguishes different devices by their serial number.

  B. FortiAnalyzer receives logs from d devices in a duster.

  C. FortiAnalyzer receives bgs only from the primary device in the cluster.

  D. FortiAnalyzer only needs to know (he serial number of the primary device in the cluster-it automaticaly discovers the other devices.

  Correct Answer: AB

• Question 45:

  Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)

  A. SMS

  B. Email

  C. SNMP

  D. IM

  Correct Answer: BC

  Reference: https://help.fortinet.com/fa/faz50hlp/60/6-0-2/Content/ FortiAnalyzer_Admin_Guide/1800_Events/0200_Event_handlers/0600_Create_event_han dlers.htm

• Question 46:

  What purposes does the auto-cache setting on reports serve? (Choose two.)

  A. To reduce report generation time

  B. To automatically update the hcache when new logs arrive

  C. To reduce the log insert lag rate

  D. To provide diagnostics on report generation time

  Correct Answer: AB

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.0.0/administration-guide/282280/enablingautocache

• Question 47:

  Which two statements about log forwarding are true? (Choose two.)

  A. Forwarded logs cannot be filtered to match specific criteria.

  B. Logs are forwarded in real-time only.

  C. The client retains a local copy of the logs after forwarding.

  D. You can use aggregation mode only with another FortiAnalyzer.

  Correct Answer: BC

  Reference: www.fortinetguru.com/2020/07/log-forwarding-fortianalyzer-fortios-6-2-3/

• Question 48:

  Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

  A. ADOMs are enabled by default.

  B. ADOMs constrain other administrator's access privileges to a subset of devices in the device list.

  C. Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM.

  D. All administrators can create ADOMs--not just the admin administrator.

  Correct Answer: BC

• Question 49:

  What are the operating modes of FortiAnalyzer? (Choose two)

  A. Standalone

  B. Manager

  C. Analyzer

  D. Collector

  Correct Answer: CD

• Question 50:

  View the exhibit.

  

  What does the data point at 14:35 tell you?

  A. FortiAnalyzer is dropping logs.

  B. FortiAnalyzer is indexing logs faster than logs are being received.

  C. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.

  D. The sqlplugind daemon is ahead in indexing by one log.

  Correct Answer: D

  Logs are received then they are indexed, no logging server in the world can index logs faster than they are received. When FAZ receives raw logs, they are inserted (indexed) by the SQL database and the sqlplugind daemon, this graph shows that FAZ received 3 logs and sqlplugind indexed 4.