VCEdump

NSE5_FAZ-7.0 Fortinet NSE 5 - FortiAnalyzer 7.0

PDF question preview Back to product

Free preview

18 sample questions

The complete product contains 114 questions.

Question formats

Single choice15

Multiple choice3

Compare study plans

Fortinet · NSE5_FAZ-7.0

NSE5_FAZ-7.0 questions and answers

Review the question wording, option layout, and available explanations before choosing a study plan.

Question 1

Single choice

After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the

purpose of running the following CLI command?

execute sql-local rebuild-adom <new-ADOM-name>

A
To reset the disk quota enforcement to default
B
To remove the analytics logs of the device from the old database
C
To migrate the archive logs to the new ADOM
D
To populate the new ADOM with analytical logs for the moved device, so you can run reports

Question 2

Single choice

What is the recommended method of expanding disk space on a FortiAnalyzer VM?

A
From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk
number> command to expand the storage
B
From the VM host manager, expand the size of the existing virtual disk
C
From the VM host manager, expand the size of the existing virtual disk and use the # execute format disk command to reformat the disk
D
From the VM host manager, add an additional virtual disk and rebuild your RAID array

Question 3

Multiple choice

Which two purposes does the auto cache setting on reports serve? (Choose two.)

A
It automatically updates the hcache when new logs arrive.
B
It provides diagnostics on report generation time.
C
It reduces the log insert lag rate.
D
It reduces report generation time.

Question 4

Single choice

You crested a playbook on FortiAnalyzer that uses a FortiOS connector

When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

A
FortiAnalyzer Event Handler
B
Incoming webhook
C
FortiOS Event Log
D
Fabric Connector event

Question 5

Single choice

Which daemon is responsible for enforcing raw log file size?

A
logfiled
B
oftpd
C
sqlplugind
D
miglogd

Question 6

Single choice

On FortiAnalyzer, what is a wildcard administrator account?

A
An account that permits access to members of an LDAP group
B
An account that allows guest access with read-only privileges
C
An account that requires two-factor authentication
D
An account that validates against any user account on a FortiAuthenticator

Question 7

Multiple choice

What purposes does the auto-cache setting on reports serve? (Choose two.)

A
To reduce report generation time
B
To automatically update the hcache when new logs arrive
C
To reduce the log insert lag rate
D
To provide diagnostics on report generation time

Question 8

Single choice

You've moved a registered logging device out of one ADOM and into a new ADOM.

What happens when you rebuild the new ADOM database?

A
FortiAnalyzer resets the disk quota of the new ADOM to default.
B
FortiAnalyzer migrates archive logs to the new ADOM.
C
FortiAnalyzer migrates analytics logs to the new ADOM.
D
FortiAnalyzer removes logs from the old ADOM.

Question 9

Single choice

If you upgrade your FortiAnalyzer firmware, what report elements can be affected?

A
Output profiles
B
Report settings
C
Report scheduling
D
Custom datasets

Question 10

Multiple choice

Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

A
Log fetching allows the administrator to fetch analytics logs from another FortiAnalyzer for redundancy.
B
A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with the same FortiAnalyzer devices at the other end.
C
Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.
D
Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

Question 11

Single choice

What FortiView tool can you use to automatically build a dataset and chart based on a filtered search result?

A
Chart Builder
B
Export to Report Chart
C
Dataset Library
D
Custom View

Question 12

Single choice

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

A
Hot swap the disk.
B
There is no need to do anything because the disk will self-recover.
C
Run execute format disk to format and restart the FortiAnalyzer device.
D
Shut down FortiAnalyzer and replace the disk

Question 13

Single choice

Refer to the exhibit.

Which statement is correct regarding the event displayed?

A
The security risk was blocked or dropped.
B
The security event risk is considered open.
C
An incident was created from this event.
D
The risk source is isolated.

Question 14

Single choice

How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

A
Use static routes
B
Use administrative profiles
C
Use trusted hosts
D
Use secure protocols

Question 15

Single choice

In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.

How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?

A
Resolve IP addresses on a per-ADOM basis to reduce delay on FortiView while IPs resolve
B
Configure # set resolve-ip enable in the system FortiView settings
C
Configure local DNS servers on FortiAnalyzer
D
Resolve IP addresses on FortiGate

Question 16

Single choice

You have recently grouped multiple FortiGate devices into a single ADOM. System Settings > Storage Info
shows the quota used.

What does the disk quota refer to?

A
The maximum disk utilization for each device in the ADOM
B
The maximum disk utilization for the FortiAnalyzer model
C
The maximum disk utilization for the ADOM type
D
The maximum disk utilization for all devices in the ADOM

Question 17

Single choice

What FortiGate process caches logs when FortiAnalyzer is not reachable?

A
logfiled
B
sqlplugind
C
oftpd
D
miglogd

Question 18

Single choice

For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

A
Use DNS
B
Use host name resolution
C
Use real-time forwarding
D
Use an NTP server