Fortinet NSE5_FAZ-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE5_FAZ-7.0 Online Questions & Answers

• Question 1:

  View the exhibit.

  

  Why is the total quota less than the total system storage?

  A. 3.6% of the system storage is already being used.
  B. Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files
  C. The oftpd process has not archived the logs yet
  D. The logfiled process is just estimating the total quota
  B. Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files

  ---

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/368682/disk- space-allocation

• Question 2:

  In FortiAnalyzer's FormView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAnalyzer?

  A. Configure local DNS servers on FortiAnalyzer
  B. Resolve IPs on FortiGate
  C. Configure # set resolve-ip enable in the system FortiView settings
  D. Resolve IPs on a per-ADOM basis to reduce delay on FortiView while IPs resolve
  B. Resolve IPs on FortiGate

• Question 3:

  View the exhibit.

  

  What does the data point at 14:35 tell you?

  A. FortiAnalyzer is dropping logs.
  B. FortiAnalyzer is indexing logs faster than logs are being received.
  C. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.
  D. The sqlplugind daemon is ahead in indexing by one log.
  B. FortiAnalyzer is indexing logs faster than logs are being received.

  ---

  Raw logs are received and then that log is indexed. So indexing can never be ahead of logs received. But it can be that at a certain point in time logs are being indexed faster than they are received.

  If you look at the study guide you will notice that there is something called Insert Lag Time. And in this example it's between 30-50 seconds. The point is the indexing of the logs can't be ahead if it gets processed a few seconds later.

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/47690/insert- rate-vs-receive-rate-widget

• Question 4:

  Which two constraints can impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)

  A. License type
  B. Disk size
  C. Total quota
  D. RAID level
  B. Disk size
  D. RAID level

  ---

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/368682/disk- space-allocation

• Question 5:

  What two things should an administrator do to view Compromised Hosts on FortiAnalyzer? (Choose two.)

  A. Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.
  B. Make sure all endpoints are reachable by FortiAnalyzer.
  C. Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.
  D. Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.
  A. Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.
  D. Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

  ---

  Compromised Hosts or Indicators of Compromise service (IOC) is a licensed feature.

  To view Compromised Hosts, you must turn on the UTM web filter of FortiGate devices and subscribe your FortiAnalyzer unit to FortiGuard to keep its local threat database synchronized with the FortiGuard threat database. See Subscribing FortiAnalyzer to FortiGuard. Ref : https://docs.fortinet.com/document/fortianalyzer/6.4.0/administration-guide/137635/viewing-compromised-hosts

• Question 6:

  What FortiGate process caches logs when FortiAnalyzer is not reachable?

  A. logfiled
  B. sqlplugind
  C. oftpd
  D. miglogd
  D. miglogd

  ---

  Reference: https://forum.fortinet.com/tm.aspx?m=143106

• Question 7:

  What are the operating modes of FortiAnalyzer? (Choose two)

  A. Standalone
  B. Manager
  C. Analyzer
  D. Collector
  C. Analyzer
  D. Collector

• Question 8:

  How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

  A. Use static routes
  B. Use administrative profiles
  C. Use trusted hosts
  D. Use secure protocols
  C. Use trusted hosts

  ---

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/186508/trusted- hosts

• Question 9:

  What is the purpose of employing RAID with FortiAnalyzer?

  A. To introduce redundancy to your log data
  B. To provide data separation between ADOMs
  C. To separate analytical and archive data
  D. To back up your logs
  A. To introduce redundancy to your log data

  ---

  https://en.wikipedia.org/wiki/RAID#:~:text=RAID%20(%22Redundant%20Array%20of%20In expensive,%2C%20performance%20improvement%2C%20or%20both.

• Question 10:

  What are two of the key features of FortiAnalyzer? (Choose two.)

  A. Centralized log repository
  B. Cloud-based management
  C. Reports
  D. Virtual domains (VDOMs)
  A. Centralized log repository
  C. Reports