NSE5_FAZ-6.4 Practice Questions Preview

Question 1

Single choice

Which clause is considered mandatory in SELECT statements used by the FortiAnalyzer to generate reports?

A
FROM
B
LIMIT
C
WHERE
D
ORDER BY

Reveal answer details Close answer details

Correct answerA

Explanation

https://kb.fortinet.com/kb/documentLink.do?externalID=FD48500

Question 2

Single choice

An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.

What should the administrator do to solve this issue?

A
Use the execute sql-local rebuild-db command to rebuild all ADOM databases.
B
Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.
C
Use the execute sql-report run ADOM1 command to run a report.
D
Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://help.fortinet.com/fmgr/cli/5-6-1/FortiManager_CLI_Reference/700_execute/sql-local
+.htm

Question 3

Multiple choice

Which two statements are true regarding high availability (HA) on FortiAnalyzer? (Choose two.)

A
FortiAnalyzer HA can function without VRRP. and VRRP is required only if you have more than two FortiAnalyzer devices in a cluster.
B
FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.
C
All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector.
D
FortiAnalyzer HA implementation is supported by many public cloud infrastructures such as AWS, Microsoft Azure, and Google Cloud.

Reveal answer details Close answer details

Correct answersB, C

Explanation

References:
https://help.fortinet.com/fa/faz50hlp/60/6-0-2/Content/FMG-FAZ/4600_HA/0000_HA.htm?TocPath=High%20Availability%7C_____0

Question 4

Single choice

You've moved a registered logging device out of one ADOM and into a new ADOM.

What happens when you rebuild the new ADOM database?

A
FortiAnalyzer resets the disk quota of the new ADOM to default.
B
FortiAnalyzer migrates archive logs to the new ADOM.
C
FortiAnalyzer migrates analytics logs to the new ADOM.
D
FortiAnalyzer removes logs from the old ADOM.

Reveal answer details Close answer details

Correct answerC

Explanation

https://kb.fortinet.com/kb/documentLink.do?externalID=FD40383

Question 5

Single choice

Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

A
Must configure the FortiAnalyzer end of the tunnel only--the FortiGate end is auto-negotiated.
B
Must establish an IPsec tunnel ID and pre-shared key.
C
IPsec cannot be enabled if SSL is enabled as well.
D
IPsec is only enabled through the CLI on FortiAnalyzer.

Reveal answer details Close answer details

Correct answerC

Question 6

Single choice

Refer to the exhibit.

What does the data point at 14:55 tell you?

A
The received rate is almost at its maximum for this device
B
The sqlplugind daemon is behind in log indexing by two logs
C
Logs are being dropped
D
Raw logs are reaching FortiAnalyzer faster than they can be indexed

Reveal answer details Close answer details

Correct answerD

Question 7

Single choice

FortiAnalyzer uses the Optimized Fabric Transfer Protocok (OFTP) over SSL for what purpose?

A
To upload logs to an SFTP server
B
To prevent log modification during backup
C
To send an identical set of logs to a second logging server
D
To encrypt log communication between devices

Reveal answer details Close answer details

Correct answerD

Question 8

Single choice

View the exhibit.

Why is the total quota less than the total system storage?

A
3.6% of the system storage is already being used.
B
Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files
C
The oftpd process has not archived the logs yet
D
The logfiled process is just estimating the total quota

Reveal answer details Close answer details

Correct answerB

Explanation

https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/368682/disk-space-allocation

Question 9

Single choice

What are offline logs on FortiAnalyzer?

A
Compressed logs, which are also known as archive logs, are considered to be offline logs.
B
When you restart FortiAnalyzer. all stored logs are considered to be offline logs.
C
Logs that are indexed and stored in the SQL database.
D
Logs that are collected from offline devices after they boot up.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://help.fortinet.com/fa/faz50hlp/56/5-6-6/Content/FortiAnalyzer_Admin_Guide/0300_Key_concepts/0600_Log_Storage/0400_Archive_analytics_logs.htm

Question 10

Single choice

Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy.

What is the most likely problem?

A
CPU resources are too high
B
Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device
C
The total disk space is insufficient and you need to add other disk
D
The ADOM disk quota is set too low, based on log rates

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://help.fortinet.com/fmgr/50hlp/56/5-6-1/FMG-FAZ/1100_Storage/0017_Deleted%20device%20logs.htm

Question 11

Single choice

By default, what happens when a log file reaches its maximum file size?

A
FortiAnalyzer overwrites the log files.
B
FortiAnalyzer stops logging.
C
FortiAnalyzer rolls the active log by renaming the file.
D
FortiAnalyzer forwards logs to syslog.

Reveal answer details Close answer details

Correct answerC

Question 12

Multiple choice

Which two statements are true regarding ADOM modes? (Choose two.)

A
You can only change ADOM modes through CLI.
B
In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM.
C
In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.
D
Normal mode is the default ADOM mode.

Reveal answer details Close answer details

Correct answersC, D

Explanation

References:
https://help.fortinet.com/fa/faz50hlp/56/5-6-1/FMG-FAZ/0800_ADOMs/0400_ADOM%20Device%20Modes.htm

Question 13

Single choice

On FortiAnalyzer, what is a wildcard administrator account?

A
An account that permits access to members of an LDAP group
B
An account that allows guest access with read-only privileges
C
An account that requires two-factor authentication
D
An account that validates against any user account on a FortiAuthenticator

Reveal answer details Close answer details

Correct answerA

Explanation

https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/747268/configuring-wildcard-admin-accounts

Question 14

Single choice

FortiAnalyzer reports are dropping analytical data from 15 days ago, even though the data policy setting for analytics logs is 60 days.

What is the most likely problem?

A
Quota enforcement is acting on analytical data before a report is complete
B
Logs are rolling before the report is run
C
CPU resources are too high
D
Disk utilization for archive logs is set for 15 days

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://forum.fortinet.com/tm.aspx?m=138806

Question 15

Single choice

A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer.

What can you do on FortiAnalyzer to accomplish this?

A
Click FortiView and generate a report for that administrator.
B
Click Task Monitor and view the tasks performed by that administrator.
C
Click Log View and generate a report for that administrator.
D
View the tasks performed by the rogue administrator in Fabric View.

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://docs.fortinet.com/document/fortimanager/6.4.1/administration-guide/792943/task-monitor