Fortinet Fortinet Certifications NSE5_FAZ-6.4 Questions & Answers

• Question 51:

  What can you do on FortiAnalyzer to restrict administrative access from specific locations?

  A. Configure trusted hosts for that administrator.

  B. Enable geo-location services on accessible interface.

  C. Configure two-factor authentication with a remote RADIUS server.

  D. Configure an ADOM for respective location.

  Correct Answer: A

  Reference: https://docs.fortinet.com/document/fortigate/6.2.0/hardening-your-fortigate/582009/systemadministrator-best-practices

• Question 52:

  The admin administrator is failing to register a FortiClient EMS on the FortiAnalyzer device.

  What can be the reason for this failure?

  A. FortiAnalyzer is in an HA cluster.

  B. ADOM mode should be set to advanced, in order to register the FortiClient EMS device.

  C. ADOMs are not enabled on FortiAnalyzer.

  D. A separate license is required on FortiAnalyzer in order to register the FortiClient EMS device.

  Correct Answer: C

  Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-2/FMG-FAZ/0800_ADOMs/0015_FortiClient%20and %20ADOMs.htm

• Question 53:

  In Log View, you can use the Chart Builder feature to build a dataset and chart based on the filtered search results.

  Similarly, which feature you can use for FortiView?

  A. Export to Report Chart

  B. Export to PDF

  C. Export to Chart Builder

  D. Export to Custom Chart

  Correct Answer: A

  Reference: https://community.fortinet.com/t5/FortiAnalyzer/Creating-a-Custom-report-from-FortiViewExport-to-Report-Chart/ta-p/190154?externalID=FD40483

• Question 54:

  Refer to the exhibit.

  

  What does the data point at 14:55 tell you?

  A. The received rate is almost at its maximum for this device

  B. The sqlplugind daemon is behind in log indexing by two logs

  C. Logs are being dropped

  D. Raw logs are reaching FortiAnalyzer faster than they can be indexed

  Correct Answer: D

• Question 55:

  What does the disk status Degraded mean for RAID management?

  A. One or more drives are missing from the FortiAnalyzer unit. The drive is no longer available to the operating system.

  B. The FortiAnalyzer device is writing to all the hard drives on the device in order to make the array fault tolerant.

  C. The FortiAnalyzer device is writing data to a newly added hard drive in order to restore the hard drive to an optimal state.

  D. The hard drive Is no longer being used by the RAID controller

  Correct Answer: D

• Question 56:

  Which two statements are true regarding fabric connectors? (Choose two.)

  A. Configuring fabric connectors to send notification to ITSM platform upon incident creation Is more efficient than third-party information from the FortiAnalyzer API.

  B. Fabric connectors allow to save storage costs and improve redundancy.

  C. Storage connector service does not require a separate license to send logs to cloud platform.

  D. Cloud-Out connections allow you to send real-time logs to pubic cloud accounts like Amazon S3, Azure Blob , and Google Cloud.

  Correct Answer: AD

• Question 57:

  For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

  A. Use DNS

  B. Use host name resolution

  C. Use real-time forwarding

  D. Use an NTP server

  Correct Answer: D

• Question 58:

  What statements are true regarding disk log quota? (Choose two)

  A. The FortiAnalyzer stops logging once the disk log quota is met.

  B. The FortiAnalyzer automatically sets the disk log quota based on the device.

  C. The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.

  D. The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

  Correct Answer: CD

• Question 59:

  What are offline logs on FortiAnalyzer?

  A. Compressed logs, which are also known as archive logs, are considered to be offline logs.

  B. When you restart FortiAnalyzer. all stored logs are considered to be offline logs.

  C. Logs that are indexed and stored in the SQL database.

  D. Logs that are collected from offline devices after they boot up.

  Correct Answer: A

  Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-6/Content/ FortiAnalyzer_Admin_Guide/0300_Key_concepts/0600_Log_Storage/0400_Arch ive_analytics_logs.htm

• Question 60:

  An administrator has configured the following settings:

  config system global set log-checksum md5-auth end

  What is the significance of executing this command?

  A. This command records the log file MD5 hash value.

  B. This command records passwords in log files and encrypts them.

  C. This command encrypts log transfer between FortiAnalyzer and other devices.

  D. This command records the log file MD5 hash value and authentication code.

  Correct Answer: D

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.4.6/administration-guide/410387/appendix-blog-integrity-and-secure-log-transfer