What are analytics logs on FortiAnalyzer?

Logs that are indexed and stored in the SQL.

Logs that roll over when the log file reaches a specific size.

Logs that are indexed and stored in the SQL.

Raw logs that are compressed and saved to a log file.

What is Log Insert Lag Time on FortiAnalyzer?

The amount of time that passes between the time a log was received and when it was indexed on FortiAnalyzer.

The number of times in the logs where end users experienced slowness while accessing resources.

The amount of lag time that occurs when the administrator is rebuilding the ADOM database.

The amount of time that passes between the time a log was received and when it was indexed on FortiAnalyzer.

The amount of time FortiAnalyzer takes to receive logs from a registered device

Refer to the exhibit. What is the purpose of using the Chart Builder feature on FortiAnalyzer?

In Log View, this feature allows you to build a dataset and chart automatically, based on the filtered search results.

In Log View, this feature allows you to build a chart and chart automatically, on the top 100 log entries.

This feature allows you to build a chart under FortiView.

You can add charts to generated reports using this feature.

Which two statement are true regardless initial Logs sync and Log Data Sync for Ha on FortiAnalyzer?

With initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

When Logs Data Sync is turned on, the backup device will reboot and then rebuilt the log database with the synchronized logs.

By default, Log Data Sync is disabled on all backup devise.

Log Data Sync provides real-time log synchronization to all backup devices.

With initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

When Logs Data Sync is turned on, the backup device will reboot and then rebuilt the log database with the synchronized logs.

Which two statements are true regarding fabric connectors? (Choose two.)

Configuring fabric connectors to send notification to ITSM platform upon incident creation Is more efficient than third-party information from the FortiAnalyzer API.

Cloud-Out connections allow you to send real-time logs to pubic cloud accounts like Amazon S3, Azure Blob , and Google Cloud.

Configuring fabric connectors to send notification to ITSM platform upon incident creation Is more efficient than third-party information from the FortiAnalyzer API.

Fabric connectors allow to save storage costs and improve redundancy.

Storage connector service does not require a separate license to send logs to cloud platform.

Cloud-Out connections allow you to send real-time logs to pubic cloud accounts like Amazon S3, Azure Blob , and Google Cloud.

What does the disk status Degraded mean for RAID management?

The hard driveiIs no longer being used by the RAID controller

One or more drives are missing from the FortiAnalyzer unit. The drive is no longer available to the operating system.

The FortiAnalyzer device is writing to all the hard drives on the device in order to make the array fault tolerant.

The FortiAnalyzer device is writing data to a newly added hard drive in order to restore the hard drive to an optimal state.

The hard driveiIs no longer being used by the RAID controller

Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?

First, upgrade the secondary device, and then upgrade the primary device.

Both FortiAnalyzer devices will be upgraded at the same time.

You can enable uninterruptible-upgrade so that the normal FortiAnalyzer operations are not interrupted while the cluster firmware upgrades.

You can perform the firmware upgrade using only a console connection.

What is the purpose of output variables?

To use the output of the previous task as the input of the current task

To store playbook execution statistics

To use the output of the previous task as the input of the current task

To display details of the connectors used by a playbook

To save all the task settings when a playbook is exported

Refer to the exhibit. Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin" and coming from Laptop1:Which filter will achieve the desired result?

operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin

operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

operation-login & dstip==10.1.1.210 & userl-admin

operation-login & performed_on=="GUI(10.1.1.210)' & user!=admin

If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

The configured priority is checked first

The configured IP address is checked first.

The active port number is checked first.

The firmware version is checked first.

The configured priority is checked first

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

There is no need to do anything because the disk will self-recover.

Run execute format disk to format and restart the FortiAnalyzer device.

Shut down FortiAnalyzer and replace the disk

Which statement is true about sending notifications with incident updates?

You can send notifications to multiple external platforms

Notifications can be sent only when an incident is updated or deleted.

If you use multiple fabric connectors, all connectors must have the same notification settings

Notifications can be sent only by email.

You can send notifications to multiple external platforms

Which statement correctly describes the management extensions available on FortiAnalyzer?

Management extensions may require a minimum number of CPU cores to run.

Management extensions do not require additional licenses.

Management extensions allow FortiAnalyzer to act as a ForbSIEM supervisor.

Management extensions require a dedicated VM for best performance.

Management extensions may require a minimum number of CPU cores to run.

When working with FortiAnalyzer reports, what is the purpose of a dataset?

To retrieve data from the database

To provide the layout used for reports

To define the chart type to be used

To retrieve data from the database

To set the data included in templates

Refer to the exhibit. The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster.What can you conclude from the configuration displayed?

This FortiAnalyzer is configured to receive logs in its port1.

This FortiAnalyzer will join to the existing HA cluster as the primary.

This FortiAnalyzer is configured to receive logs in its port1.

This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.

