Which two statements about high availability (HA) on FortiAnalyzer are true? (Choose two.)

FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

FortiAnalyzer HA active-passive mode can function without VRRP.

All devices in a FortiAnalyzer HA cluster must run in the same operation mode, either analyzer mode or collector mode.

All devices in a FortiAnalyzer HA cluster must have the same available disk space.

An administrator has moved a FortiGate device from the root ADOM to ADOM1.Which two statements are true regarding logs? (Choose two.)

Analytics logs will be moved to ADOM1 from the root ADOM automatically.

Analytics logs will be moved to ADOM1 from the root ADOM after you rebuild the database.

Analytics logs will be moved to ADOM1 from the root ADOM automatically.

Archived logs will be moved to ADOM1 from the root ADOM automatically.

Logs will be present in both ADOMs immediately after the move.

Analytics logs will be moved to ADOM1 from the root ADOM after you rebuild the database.

What is the purpose of the FortiAnalyzer command diagnose system print netstat?

It provides network statistics for active connections, including the protocols, IP addresses, and connection states.

It provides the complete routing table, including directly connected routes.

It provides the static DNS table, including the host names and their expiration timers.

It provides NTP server information, including server IPs. stratum, poll time, and latency.

What are offline logs on FortiAnalyzer?

Any logs collected from offline devices after they boot up

Compressed logs, also known as archive logs

Logs that are indexed and stored in the SQL database

Any logs collected from offline devices after they boot up

Real-time logs that are not yet indexed

Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate on FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

A local wildcard administrator account

One or more remote LDAP servers

A local wildcard administrator account

One or more remote LDAP servers

LDAP servers IP addresses added as trusted hosts

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

Perform a hot swap of the disk.

There is no need to do anything because the disk will self-recover.

Run execute format disk to format and restart the FortiAnalyzer device.

Perform a hot swap of the disk.

Shut down FortiAnalyzer and replace the disk.

In a Fortinet Security Fabric, what can make an upstream FortiGate create traffic logs associated with sessions initiated on downstream FortiGate devices?

The upstream FortiGate is configured to do NAT

The traffic destination is another FortiGate in the fabric.

The upstream FortiGate is configured to do NAT

Log redundancy is configured in the fabric.

The downstream device cannot connect to FortiAnalyzer.

You finished registering a FortiGate device. After traffic starts to flow through FortiGate, you notice that only some of the logs expected are being received on FortiAnalyzer.What could be the reason for the logs not arriving on FortiAnalyzer?

FortiGate does not have logging configured correctly.

FortiGate was added to the wrong ADOM type.

This FortiGate model is not fully supported.

FortiGate does not have logging configured correctly.

This FortiGate is part of an HA cluster but it is the secondary device.

Refer to the exhibit. The exhibit shows the creation of a new administrator on FortiAnalyzer.What are two effects of enabling the choice Match all users on remote server when configuring a new administrator? (Choose two.)

It creates a wildcard administrator using an LDAP server.

Administrators can log in to FortiAnalyzer using their credentials on the remote LDAP server.

It allows user accounts in the LDAP server to use two-factor authentication.

It creates a wildcard administrator using an LDAP server.

User Remote-Admin from the LDAP server will be able to log in to FortiAnalyzer at any time.

Administrators can log in to FortiAnalyzer using their credentials on the remote LDAP server.

You are trying to initiate an authorization request from FortiGate to FortiAnalyzer, but the Security Fabric window does not open when you click Authorize.Which two reasons can cause this to happen? (Choose two.)

The management computer does not have connectivity to the authorization IP address and port combination.

The fabric authorization settings on FortiAnalyzer are misconfigured.

A pre-shared key needs to be established on both sides.

The management computer does not have connectivity to the authorization IP address and port combination.

The Security Fabric root is unauthorized and needs to be added as a trusted host.

The fabric authorization settings on FortiAnalyzer are misconfigured.

Which statement correctly describes RAID 10 (1+0) on FortiAnalyzer?

A configuration with four disks, each with 2 TB of capacity, provides a total space of 4 TB.

11 combines mirroring striping and distributed parity to provide performance and fault tolerance

A configuration with four disks, each with 2 TB of capacity, provides a total space of 2 TB.

It uses striping to provide performance and fault tolerance.

Which two statements about deleting ADOMs are true? (Choose two.)

ADOMs with registered devices cannot be deleted.

Logs must be purged or migrated before you can delete an ADOM.

ADOMs with registered devices cannot be deleted.

Default ADOMs cannot be deleted.

The status of the ADOMs must be unlocked.

Refer to the exhibit. The capture displayed was taken on a FortiAnalyzer.Why is a single IP address shown as the source for all logs received?

FortiAnalyzer is receiving logs from the root FortiGate of a Security Fabric.

FortiAnalyzer is using the device MAC addresses to differentiate their logs.

The logs belong to devices that are part of a high availability (HA) cluster.

FortiAnalyzer is receiving logs from the root FortiGate of a Security Fabric.

The device sending logs has two VDOMs in the same ADOM.

An administrator, fortinet, can view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mail server that can be used to send alert emails.What can be the problem?

fortinet is assigned the default Standard_User administrative profile.

ADOM mode is configured with Advanced mode.

fortinet is assigned the default Standard_User administrative profile.

fortinet is assigned the default Restricted_User administrative profile.

Which statement about the communication between FortiGate high availability (HA) clusters and FortiAnalyzer is true?

FortiAnalyzer distinguishes each cluster member by the IP addresses in log message headers.

If devices were registered to FortiAnalyzer before forming a cluster, you can manually add them together.

FortiAnalyzer distinguishes each cluster member by the IP addresses in log message headers.

