Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy.What is the most likely problem?

The ADOM disk quota is set too low, based on log rates

Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device

The total disk space is insufficient and you need to add other disk

The ADOM disk quota is set too low, based on log rates

View the exhibit: What does the 1000MB maximum for disk utilization refer to?

The disk quota for all devices in the ADOM

The disk quota for the FortiAnalyzer model

The disk quota for all devices in the ADOM

The disk quota for each device in the ADOM

The disk quota for the ADOM type

You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?

FortiAnalyzer migrates analytics logs to the new ADOM.

FortiAnalyzer resets the disk quota of the new ADOM to default.

FortiAnalyzer migrates archive logs to the new ADOM.

FortiAnalyzer migrates analytics logs to the new ADOM.

FortiAnalyzer removes logs from the old ADOM.

What happens when a log file saved on FortiAnalyzer disks reaches the size specified in the device log settings?

The log file rolls over and is archived.

The log file is stored as a raw log and is available for analytic support.

The log file rolls over and is archived.

The log file is purged from the database.

What is the purpose of employing RAID with FortiAnalyzer?

To introduce redundancy to your log data

To provide data separation between ADOMs

To separate analytical and archive data

Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Log forwarding an aggregation mode

What is the recommended method of expanding disk space on a FortiAnalyzer VM?

From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage

From the VM host manager, expand the size of the existing virtual disk

From the VM host manager, expand the size of the existing virtual disk and use the # execute format disk command to reformat the disk

From the VM host manager, add an additional virtual disk and rebuild your RAID array

How are logs forwarded when FortiAnalyzer is using aggregation mode?

Logs and content files are stored and uploaded at a scheduled time.

Logs are forwarded as they are received and content files are uploaded at a scheduled time.

Logs and content files are stored and uploaded at a scheduled time.

Logs are forwarded as they are received.

Logs and content files are forwarded as they are received.

How do you restrict an administrator's access to a subset of your organization's ADOMs?

Assign the ADOMs to the administrator's account

Assign the default Super_User administrator profile

In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required?(Choose two.)

Remote logging must be enabled on FortiGate

FortiGate must be registered with FortiAnalyzer

Remote logging must be enabled on FortiGate

FortiGate must be registered with FortiAnalyzer

What can the CLI command # diagnose test application oftpd 3 help you to determine?

What devices and IP addresses are connecting to FortiAnalyzer

What logs, if any, are reaching FortiAnalyzer

What ADOMs are enabled and configured

What devices are registered and unregistered

Which statements are correct regarding FortiAnalyzer reports? (Choose two)

FortiAnalyzer provides the ability to create custom reports.

FortiAnalyzer glows you to schedule reports to run.

FortiAnalyzer provides the ability to create custom reports.

FortiAnalyzer glows you to schedule reports to run.

FortiAnalyzer includes pre-defined reports only.

FortiAnalyzer allows reporting for FortiGate devices only.

FortiAnalyzer centralizes which functions? (Choose three)

Content archiving / data mining

Security log analysis / forensics

Content archiving / data mining

Security log analysis / forensics

By default, what happens when a log file reaches its maximum file size?

FortiAnalyzer rolls the active log by renaming the file.

FortiAnalyzer overwrites the log files.

FortiAnalyzer rolls the active log by renaming the file.

FortiAnalyzer forwards logs to syslog.

Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

ADOMs constrain other administrator's access privileges to a subset of devices in the device list.

Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM.

ADOMs constrain other administrator's access privileges to a subset of devices in the device list.

Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM.

All administrators can create ADOMs--not just the admin administrator.

Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

SSL encryption levels are globally set on FortiAnalyzer.

SSL communications are auto-negotiated between the two devices.

SSL can send logs in real-time only.

SSL encryption levels are globally set on FortiAnalyzer.

FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.

Which two purposes does the auto cache setting on reports serve? (Choose two.)

It automatically updates the hcache when new logs arrive.

It reduces report generation time.

It automatically updates the hcache when new logs arrive.

It provides diagnostics on report generation time.

It reduces the log insert lag rate.

It reduces report generation time.

What are offline logs on FortiAnalyzer?

Compressed logs, which are also known as archive logs, are considered to be offline logs.

When you restart FortiAnalyzer. all stored logs are considered to be offline logs.

Logs that are indexed and stored in the SQL database.

Logs that are collected from offline devices after they boot up.

Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.

Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

A FortiAnalyzer device can perform either the fetch server or client role, and it can perform two roles at the same time with the same FortiAnalyzer devices at the other end.

Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version.

Log fetching allows the administrator to fetch analytics logs from another FortiAnalyzer for redundancy.

Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

An administrator has configured the following settings:config system fortiview settingsset resolve-ip enableendWhat is the significance of executing this command?

It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.

Use this command only if the source IP addresses are not resolved on FortiGate.

It resolves the source and destination IP addresses to a hostname in FortiView on FortiAnalyzer.

You must configure local DNS servers on FortiGate for this command to resolve IP addresses on Forti Analyzer.

