What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

The endpoint is marked as Compromised and. optionally, can be put in quarantine.

FortiAnalyzer flags the associated host for further analysis.

A new Infected entry is added for the corresponding endpoint.

The detection engine classifies those logs as Suspicious

Refer to the exhibit. Based on the partial outputs displayed, which devices can be members of a FortiAnalyzer Fabric?

All devices listed can be members

FortiAnalyzerl and FortiAnalyzer3

FortiAnalyzer1 and FortiAnalyzer2

All devices listed can be members

FortiAnalyzer2 and FortiAnalyzer3

Refer to the exhibit. What does the data point at 12:20 indicate?

The log insert lag time is increasing.

The performance of FortiAnalyzer is below the baseline.

FortiAnalyzer is using its cache to avoid dropping logs.

The log insert lag time is increasing.

The sqlplugind service is caught up with new logs.

Which statement about the FortiSIEM management extension is correct?

Allows you to manage the entire life cycle of a threat or breach.

Its use of the available disk space is capped at 50%.

It requires a licensed FortiSIEM supervisor.

It can be installed as a dedicated VM.

Why run the command diagnose sql status sqlplugind?

To display the SOL query connections and hcache status

To list the current SQL processes running

To check what is the database log insertion status

To display the SOL query connections and hcache status

To view the current hcache size

Which two statements are correct regarding the export and import of playbooks? (Choose two.)

You can import a playbook even if there is another one with the same name in the destination.

A playbook that was disabled when it was exported, will be disabled when it is imported.

You can export only one playbook at a time.

You can import a playbook even if there is another one with the same name in the destination.

Playbooks can be exported and imported only within the same FortiAnaryzer.

A playbook that was disabled when it was exported, will be disabled when it is imported.

Which SQL query is in the correct order to query the database in the FortiAnslyzer?

SELECT devid FROM Slog- WHERE *user' =' USERl' GROUP BY devid

SELECT devid FROM Slog GROOP BY devid WHERE * user' =* USERl'

SELECT devid WHERE 'u3er'='USERl' FROM $ log GROUP BY devid

SELECT devid FROM Slog- WHERE *user' =' USERl' GROUP BY devid

FROM Slog WHERE 'user* =' USERl' SELECT devid GROUP BY devid

Refer to the exhibit. Which statement is correct regarding the event displayed?

The security risk was blocked or dropped.

The security event risk is considered open.

An incident was created from this event.

What is required to authorize a FortiGate on FortiAnalyzer using Fabric authorization?

Valid FortiAnalyzer credentials

What are two benefits of using fabric connectors? (Choose two.)

They allow FortiAnalyzer to send logs in real-time to public cloud accounts.

Fabric connectors allow you to improve redundancy.

They allow FortiAnalyzer to send logs in real-time to public cloud accounts.

You do not need an additional license to send logs to the cloud platform.

Fabric connectors allow you to improve redundancy.

Using fabric connectors is more efficient than using third-party polling with API.

Which log will generate an event with the status Contained?

An AV log with action=quarantine.

A WebFilter log with action=dropped.

An AV log with action=quarantine.

An AppControl log with action=blocked.

Refer to the exhibit. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin", and coming from Laptop1.Which filter will achieve the desired result?

operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin

operation-login & dstip==10.1.1.210 & user!-admin

operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

operation-login & performed_on=="GUI(10.1.1.210)" & user!=admin

operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin

Fortinet NSE5_FAZ-7.2 Practice Test 4 - Free Online Exam Prep & Questions

Refer to the exhibit.

Fortinet NSE5_FAZ-7.2 image Question 121 26408 09182024190350000000

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

Become a Premium Member for full access

Unlock Premium Member

Fortinet NSE5_FAZ-7.2 Practice Test 4

Question

Fortinet NSE5_FAZ-7.2 Practice Tests

Practice Tests