If the HA primary device becomes unavailable, you must remove it from the HA cluster list on FortiAnalyzer.

The FortiGate HA cluster must be in active-passive mode in order to avoid conflict.

Which two methods can you use to restrict administrative access on FortiAnalyzer? (Choose two.)

Limit access to specific virtual domains.

Fabric connectors to external LDAP servers.

Which two statements regarding FortiAnalyzer log forwarding modes are true? (Choose two.)

Both modes, forwarding and aggregation, support encryption of logs between devices.

Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

Both modes, forwarding and aggregation, support encryption of logs between devices.

In aggregation mode, you can forward logs to syslog and CEF servers.

Forwarding mode forwards logs in real time only to other FortiAnalyzer devices.

Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

Refer to the exhibit. Based on the partial outputs displayed, which devices can be members of a FortiAnalyzer Fabric?

FortiAnalyzer1 and FortiAnalyzer2

FortiAnalyzer1 and FortiAnalyzer3

All devices listed can be members.

FortiAnalyzer1 and FortiAnalyzer2

FortiAnalyzer2 and FortiAnalyzer3

Which two statements about FortiAnalyzer operating modes are true? (Choose two.)

When in analyzer mode, FortiAnalyzer supports event management and reporting features.

When in collector mode, FortiAnalyzer offloads the log receiving task to the analyzer.

When in analyzer mode, FortiAnalyzer supports event management and reporting features.

For the collector, you should allocate most of the disk space to analytics logs.

Analyzer mode is the default operating mode.

Refer to the exhibit. Based on the output, what can you conclude about the FortiAnalyzer logging status?

FortiGate has logs to send, but FortiAnalyzer is unavailable.

The connection between FortiGate and FortiAnalyzer is overloaded.

FortiGate has logs to send, but FortiAnalyzer is unavailable.

FortiGate is configured to send logs in batches.

FortiGate is sending logs again after it performed a reboot.

An administrator has configured the following settings: What is the purpose of executing these commands?

To record the hash value and authentication code of log files.

To encrypt log transfer between FortiAnalyzer and other devices.

To create the secure channel used by the OFTP process.

To verify the integrity of the log files received.

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

Perform a hot swap of the disk.

There is no need to do anything because the disk will self-recover.

Run execute format disk to format and restart the FortiAnalyzer device.

Perform a hot swap of the disk.

Shut down FortiAnalyzer and replace the disk.

Which statement when you are upgrading the firmware on an HA cluster made up of three FortiAnalyzer devices is true?

First, upgrade the secondary devices, and then upgrade the primary device.

You can perform the firmware upgrade using only a console connection.

All FortiAnalyzer devices will be upgraded at the same time.

Enabling uninterruptible-upgrade prevents normal operations from being interrupted during the upgrade.

First, upgrade the secondary devices, and then upgrade the primary device.

Refer to the exhibit. The exhibit shows the creation of a new administrator on FortiAnalyzer. The new account uses the credentials stored on an LDAP server.Why would an administrator configure a password for this account?

This password is used if the authentication server becomes unreachable.

This password authenticates FortiAnalyzer aqainst the LDAP server.

This password is set to comply with FortiAnalvzer password policy

This password is required because this is a restricted user.

Refer to the exhibit, which shows the HA configuration settings of a FortiAnalyzer device. The administrator wants to join this FortiAnalyzer to an existing HA cluster. What can you conclude from the configuration displayed?

This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.

After joining the cluster, this FortiAnalyzer will forward received logs to its peers.

This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.

This FortiAnalyzer is configured to route HA traffic through a gateway.

This FortiAnalyzer will join the existing HA cluster as the secondary.

What does the disk status Degraded mean for RAID management?

One or more drives are missing from the FortiAnalyzer unit.

The hard drive is no longer being used by the RAID controller.

One or more drives are missing from the FortiAnalyzer unit.

The device is writing data to the disk to restore the volume to an optimal state.

FortiAnalyzer determined that the parity data in the disk is not valid.

The connection status of a new device on FortiAnalyzer is listed as Unauthorized.What does that status mean?

It is a device whose registration has not yet been accepted in FortiAnalvzer.

It is a device that has not yet been assigned an ADOM.

It is a device that is waiting for you to configure a pre-shared key.

It is a device that FortiAnalvzer does not support.

Which two statements regarding ADOM modes are true? (Choose two.)

In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advanced mode, the disk quota of the ADOM is flexible.

You can change ADOM modes only through the CLI.

In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

Which statements are correct regarding FortiAnalyzer reports? (Choose two)

FortiAnalyzer provides the ability to create custom reports.

FortiAnalyzer glows you to schedule reports to run.

FortiAnalyzer provides the ability to create custom reports.

FortiAnalyzer glows you to schedule reports to run.

FortiAnalyzer includes pre-defined reports only.

FortiAnalyzer allows reporting for FortiGate devices only.

What can you do on FortiAnalyzer to restrict administrative access from specific locations?

Configure trusted hosts for that administrator.

Enable geo-location services on accessible interface.

Configure two-factor authentication with a remote RADIUS server.

Configure an ADOM for respective location.

Fortinet FCP_FAZ_AD-7.4 Practice Test 1 - Free Online Exam Prep & Questions

Which three RAID configurations provide fault tolerance on FortiAnalyzer? (Choose three.)

A.

RAIDO

B.

RAID 5

C.

RAID1

D.

RAID 6+0

E.

RAID 0+0

Fortinet FCP_FAZ_AD-7.4 Practice Test 1

Question

Fortinet FCP_FAZ_AD-7.4 Practice Tests

Practice Tests