NSE5_FAZ-7.2 Practice Questions Preview

Question 1

Single choice

Why must you wait for several minutes before you run a playbook that you just created?

A
FortiAnalyzer needs that time to parse the new playbook.
B
FortiAnalyzer needs that time to back up the current playbooks.
C
FortiAnalyzer needs that time to ensure there are no other playbooks running.
D
FortiAnalyzer needs that time to debug the new playbook.

Reveal answer details Close answer details

Correct answerB

Question 2

Multiple choice

FortiAnalyzer centralizes which functions? (Choose three)

A
Network analysis
B
Graphical reporting
C
Content archiving / data mining
D
Vulnerability assessment
E
Security log analysis / forensics

Reveal answer details Close answer details

Correct answersB, C, E

Question 3

Multiple choice

Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

A
A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with the same FortiAnalyzer devices at the other end.
B
Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.
C
Log fetching allows the administrator to fetch analytics logs from another FortiAnalyzer for redundancy.
D
Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

Reveal answer details Close answer details

Correct answersB, D

Question 4

Multiple choice

When you perform a system backup, what does the backup configuration contain? (Choose two.)

A
Generated reports
B
Device list
C
Authorized devices logs
D
System information

Reveal answer details Close answer details

Correct answersB, D

Question 5

Single choice

What is the purpose of the following CLI command?

A
To add a log file checksum
B
To add the MD's hash value and authentication code
C
To add a unique tag to each log to prove that it came from this FortiAnalyzer
D
To encrypt log communications

Reveal answer details Close answer details

Correct answerA

Question 6

Multiple choice

What are the operating modes of FortiAnalyzer? (Choose two)

A
Standalone
B
Manager
C
Analyzer
D
Collector

Reveal answer details Close answer details

Correct answersC, D

Question 7

Single choice

By default, what happens when a log file reaches its maximum file size?

A
FortiAnalyzer overwrites the log files.
B
FortiAnalyzer stops logging.
C
FortiAnalyzer rolls the active log by renaming the file.
D
FortiAnalyzer forwards logs to syslog.

Reveal answer details Close answer details

Correct answerC

Question 8

Single choice

Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?

A
Antivirus logs
B
Web filter logs
C
IPS logs
D
Application control logs

Reveal answer details Close answer details

Correct answerB

Question 9

Single choice

What is the recommended method of expanding disk space on a FortiAnalyzer VM?

A
From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk
number> command to expand the storage
B
From the VM host manager, expand the size of the existing virtual disk
C
From the VM host manager, expand the size of the existing virtual disk and use the # execute format disk command to reformat the disk
D
From the VM host manager, add an additional virtual disk and rebuild your RAID array

Reveal answer details Close answer details

Correct answerA

Question 10

Single choice

If a hard disk fails on a FortiAnalyzer that supports software RAID, what should you do to bring the FortiAnalyzer back to functioning normally, without losing data?

A
Hot swap the disk
B
Replace the disk and rebuild the RAID manually
C
Take no action if the RAID level supports a failed disk
D
Shut down FortiAnalyzer and replace the disk

Reveal answer details Close answer details

Correct answerD

Question 11

Single choice

Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

A
Log upload
B
Indicators of Compromise
C
Log forwarding an aggregation mode
D
Log fetching

Reveal answer details Close answer details

Correct answerD

Question 12

Single choice

Refer to the exhibit.

The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster.

What can you conclude from the configuration displayed?

A
This FortiAnalyzer will join to the existing HA cluster as the primary.
B
This FortiAnalyzer is configured to receive logs in its port1.
C
This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.
D
After joining to the cluster, this FortiAnalyzer will keep an updated log database.

Reveal answer details Close answer details

Correct answerB

Question 13

Single choice

Consider the CLI command:

What is the purpose of the command?

A
To add a unique tag to each log to prove that it came from this FortiAnalyzer
B
To add the MD5 hash value and authentication code
C
To add a log file checksum
D
To encrypt log communications

Reveal answer details Close answer details

Correct answerC

Question 14

Multiple choice

After generating a report, you notice the information you were expecting to see is not included in it.

What are two possible reasons for this scenario? (Choose two.)

A
You enabled auto-cache with extended log filtering.
B
The logfiled service has not indexed all the expected logs.
C
The logs were overwritten by the data retention policy.
D
The time frame selected in the report is wrong.

Reveal answer details Close answer details

Correct answersB, C

Question 15

Single choice

Refer to the exhibit.

What does the data point at 12:20 indicate?

A
The performance of FortiAnalyzer is below the baseline.
B
FortiAnalyzer is using its cache to avoid dropping logs.
C
The log insert lag time is increasing.
D
The sqlplugind service is caught up with new logs.

Reveal answer details Close answer details

Correct answerD

Question 16

Multiple choice

Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

A
ADOMs are enabled by default.
B
ADOMs constrain other administrator's access privileges to a subset of devices in the device list.
C
Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per
ADOM.
D
All administrators can create ADOMs--not just the admin administrator.

Reveal answer details Close answer details

Correct answersB, C

Question 17

Single choice

What can the CLI command # diagnose test application oftpd 3 help you to determine?

A
What devices and IP addresses are connecting to FortiAnalyzer
B
What logs, if any, are reaching FortiAnalyzer
C
What ADOMs are enabled and configured
D
What devices are registered and unregistered

Reveal answer details Close answer details

Correct answerA

Question 18

Multiple choice

What remote authentication servers can you configure to validate your FortiAnalyzer administrator logons? (Choose three)

A
RADIUS
B
Local
C
LDAP
D
PKI
E
TACACS+

Reveal answer details Close answer details

Correct answersA, C, E

Question 19

Single choice

How do you restrict an administrator's access to a subset of your organization's ADOMs?

A
Set the ADOM mode toAdvanced
B
Assign the ADOMs to the administrator's account
C
Configure trusted hosts
D
Assign the defaultSuper_Useradministrator profile

Reveal answer details Close answer details

Correct answerB

Question 20

Single choice

View the exhibit:

What does the 1000MB maximum for disk utilization refer to?

A
The disk quota for the FortiAnalyzer model
B
The disk quota for all devices in the ADOM
C
The disk quota for each device in the ADOM
D
The disk quota for the ADOM type

Reveal answer details Close answer details

Correct answerB

Question 21

Single choice

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

A
Hot swap the disk.
B
There is no need to do anything because the disk will self-recover.
C
Run execute format disk to format and restart the FortiAnalyzer device.
D
Shut down FortiAnalyzer and replace the disk

Reveal answer details Close answer details

Correct answerA