Fortinet Fortinet Certifications NSE5_FAZ-7.0 Questions & Answers

• Question 11:

  Which two statements about log forwarding are true? (Choose two.)

  A. Forwarded logs cannot be filtered to match specific criteria.

  B. Logs are forwarded in real-time only.

  C. The client retains a local copy of the logs after forwarding.

  D. You can use aggregation mode only with another FortiAnalyzer.

  Correct Answer: CD

  https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/420493/modes https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/621804/log- forwarding

• Question 12:

  Refer to the exhibit.

  

  What does the data point at 14:55 tell you?

  A. The received rate is almost at its maximum for this device

  B. The sqlplugind daemon is behind in log indexing by two logs

  C. Logs are being dropped

  D. Raw logs are reaching FortiAnalyzer faster than they can be indexed

  Correct Answer: D

• Question 13:

  On FortiAnalyzer, what is a wildcard administrator account?

  A. An account that permits access to members of an LDAP group

  B. An account that allows guest access with read-only privileges

  C. An account that requires two-factor authentication

  D. An account that validates against any user account on a FortiAuthenticator

  Correct Answer: A

  https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/747268/configuring-wildcard- admin-accounts

• Question 14:

  You need to upgrade your FortiAnalyzer firmware.

  What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?

  A. FortiAnalyzer uses log fetching to retrieve the logs when back online

  B. FortiGate uses the miglogd process to cache the logs

  C. The logfiled process stores logs in offline mode

  D. Logs are dropped

  Correct Answer: B

• Question 15:

  What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?

  A. Log correlation

  B. Host name resolution

  C. Log collection

  D. Real-time forwarding

  Correct Answer: A

  page 27: synchronize the time on FortiAnalyzer and all registered devices with an NTP server for proper log correlation.

• Question 16:

  Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

  A. Log fetching allows the administrator to fetch analytics logs from another FortiAnalyzer for redundancy.

  B. A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with the same FortiAnalyzer devices at the other end.

  C. Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.

  D. Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

  Correct Answer: CD

  Using FortiAnalyzer, you can enable log fetching. This allows FortiAnalyzer to fetch the archived logs of specified devices from another FortiAnalyzer, which you can then run queries or reports on for forensic analysis.

  The FortiAnalyzer device that fetches logs operates as the fetch client, and the other FortiAnalyzer device that sends logs operates as the fetch server. Log fetching can happen only between two FortiAnalyzer devices, and both of them must be running the same firmware version. A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with different FortiAnalyzer devices at the other end. FortiAnalyzer_7.0_Study_Guide-Online pag. 168

• Question 17:

  Refer to the exhibit.

  

  Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin" and coming from Laptop1: Which filter will achieve the desired result?

  A. operation-login and performed_on=="GUI(10.1.1.100)" and user!=admin

  B. operation-login and srcip==10.1.1.100 and dstip==10.1.1.210 and user==admin

  C. operation-login and dstip==10.1.1.210 and userl-admin

  D. operation-login and performed_on=="GUI(10.1.1.210)' and user!=admin

  Correct Answer: D

• Question 18:

  If a hard disk fails on a FortiAnalyzer that supports software RAID, what should you do to bring the FortiAnalyzer back to functioning normally, without losing data?

  A. Hot swap the disk

  B. Replace the disk and rebuild the RAID manually

  C. Take no action if the RAID level supports a failed disk

  D. Shut down FortiAnalyzer and replace the disk

  Correct Answer: D

  https://kb.fortinet.com/kb/documentLink.do?externalID=FD46446#:~:text=On%20FortiAnaly zer%2FFortiManager%20devices%20that,to%20exchanging%20the%20hard%20disk.

  If a hard disk on a FortiAnalyzer unit fails, it must be replaced. On FortiAnalyzer devices that support hardware RAID, the hard disk can be replaced while the unit is still running ?known as hot swapping. On FortiAnalyzer units with software RAID, the device must be shutdown prior to exchanging the hard disk.

  Reference: https://community.fortinet.com/t5/FortiAnalyzer/Technical-Note-How-to-swap- Hard-Disk-on-FortiAnalyzer/tap/194997?externalID=FD41397#:~:text=If%20a%20hard%20disk%20on,process%20know n%20as%20hot%20swapping

• Question 19:

  Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally? (Choose two.)

  A. Mail server

  B. Output profile

  C. SFTP server

  D. Report scheduling

  Correct Answer: AB

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.0.2/administration- guide/598322/creating-output-profiles

• Question 20:

  Refer to the exhibit.

  

  Which statement is correct regarding the event displayed?

  A. The security risk was blocked or dropped.

  B. The security event risk is considered open.

  C. An incident was created from this event.

  D. The risk source is isolated.

  Correct Answer: A

  Events in FortiAnalyzer will be in one of four statuses. The current status will determine if more actions need to be taken by the security team or not.

  The possible statuses are:

  Unhandled: The security event risk is not mitigated or contained, so it is considered open.

  Contained: The risk source is isolated.

  Mitigated: The security risk is mitigated by being blocked or dropped.

  (Blank): Other scenarios.

  FortiAnalyzer_7.0_Study_Guide-Online pag. 206