Fortinet NSE5_FAZ-6.4 Free Practice Questions

NEW QUESTION 1
Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?

• A. Antivirus logs
• B. Web filter logs
• C. IPS logs
• D. Application control logs

Answer: B

NEW QUESTION 2
Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

• A. Log upload
• B. Indicators of Compromise
• C. Log forwarding an aggregation mode
• D. Log fetching

Answer: D

Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.0/administration-guide/651442/fetcher-management

NEW QUESTION 3
Which two methods are the most common methods to control and restrict administrative access on FortiAnalyzer? (Choose two.)

• A. Virtual domains
• B. Administrative access profiles
• C. Trusted hosts
• D. Security Fabric

Answer: BC

NEW QUESTION 4
How does FortiAnalyzer retrieve specific log data from the database?

• A. SQL FROM statement
• B. SQL GET statement
• C. SQL SELECT statement
• D. SQL EXTRACT statement

Answer: A

Explanation:
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/137bb60e-ff37-11e8-8524-f8bc1258b8

NEW QUESTION 5
Which clause is considered mandatory in SELECT statements used by the FortiAnalyzer to generate reports?

• A. FROM
• B. LIMIT
• C. WHERE
• D. ORDER BY

Answer: A

NEW QUESTION 6
What is the purpose of employing RAID with FortiAnalyzer?

• A. To introduce redundancy to your log data
• B. To provide data separation between ADOMs
• C. To separate analytical and archive data
• D. To back up your logs

Answer: A

Explanation:
https://en.wikipedia.org/wiki/RAID#:~:text=RAID ("Redundant Array of Inexpensive,,%

NEW QUESTION 7
Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

• A. SSL is the default setting.
• B. SSL communications are auto-negotiated between the two devices.
• C. SSL can send logs in real-time only.
• D. SSL encryption levels are globally set on FortiAnalyzer.
• E. FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.

Answer: AD

NEW QUESTION 8
An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.
What should the administrator do to solve this issue?

• A. Use the execute sql-local rebuild-db command to rebuild all ADOM databases.
• B. Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.
• C. Use the execute sql-report run ADOM1 command to run a report.
• D. Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

Answer: B

NEW QUESTION 9
Logs are being deleted from one of your ADOMs earlier that the configured setting for archiving in your data policy. What is the most likely problem?

• A. The total disk space is insufficient and you need to add other disk.
• B. CPU resources are too high.
• C. The ADOM disk quota is set too low based on log rates.
• D. Logs in that ADOM are being forwarded in real-time to another FortiAnalyzer device.

Answer: C

Explanation:
https://help.fortinet.com/fmgr/50hlp/56/5-6-1/FMG FAZ/1100_Storage/0017_Deleted device logs.htm https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/87802/automatic-deletion

NEW QUESTION 10
What can the CLI command # diagnose test application oftpd 3 help you to determine?

• A. What devices and IP addresses are connecting to FortiAnalyzer
• B. What logs, if any, are reaching FortiAnalyzer
• C. What ADOMs are enabled and configured
• D. What devices are registered and unregistered

Answer: A

Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/cli-reference/395556/test#test_application

NEW QUESTION 11
An administrator has moved FortiGate A from the root ADOM to ADOM1. Which two statements are true regarding logs? (Choose two.)

• A. Analytics logs will be moved to ADOM1 from the root ADOM automatically.
• B. Archived logs will be moved to ADOM1 from the root ADOM automatically.
• C. Logs will be presented in both ADOMs immediately after the move.
• D. Analytics logs will be moved to ADOM1 from the root ADOM after you rebuild the ADOM1 SQL database.

Answer: BC

NEW QUESTION 12
View the exhibit.

Why is the total quota less than the total system storage?

• A. 3.6% of the system storage is already being used.
• B. Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files
• C. The oftpd process has not archived the logs yet
• D. The logfiled process is just estimating the total quota

Answer: B

Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/368682/disk-space-allocation

NEW QUESTION 13
If you upgrade the FortiAnalyzer firmware, which report element can be affected?

• A. Custom datasets
• B. Report scheduling
• C. Report settings
• D. Output profiles

Answer: B

Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/upgrade-guide/669300/checking-reports

NEW QUESTION 14
What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?

• A. Log correlation
• B. Host name resolution
• C. Log collection
• D. Real-time forwarding

Answer: C

NEW QUESTION 15
Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

• A. ADOMs are enabled by default.
• B. ADOMs constrain other administrator’s access privileges to a subset of devices in the device list.
• C. Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM.
• D. All administrators can create ADOMs--not just the admin administrator.

Answer: BC

NEW QUESTION 16
By default, what happens when a log file reaches its maximum file size?

• A. FortiAnalyzer overwrites the log files.
• B. FortiAnalyzer stops logging.
• C. FortiAnalyzer rolls the active log by renaming the file.
• D. FortiAnalyzer forwards logs to syslog.

Answer: C

NEW QUESTION 17
For which two SAML roles can the FortiAnalyzer be configured? (Choose two.)

• A. Principal
• B. Service provider
• C. Identity collector
• D. Identity provider

Answer: BD

NEW QUESTION 18
Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)

• A. SMS
• B. Email
• C. SNMP
• D. IM

Answer: BC

NEW QUESTION 19
......