Fortinet NSE5_FAZ-7.0 Online Practice Questions and Exam Preparation

Fortinet NSE5_FAZ-7.0 Online Questions & Answers

• Question 51:

  An administrator has configured the following settings:

  config system fortiview settings set resolve-ip enable end

  What is the significance of executing this command?

  A. Use this command only if the source IP addresses are not resolved on FortiGate.
  B. It resolves the source and destination IP addresses to a hostname in FortiView on FortiAnalyzer.
  C. You must configure local DNS servers on FortiGate for this command to resolve IP addresses on Forti Analyzer.
  D. It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.
  D. It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.

  ---

  Reference: https://community.fortinet.com/t5/Fortinet-Forum/Hostnames-in- FortiAnalyzer/m-p/95351?m=156950

• Question 52:

  What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

  A. Hot swap the disk.
  B. There is no need to do anything because the disk will self-recover.
  C. Run execute format disk to format and restart the FortiAnalyzer device.
  D. Shut down FortiAnalyzer and replace the disk
  A. Hot swap the disk.

  ---

  Hardware RAID not software

• Question 53:

  An administrator fortinet, is able to view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mall server that can be used to send email. What could be the problem?

  A. Fortinet is assigned the Standard_ User administrator profile.
  B. A trusted host is configured.
  C. ADOM mode is configured with Advanced mode.
  D. Fortinet is assigned the Restricted_ User administrator profile.
  A. Fortinet is assigned the Standard_ User administrator profile.

  ---

• Question 54:

  Refer to the exhibits.

  

  Page 306 of 7.0 study guide Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-2/FMG- FAZ/2300_Reports/0025_Auto-cache.htm

  How many events will be added to the incident created after running this playbook?

  A. Ten events will be added.
  B. No events will be added.
  C. Five events will be added.
  D. Thirteen events will be added.
  C. Five events will be added.

• Question 55:

  Which tabs do not appear when FortiAnalyzer is operating in Collector mode?

  A. FortiView
  B. Event Management
  C. Device Manger
  D. Reporting
  A. FortiView
  D. Reporting

• Question 56:

  Which two purposes does the auto cache setting on reports serve? (Choose two.)

  A. It automatically updates the hcache when new logs arrive.
  B. It provides diagnostics on report generation time.
  C. It reduces the log insert lag rate.
  D. It reduces report generation time.
  A. It automatically updates the hcache when new logs arrive.
  D. It reduces report generation time.

  ---

  Reference: https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/384416/how- auto-cache-works https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/86926/enabling- auto-cache

• Question 57:

  Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

  A. Log fetching allows the administrator to fetch analytics logs from another FortiAnalyzer for redundancy.
  B. A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with the same FortiAnalyzer devices at the other end.
  C. Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.
  D. Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.
  C. Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.
  D. Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

  ---

  Using FortiAnalyzer, you can enable log fetching. This allows FortiAnalyzer to fetch the archived logs of specified devices from another FortiAnalyzer, which you can then run queries or reports on for forensic analysis.

  The FortiAnalyzer device that fetches logs operates as the fetch client, and the other FortiAnalyzer device that sends logs operates as the fetch server. Log fetching can happen only between two FortiAnalyzer devices, and both of them must be running the same firmware version. A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with different FortiAnalyzer devices at the other end. FortiAnalyzer_7.0_Study_Guide-Online pag. 168

• Question 58:

  You crested a playbook on FortiAnalyzer that uses a FortiOS connector

  When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

  A. FortiAnalyzer Event Handler
  B. Incoming webhook
  C. FortiOS Event Log
  D. Fabric Connector event
  B. Incoming webhook

  ---

  "One possible scenario is shown on the slide:

  1.

  Traffic flows through the FortiGate

  2.

  FortiGate sends logs to FortiAnalyzer

  3.

  FortiAnalyzer detects some suspicious traffic and generates an event

  4.

  The event triggers the execution of a playbook in FortiAnalyzer, which sends a webhook call to FortiGate so that it runs an automation stitch

  5.

  FortiGate runs the automation stitch with the corrective or preventive actions"

• Question 59:

  Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)

  A. SMS
  B. Email
  C. SNMP
  D. IM
  B. Email
  C. SNMP

  ---

  Reference: https://help.fortinet.com/fa/faz50hlp/60/6-0-2/Content/FortiAnalyzer_Admin_Guide/1800_Events/0200_Event_handlers/0600_Create_event_han dlers.htm Reference: https://help.fortinet.com/fa/faz50hlp/60/6-0- 2/Content/FortiAnalyzer_Admin_Guide/1800_Events/0200_Event_handlers/0600_Create_e vent_handlers.htm

• Question 60:

  A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer. What can you do on FortiAnalyzer to accomplish this?

  A. Click FortiView and generate a report for that administrator.
  B. Click Task Monitor and view the tasks performed by that administrator.
  C. Click Log View and generate a report for that administrator.
  D. View the tasks performed by the rogue administrator in Fabric View.
  A. Click FortiView and generate a report for that administrator.

  ---

  Reference: https://docs.fortinet.com/document/fortimanager/6.4.1/administration- guide/792943/task-monitor