It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.

Which two statements are true regarding ADOM modes? (Choose two.)

In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

You can only change ADOM modes through CLI.

In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM.

In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

Normal mode is the default ADOM mode.

Which two statements are true regarding FortiAnalyzer log forwarding? (Choose two.)

Both modes, forwarding and aggregation, support encryption of logs between devices.

Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

Both modes, forwarding and aggregation, support encryption of logs between devices.

In aggregation mode, you can forward logs to syslog and CEF servers as well.

Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

Forwarding mode forwards logs in real time only to other FortiAnalyzer devices.

An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.What should the administrator do to solve this issue?

Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.

Use the execute sql-local rebuild-db command to rebuild all ADOM databases.

Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.

Use the execute sql-report run ADOM1 command to run a report.

Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

Which statement is true regarding Macros on FortiAnalyzer?

Macros are ADOM specific and each ADOM will have unique macros relevant to that ADOM.

Macros are supported only on the FortiGate ADOM.

Macros are useful in generating excel log files automatically based on the reports settings.

Macros are predefined templates for reports and cannot be customized.

Which two statements are true regarding FortiAnalyzer operating modes? (Choose two.)

When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.

By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting

When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.

Collector mode is the default operating mode.

When in collector mode. FortiAnalyzer supports event management and reporting features.

By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting

Refer to the exhibit. The exhibit shows "remoteservergroup" is an authentication server group with LDAP and RADIUS servers.Which two statements express the significance of enabling "Match all users on remote server" when configuring a new administrator? (Choose two.)

It creates a wildcard administrator using LDAP and RADIUS servers.

Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.

It creates a wildcard administrator using LDAP and RADIUS servers.

Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.

Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.

It allows administrators to use two-factor authentication.

A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer.What can you do on FortiAnalyzer to accomplish this?

Click Task Monitor and view the tasks performed by that administrator.

Click FortiView and generate a report for that administrator.

Click Task Monitor and view the tasks performed by that administrator.

Click Log View and generate a report for that administrator.

View the tasks performed by the rogue administrator in Fabric View.

The admin administrator is failing to register a FortiClient EMS on the FortiAnalyzer device.What can be the reason for this failure?

ADOMs are not enabled on FortiAnalyzer.

FortiAnalyzer is in an HA cluster.

ADOM mode should be set to advanced, in order to register the FortiClient EMS device.

ADOMs are not enabled on FortiAnalyzer.

A separate license is required on FortiAnalyzer in order to register the FortiClient EMS device.

Refer to the exhibit. Which two statements are true regarding enabling auto-cache on FortiAnalyzer? (Choose two.)

This feature is automatically enabled for scheduled reports.

Enabling auto-cache reduces report generation time for reports that require a long time to assemble datasets.

Report size will be optimized to conserve disk space on FortiAnalyzer.

Reports will be cached in the memory.

This feature is automatically enabled for scheduled reports.

Enabling auto-cache reduces report generation time for reports that require a long time to assemble datasets.

Which two statements are true regarding high availability (HA) on FortiAnalyzer? (Choose two.)

FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector.

FortiAnalyzer HA can function without VRRP. and VRRP is required only if you have more than two FortiAnalyzer devices in a cluster.

FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector.

FortiAnalyzer HA implementation is supported by many public cloud infrastructures such as AWS, Microsoft Azure, and Google Cloud.

An administrator has moved FortiGate A from the root ADOM to ADOM1.Which two statements are true regarding logs? (Choose two.)

Archived logs will be moved to ADOM1 from the root ADOM automatically.

Analytics logs will be moved to ADOM1 from the root ADOM after you rebuild the ADOM1 SQL database.

Analytics logs will be moved to ADOM1 from the root ADOM automatically.

Archived logs will be moved to ADOM1 from the root ADOM automatically.

Logs will be presented in both ADOMs immediately after the move.

Analytics logs will be moved to ADOM1 from the root ADOM after you rebuild the ADOM1 SQL database.

Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer?(Choose two.)

Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

Make sure all endpoints are reachable by FortiAnalyzer.

Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.

Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

What can you do on FortiAnalyzer to restrict administrative access from specific locations?

Configure trusted hosts for that administrator.

Enable geo-location services on accessible interface.

Configure two-factor authentication with a remote RADIUS server.

Configure an ADOM for respective location.

An administrator fortinet, is able to view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mall server that can be used to send email.What could be the problem?

Fortinet is assigned the Standard_ User administrator profile.

ADOM mode is configured with Advanced mode.

Fortinet is assigned the Restricted_ User administrator profile.

Fortinet NSE5_FAZ-7.2 Practice Test 2 - Free Online Exam Prep & Questions

What is the purpose of a dataset query in FortiAnalyzer?

It sorts log data into tables

It extracts the database schema

It retrieves log data from the database

It injects log data into the database

Comment (0)

Fortinet NSE5_FAZ-7.2 Practice Test 2

Question

Fortinet NSE5_FAZ-7.2 Practice Tests

Practice Tests