In a Fortinet Security Fabric, what can make an upstream FortiGate create traffic logs associated with sessions initiated on downstream FortiGate devices?

The downstream device cannot connect to FortiAnalyzer.

The traffic destination is another FoitiGate in the fabric.

Log redundancy is configured in the fabric.

The upstream FortiGate is configured to do NAT.

The downstream device cannot connect to FortiAnalyzer.

Which two statements about FortiAnalyzer operating modes are true? (Choose two.)

Analyzer mode is the default operating mode.

When in analyzer mode. FortiAnalyzer supports event management and reporting features.

When in collector mode. FortiAnalyzer offloads the log receiving task to the analyzer.

Analyzer mode is the default operating mode.

For the collector, you should allocate most of the disk space to analytics logs.

When in analyzer mode. FortiAnalyzer supports event management and reporting features.

Which statement is true when you are upgrading the firmware on an HA cluster made up of throe FortiAnalyzer devices?

First, upgrade the secondary devices, and then upgrade the primary device.

All FortiAnalyzer devices will be upgraded at the same time.

Enabling uninterruptible-upgrade prevents normal operations from being interrupted during the upgrade.

You can perform the firmware upgrade using only a console connection.

First, upgrade the secondary devices, and then upgrade the primary device.

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

Perform a hot swap of the disk.

Shul down FortiAnalyzer and replace the disk.

Perform a hot swap of the disk.

Run execute format disk to format and restart the FortiAnalyzer device.

There is no need to do anything because the disk will self-recover.

After you have moved a registered logging device out of one ADOM and into a new ADOM, you run the following command: execute sql-local rebuild-adom <new-ADOM-name>What is the purpose of running this CLI command?

To populate the new ADOM with analytical logs for the moved device, so you can run reports

To reset the ADOM disk quota enforcement to its default value

To migrate the archive logs to the new ADOM

To populate the new ADOM with analytical logs for the moved device, so you can run reports

To remove the analytics logs of the device from the old database

You finished registering a FortiGate device. After traffic starts to flow through FortiGate. you notice that only some of the logs expected are being received on FortiAnalyzer.What could be the reason for the logs not arriving on FortiAnalyzer?

FortiGate does not have logging configured correctly.

This FortiGate model is not fully supported.

This FortiGate is part of an HA cluster but it is the secondary device.

FortiGate was added to the wrong ADOM type.

Which statement is true about using aggregation mode on FortiAnalyzer?

Aggregation mode can work with syslog servers.

Aggregation mode supports log filters.

Aggregation mode can work with syslog servers.

In aggregation mode, logs and content files are forwarded in real time.

Aggregation mode can be configured only on the CLI.

Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate on FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

One or more remote LDAP servers

LDAP servers IP addresses added as trusted hosts

One or more remote LDAP servers

A local wildcard administrator account

Which two statements are true regarding the log synchronization states for HA on FortiAnalyzer? (Choose two.)

Log Data Sync provides real-time log synchronization to all backup devices.

With Initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

Log Data Sync provides real-time log synchronization to all backup devices.

When Log Data Sync is turned on, the backup device reboots and then rebuilds the log database with the synchronized logs.

With Initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

By default. Log Data Sync is disabled on all backup devices.

An administrator, fortinet, can view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mail server that can be used to send alert emails.What can be the problem?

fortinet is assigned the Standard_User administrative profile.

ADOM mode is configured with Advanced mode.

fortinet is assigned the Standard_User administrative profile.

fortinet is assigned Restricted_User administrative profile.

Which two statements are true regarding fabric connectors? (Choose two.)

Using fabric connectors is more efficient than third-party polling information from the FortiAnalyzer API

The storage connector service does not require a separate license to send logs to the cloud platform.

Using fabric connectors is more efficient than third-party polling information from the FortiAnalyzer API

Cloud-out connectors allow you to send real-time logs to public cloud accounts like Amazon S3.

Fabric connectors allow you to save storage costs and improve redundancy.

The storage connector service does not require a separate license to send logs to the cloud platform.

An administrator has configured the following settings: What is the purpose of executing these commands?

To verify the integrity of the log files received.

To record the hash value and authentication code of log files.

To encrypt log transfer between FortiAnalyzer and other devices.

To verify the integrity of the log files received.

To create the secure channel used by the OFTP process.

Which statement is true about the communication between FortiGate high availability (HA) clusters and FortiAnalyzer?

Only the primary device in the cluster communicates with FortiAnalyzer.

Each cluster member sends its logs directly to FortiAnalyzer.

You must add the device lo the cluster first, and then registers the cluster with FortiAnalyzer.

FortiAnalyzer distinguishes each cluster member by its MAC address.

Only the primary device in the cluster communicates with FortiAnalyzer.

Which two statements are true regarding FortiAnalyzer system backups? (Choose two.)

Existing reports can be included in the backup files.

Backup files can be uploaded to SCP and SFTP servers.

Existing reports can be included in the backup files.

The system reserves at least 5% to 20% disk space for backup files.

Scheduled system backups can be configured only from the CLI.

Backup files can be uploaded to SCP and SFTP servers.

Which statement is true about ADOMs?

A fabric ADOM can include all the device types supported by FortiAnalyzer.

When a FortiAnalyzer Fabric is implemented, the default ADOM mode is set to advanced.

A fabric ADOM can include all the device types supported by FortiAnalyzer.

You can change the ADOM mode only through the GUI.

In normal mode, you cannot change the disk quota of the ADOM after its creation.

What is true about a FortiAnalyzer Fabric?

The members send their logs to the supervisor.

Members events can be raised from the supervisor.

The supervisor and members cannot be in different time zones

The members send their logs to the supervisor.

Which two methods can you use to restrict administrative access on FortiAnalyzer? (Choose two.)

Fabric connectors to external LDAP servers.

Limit access to specific virtual domains.

Refer to the exhibit. Based on the partial outputs displayed in the exhibit, which devices are ready to be configured as peers in an HA cluster?

These devices cannot participate in the same cluster.

FortiAnalyzer1 and FortiAnalyzer3

FortiAnalyzer1 and FortiAnalyzer2

These devices cannot participate in the same cluster.

FortiAnalyzer2 and FortiAnalyzer3

What is true about FortiAnalyzer reports?

You require an output profile before reports are generated.

When you enable auto-cache, reports are scheduled by default.

Reports can be saved in a CSV format.

You require an output profile before reports are generated.

The reports from one ADOM are available for all ADOMs.

Which command can you use to find the IP addresses of the devices sending logs to FortiAnalyzer?

diagnose debug application oftpd 8

diagnose teat application miglogd 6

diagnose best application oftpd 3

Refer to the exhibit. The image displays 'he configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster.What can you conclude from the configuration displayed?

This FortiAnalyzer is configured to receive logs in its port1.

After joining to the cluster, this FortiAnalyzer will keep an updated log database.

This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.

This FortiAnalyzer will join to the existing HA cluster as the primary.

This FortiAnalyzer is configured to receive logs in its port1.

What are analytics logs on FortiAnalyzer?

Logs that are indexed and stored in the SQL

Logs that are compressed and saved to a log file

Logs that roll over when the log file reaches a specific size

Logs that are indexed and stored in the SQL

Logs classified as type Traffic, or type Security

Fortinet NSE6_FAZ-7.2 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 30

Which two of the available registration methods place the device automatically in its assigned ADOM? (Choose two.)

Request from the device

Serial number

Fabric Authorization

Pre-shared key

Comment (0)

Fortinet NSE6_FAZ-7.2 Practice Test 1

Question

Fortinet NSE6_FAZ-7.2 Practice Tests

Practice Tests