After joining to the cluster, this FortiAnalyzer will keep an updated log database.

What must you consider when using log fetching? (Choose two.)

You can use filters to include only logs from a single device.

The fetching profile must include a user with the Super_User profile.

The fetch client can retrieve logs from devices that are not added to its local Device Manager

You can use filters to include only logs from a single device.

The fetching profile must include a user with the Super_User profile.

The archive logs retrieved from the server become archive logs in the client.

Which two statements are true regarding the outbreak detection service? (Choose two.)

An additional license is required.

It automatically downloads new event handlers and reports.

New alerts are received by email.

Outbreak alerts are available on the root ADOM only.

An additional license is required.

It automatically downloads new event handlers and reports.

What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

When new logs are received, the hard-cache data is updated automatically.

The generation time for reports is decreased.

The size of newly generated reports is optimized to conserve disk space.

FortiAnalyzer local cache is used to store generated reports.

When new logs are received, the hard-cache data is updated automatically.

The generation time for reports is decreased.

Why must you wait for several minutes before you run a playbook that you just created?

FortiAnalyzer needs that time to parse the new playbook.

FortiAnalyzer needs that time to back up the current playbooks.

FortiAnalyzer needs that time to ensure there are no other playbooks running.

FortiAnalyzer needs that time to debug the new playbook.

Which statement describes online logs on FortiAnalyzer?

Logs that can be viewed using Log Browse

Logs that reached a specific size and were rolled over

Logs that can be used to create reports

Logs that can be viewed using Log Browse

Logs that are saved to disk, compressed, and available in FortiView

In FortiAnalyzer's FormView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAnalyzer?

Configure local DNS servers on FortiAnalyzer

Configure # set resolve-ip enable in the system FortiView settings

Resolve IPs on a per-ADOM basis to reduce delay on FortiView while IPs resolve

View the exhibit. Why is the total quota less than the total system storage?

Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files

3.6% of the system storage is already being used.

Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files

The oftpd process has not archived the logs yet

The logfiled process is just estimating the total quota

What statements are true regarding disk log quota? (Choose two)

The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.

The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

The FortiAnalyzer stops logging once the disk log quota is met.

The FortiAnalyzer automatically sets the disk log quota based on the device.

The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.

The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

What statements are true regarding FortiAnalyzer 's treatment of high availability (HA) dusters?(Choose two)

FortiAnalyzer distinguishes different devices by their serial number.

FortiAnalyzer receives logs from d devices in a duster.

FortiAnalyzer distinguishes different devices by their serial number.

FortiAnalyzer receives logs from d devices in a duster.

FortiAnalyzer receives bgs only from the primary device in the cluster.

FortiAnalyzer only needs to know (he serial number of the primary device in the cluster-it automaticaly discovers the other devices.

How can you attach a report to an incident?

From the properties of an existing incident

By attaching it to an event handler alert

By editing the settings of the desired report

From the properties of an existing incident

Saving it in JSON format, and then importing it

Which statement about the FortiSOAR management extension is correct?

It runs as a docker container on FortiAnalyzer

It requires a FortiManager configured to manage FortiGate

It requires a dedicated FortiSOAR device or VM.

It does not include a limited trial by default.

It runs as a docker container on FortiAnalyzer

After generating a report, you notice the information you were expecting to see is not included in it.What are two possible reasons for this scenario? (Choose two.)

The logfiled service has not indexed all the expected logs.

The logs were overwritten by the data retention policy.

You enabled auto-cache with extended log filtering.

The logfiled service has not indexed all the expected logs.

The logs were overwritten by the data retention policy.

The time frame selected in the report is wrong.

What is the purpose of using prefilters when configuring event handlers?

They limit which logs are checked for matches by the other filters.

They can filter the logs before they are processed by FortiAnalyzer

They download new filters to be used in event handlers.

They are common filters applied simultaneously to all event handlers.

Which statement describes a dataset in FortiAnalyzer?

They determine what data is retrieved from the database.

They provide the layout used for reports.

They are used to set the data included in templates.

They define the chart types to be used in reports.

What is the purpose of trigger variables?

To use information from the trigger to filter the action in a task

To display statistics about the playbook runtime

To use information from the trigger to filter the action in a task

To provide the trigger information to make the playbook start running

To store the start times of playbooks with On_Schedule triggers

Which statement about sending notifications with incident updates is true?

Each connector used can have different notification settings.

Notifications can be sent only when an incident is created or deleted.

You must configure an output profile to send notifications by email.

Each incident can send notifications to a single external platform.

Each connector used can have different notification settings.

Fortinet NSE5_FAZ-7.2 Practice Test 3 - Free Online Exam Prep & Questions

Which two statements express the advantages of grouping similar reports? (Choose two.)

Fortinet NSE5_FAZ-7.2 Practice Test 3

Question

Fortinet NSE5_FAZ-7.2 Practice Tests

Practice Tests