Fortinet NSE5_FAZ-6.4 Online Practice Questions and Exam Preparation

Fortinet NSE5_FAZ-6.4 Online Questions & Answers

• Question 31:

  A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer. What can you do on FortiAnalyzer to accomplish this?

  A. Click FortiView and generate a report for that administrator.
  B. Click Task Monitor and view the tasks performed by that administrator.
  C. Click Log View and generate a report for that administrator.
  D. View the tasks performed by the rogue administrator in Fabric View.
  B. Click Task Monitor and view the tasks performed by that administrator.

  ---

  Reference: https://docs.fortinet.com/document/fortimanager/6.4.1/administration-guide/792943/task-monitor

• Question 32:

  Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally?(Choose two.)

  A. Mail server
  B. Output profile
  C. SFTP server
  D. Report scheduling
  A. Mail server
  B. Output profile

  ---

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.0.2/administration- guide/598322/creating-output-profiles

• Question 33:

  What FortiGate process caches logs when FortiAnalyzer is not reachable?

  A. logfiled
  B. sqlplugind
  C. oftpd
  D. miglogd
  D. miglogd

  ---

  Reference: https://forum.fortinet.com/tm.aspx?m=143106

• Question 34:

  How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

  A. Use static routes
  B. Use administrative profiles
  C. Use trusted hosts
  D. Use secure protocols
  C. Use trusted hosts

  ---

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/186508/trusted-hosts

• Question 35:

  What statements are true regarding disk log quota? (Choose two)

  A. The FortiAnalyzer stops logging once the disk log quota is met.
  B. The FortiAnalyzer automatically sets the disk log quota based on the device.
  C. The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.
  D. The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.
  C. The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.
  D. The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

• Question 36:

  Which two statements are true regarding FortiAnalyzer operating modes? (Choose two.)

  A. When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.
  B. Collector mode is the default operating mode.
  C. When in collector mode. FortiAnalyzer supports event management and reporting features.
  D. By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting
  A. When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.
  D. By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting

  ---

  Reference: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/227478/collector-mode https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/312644/analyzer-collector-collaboration

• Question 37:

  Which two statements are true regarding FortiAnalyzer log forwarding? (Choose two.)

  A. In aggregation mode, you can forward logs to syslog and CEF servers as well.
  B. Forwarding mode forwards logs in real time only to other FortiAnalyzer devices.
  C. Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.
  D. Both modes, forwarding and aggregation, support encryption of logs between devices.
  B. Forwarding mode forwards logs in real time only to other FortiAnalyzer devices.
  C. Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

  ---

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.2.0/cookbook/63238/what-is-the-difference-between-log-forward-and-log-aggregation-modes

• Question 38:

  Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

  A. Must configure the FortiAnalyzer end of the tunnel only--the FortiGate end is auto- negotiated.
  B. Must establish an IPsec tunnel ID and pre-shared key.
  C. IPsec cannot be enabled if SSL is enabled as well.
  D. IPsec is only enabled through the CLI on FortiAnalyzer.
  C. IPsec cannot be enabled if SSL is enabled as well.

• Question 39:

  What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?

  A. Log correlation
  B. Host name resolution
  C. Log collection
  D. Real-time forwarding
  A. Log correlation

• Question 40:

  How are logs forwarded when FortiAnalyzer is using aggregation mode?

  A. Logs are forwarded as they are received and content files are uploaded at a scheduled time.
  B. Logs and content files are stored and uploaded at a scheduled time.
  C. Logs are forwarded as they are received.
  D. Logs and content files are forwarded as they are received.
  B. Logs and content files are stored and uploaded at a scheduled time.

  ---

  https://www.fortinetguru.com/2020/07/log-forwarding-fortianalyzer-fortios-6-2-3/ https://docs.fortinet.com/document/fortianalyzer/6.2.0/administration-guide/420493/modes https://docs.fortinet.com/document/fortianalyzer/6.2.0/cookbook/63238/what-is-the-difference-between-log-forward-and-log-aggregation-modes