Fortinet NSE5_FAZ-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE5_FAZ-7.0 Online Questions & Answers

• Question 101:

  Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally? (Choose two.)

  A. Mail server
  B. Output profile
  C. SFTP server
  D. Report scheduling
  A. Mail server
  B. Output profile

  ---

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.0.2/administration- guide/598322/creating-output-profiles

• Question 102:

  Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy. What is the most likely problem?

  A. CPU resources are too high
  B. Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device
  C. The total disk space is insufficient and you need to add other disk
  D. The ADOM disk quota is set too low, based on log rates
  D. The ADOM disk quota is set too low, based on log rates

  ---

  Reference: https://help.fortinet.com/fmgr/50hlp/56/5-6-1/FMG- FAZ/1100_Storage/0017_Deleted%20device%20logs.htm

• Question 103:

  What purposes does the auto-cache setting on reports serve? (Choose two.)

  A. To reduce report generation time
  B. To automatically update the hcache when new logs arrive
  C. To reduce the log insert lag rate
  D. To provide diagnostics on report generation time
  A. To reduce report generation time
  B. To automatically update the hcache when new logs arrive

  ---

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.0.0/administration- guide/282280/enabling-autocache

• Question 104:

  The admin administrator is failing to register a FortiClient EMS on the FortiAnalyzer device. What can be the reason for this failure?

  A. FortiAnalyzer is in an HA cluster.
  B. ADOM mode should be set to advanced, in order to register the FortiClient EMS device.
  C. ADOMs are not enabled on FortiAnalyzer.
  D. A separate license is required on FortiAnalyzer in order to register the FortiClient EMS device.
  C. ADOMs are not enabled on FortiAnalyzer.

  ---

  Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-2/FMG- FAZ/0800_ADOMs/0015_FortiClient%20and%20ADOMs.htm

• Question 105:

  Which two statements are correct regarding the export and import of playbooks? (Choose two.)

  A. Playbooks can be exported and imported only within the same FortiAnalyzer.
  B. You can export only one playbook at a time.
  C. A playbook that was disabled when it was exported, will be disabled when it is imported.
  D. You can import a playbook even if there is another one with the same name in the destination.
  C. A playbook that was disabled when it was exported, will be disabled when it is imported.
  D. You can import a playbook even if there is another one with the same name in the destination.

  ---

  D : If the imported playbook has the same name as an existing one, FortiAnalyzer will create a new name that includes a timestamp to avoid conflicts.

  C : Playbooks are imported with the same status they had (enabled or disabled) when they were exported. Playbooks set to run automatically should be exported while they are disabled to avoid unintended runs on the destination.

• Question 106:

  How does FortiAnalyzer retrieve specific log data from the database?

  A. SQL FROM statement
  B. SQL GET statement
  C. SQL SELECT statement
  D. SQL EXTRACT statement
  C. SQL SELECT statement

  ---

  https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/137bb60e-ff37- 11e8-8524-f8bc1258b856/fortianalyzer-fortigate-sql-technote-40-mr2.pdf

• Question 107:

  After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the purpose of running the following CLI command? execute sql-local rebuild-adom

  A. To reset the disk quota enforcement to default
  B. To remove the analytics logs of the device from the old database
  C. To migrate the archive logs to the new ADOM
  D. To populate the new ADOM with analytical logs for the moved device, so you can run reports
  D. To populate the new ADOM with analytical logs for the moved device, so you can run reports

  ---

  D is correct : From FortiAnalyzer study guide

• Question 108:

  For which two SAML roles can the FortiAnalyzer be configured? (Choose two.)

  A. Principal
  B. Service provider
  C. Identity collector
  D. Identity provider
  B. Service provider
  D. Identity provider

  ---

  In FortiAnalyzer, SAML can be enabled across all Security Fabric devices, enabling smooth movement between devices for the administrator by means of single sign-on (SSO). FortiAnalyzer can play the role of the identity provider (IdP), the service provider (SP), or Fabric SP, when an external identity provider is available. FortiAnalyzer_7.0_Study_Guide-Online pag. 48

• Question 109:

  Refer to the exhibit.

  

  The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster. What can you conclude from the configuration displayed?

  A. This FortiAnalyzer will join to the existing HA cluster as the primary.
  B. This FortiAnalyzer is configured to receive logs in its port1.
  C. This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.
  D. After joining to the cluster, this FortiAnalyzer will keep an updated log database.
  B. This FortiAnalyzer is configured to receive logs in its port1.

  ---

  If the preferred role is Primary, then this unit becomes the primary unit if it is configured first in a new HA cluster. If there is an existing primary unit, then this unit becomes a secondary unit.

• Question 110:

  What is the purpose of the following CLI command?

  

  A. To add a log file checksum
  B. To add the MD's hash value and authentication code
  C. To add a unique tag to each log to prove that it came from this FortiAnalyzer
  D. To encrypt log communications
  A. To add a log file checksum

  ---

  https://docs2.fortinet.com/document/fortianalyzer/6.0.3/cli- reference/849211/global