Fortinet NSE 5 Network Security Analyst NSE5_FAZ-6.4 Questions & Answers

• Question 1:

  If you upgrade the FortiAnalyzer firmware, which report element can be affected?

  A. Custom datasets

  B. Report scheduling

  C. Report settings

  D. Output profiles

  Correct Answer: A

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/upgrade-guide/669300/checking-reports

• Question 2:

  What FortiView tool can you use to automatically build a dataset and chart based on a filtered search result?

  A. Chart Builder

  B. Export to Report Chart

  C. Dataset Library

  D. Custom View

  Correct Answer: A

  https://docs.fortinet.com/document/fortianalyzer/6.2.0/cookbook/989203/building-charts-with-chart-builder

• Question 3:

  Which two statements are true regarding ADOM modes? (Choose two.)

  A. You can only change ADOM modes through CLI.

  B. In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM.

  C. In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

  D. Normal mode is the default ADOM mode.

  Correct Answer: CD

  Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-1/FMG- FAZ/0800_ADOMs/0400_ADOM% 20Device%20Modes.htm

• Question 4:

  Refer to the exhibit.

  

  The exhibit shows "remoteservergroup" is an authentication server group with LDAP and RADIUS servers.

  Which two statements express the significance of enabling "Match all users on remote server" when configuring a new administrator? (Choose two.)

  A. It creates a wildcard administrator using LDAP and RADIUS servers.

  B. Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.

  C. Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.

  D. It allows administrators to use two-factor authentication.

  Correct Answer: AB

  Reference: https://docs.fortinet.com/document/fortimanager/7.0.1/administration-guide/858351/creatingadministrators

• Question 5:

  In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)

  A. Remote logging must be enabled on FortiGate

  B. Log encryption must be enabled

  C. ADOMs must be enabled

  D. FortiGate must be registered with FortiAnalyzer

  Correct Answer: AD

  Pg 70: "after you add and register a FortiGate device with the FortiAnalyzer unit, you must also ensure that the FortiGate device is configured to send logs to the FortiAnalyzer unit." https://docs.fortinet.com/uploaded/files/4614/FortiAnalyzer-5.4.6-Administration%20Guide.pdf Pg 45: "ADOMs must be enabled to support the logging and reporting of NON- FORTIGATE devices, such as FortiCarrier, FortiClientEMS, FortiMail, FortiWeb, FortiCache, and FortiSandbox."

• Question 6:

  How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

  A. Use static routes

  B. Use administrative profiles

  C. Use trusted hosts

  D. Use secure protocols

  Correct Answer: C

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/186508/trusted-hosts

• Question 7:

  When you perform a system backup, what does the backup configuration contain? (Choose two.)

  A. Generated reports

  B. Device list

  C. Authorized devices logs

  D. System information

  Correct Answer: BD

  https://help.fortinet.com/fa/cli-olh/5-6- 5/Content/Document/1400_execute/backup.htm https://help.fortinet.com/fauth/5-2/Content/Admin%20Guides/5_2%20Admin% 20Guide/300/301_Dashboard.htm

• Question 8:

  Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate to FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

  A. A local wildcard administrator account

  B. A remote LDAP server

  C. A trusted host profile that restricts access to the LDAP group

  D. An administrator group

  Correct Answer: AB

  Reference: https://kb.fortinet.com/kb/documentLink.do?externalID=FD38567

• Question 9:

  Which two statements about log forwarding are true? (Choose two.)

  A. Forwarded logs cannot be filtered to match specific criteria.

  B. Logs are forwarded in real-time only.

  C. The client retains a local copy of the logs after forwarding.

  D. You can use aggregation mode only with another FortiAnalyzer.

  Correct Answer: CD

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/420493/modes https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/621804/log-forwarding

• Question 10:

  Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

  A. SSL is the default setting.

  B. SSL communications are auto-negotiated between the two devices.

  C. SSL can send logs in real-time only.

  D. SSL encryption levels are globally set on FortiAnalyzer.

  E. FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.

  Correct Answer: AD