ExamGecko
Question list
Search
Search

Question 77 - NSE5_FAZ-7.2 discussion

Report
Export

Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer?

(Choose two.)

A.
Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.
Answers
A.
Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.
B.
Make sure all endpoints are reachable by FortiAnalyzer.
Answers
B.
Make sure all endpoints are reachable by FortiAnalyzer.
C.
Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.
Answers
C.
Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.
D.
Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.
Answers
D.
Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.
Suggested answer: A, D

Explanation:

In order to configure IOC, you require the following:

• A one-year subscription to IOC. Note that FortiAnalyzer does include an evaluation license, but it is restrictive and only meant to give you an idea of how the feature works.

• A web filter services subscription on FortiGate device(s)

• Web filter policies on FortiGate device(s) that send traffic to FortiAnalyzer Compromised Hosts or Indicators of Compromise service (IOC) is a licensed feature.

To view Compromised Hosts, you must turn on the UTM web filter of FortiGate devices and subscribe your FortiAnalyzer unit to FortiGuard to keep its local threat database synchronized with the

FortiGuard threat database. See Subscribing FortiAnalyzer to FortiGuard.

Ref : https://docs.fortinet.com/document/fortianalyzer/6.4.0/administration-guide/137635/viewingcompromised-hosts

asked 18/09/2024
Rajesh Maharajan
36 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first