NSE5_FAZ-7.0 Fortinet NSE 5 - FortiAnalyzer 7.0 Dumps Questions

NSE5_FAZ-7.0 Fortinet NSE 5 – FortiAnalyzer 7.0 Dumps Questions

test2022-10-20T06:46:10+00:00

NSE5_FAZ-7.0 Fortinet NSE 5 – FortiAnalyzer 7.0 Dumps Questions are the best material which can help you pass your exam easily. NSE5_FAZ-7.0 exam tests applied knowledge of FortiAnalyzer configuration, operation, and day-to-day administration, and includes operational scenarios, system configuration, device registration, and troubleshooting. FreeTestShare has the latest NSE5_FAZ-7.0 Fortinet NSE 5 – FortiAnalyzer 7.0 Dumps Questions to help you memorize and pass your exam at the very first attempt.

Check the NSE5_FAZ-7.0 practice exam to see if you are ready for real exam.

Page 1 of 3

1. Which two constraints can impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)

License type

Disk size

Total quota

RAID level

2. Which two statements are correct regarding the export and import of playbooks? (Choose two.)

You can export only one playbook at a time.

You can import a playbook even if there is another one with the same name in the destination.

Playbooks can be exported and imported only within the same FortiAnaryzer.

A playbook that was disabled when it was exported, will be disabled when it is imported.

3. What purposes does the auto-cache setting on reports serve? (Choose two.)

To reduce report generation time

To automatically update the hcache when new logs arrive

To reduce the log insert lag rate

To provide diagnostics on report generation time

4. Refer to the exhibit.

Which image corresponds to the packet capture shown in the exhibit?

A)

Option A

Option B

Option C

Option D

5. Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally? (Choose two.)

Mail server

Output profile

SFTP server

Report scheduling

6. Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate to FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

A local wildcard administrator account

A remote LDAP server

A trusted host profile that restricts access to the LDAP group

An administrator group

7. For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

Use DNS

Use host name resolution

Use real-time forwarding

Use an NTP server

8. Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?

First, upgrade the secondary device, and then upgrade the primary device.

Both FortiAnalyzer devices will be upgraded at the same time.

You can enable uninterruptible-upgrade so that the normal FortiAnalyzer operations are not interrupted while the cluster firmware upgrades.

You can perform the firmware upgrade using only a console connection.

9. Which two statements about log forwarding are true? (Choose two.)

Forwarded logs cannot be filtered to match specific criteria.

Logs are forwarded in real-time only.

The client retains a local copy of the logs after forwarding.

You can use aggregation mode only with another FortiAnalyzer.

10. What two things should an administrator do to view Compromised Hosts on FortiAnalyzer? (Choose two.)

Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer.

Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up-to-date.

Make sure all endpoints are reachable by FortiAnalyzer.

Page 2 of 3

11. What happens when a log file saved on FortiAnalyzer disks reaches the size specified in the device log settings?

The log file is stored as a raw log and is available for analytic support.

The log file rolls over and is archived.

The log file is purged from the database.

The log file is overwritten.

12. Which two purposes does the auto cache setting on reports serve? (Choose two.)

It automatically updates the hcache when new logs arrive.

It provides diagnostics on report generation time.

It reduces the log insert lag rate.

It reduces report generation time.

13. Refer to the exhibit.

Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin" and coming from Laptop1:

Which filter will achieve the desired result?

operation―login & performed_on==BGUI(10. 1.1. 100)" & userl=admin

operation―login & srcip=10.1 - 1. 100 & dstip==10 1.1. 210 & user=admin

operation―login & performed1_on=,'GUI(10. 1.1. 210)" & user!=admin

operation―login & dstip=10.1 . 1. 2.10 & user1―admin

14. You are using RAID with a FortiAnalyzer that supports software RAID, and one of the hard disks on

FortiAnalyzer has failed.

What is the recommended method to replace the disk?

Shut down FortiAnalyzer and then replace the disk

Downgrade your RAID level, replace the disk, and then upgrade your RAID level

Clear all RAID alarms and replace the disk while FortiAnalyzer is still running

Perform a hot swap

15. An administrator has moved FortiGate A from the root ADOM to ADOM 1. However, the administrator is not able to generate reports for FortiGate A in ADOM 1.

What should the administrator do to solve this issue?

Use the execute sql-local rebuild-db command to rebuild all ADOM databases.

Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.

Use the execute sql-report run ADOM1 command to run a report.

Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

16. What is the purpose of employing RAID with FortiAnalyzer?

To introduce redundancy to your log data

To provide data separation between ADOMs

To separate analytical and archive data

To back up your logs

17. If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

The configured IP address is checked first.

The active port number is checked first.

The firmware version is checked first.

The configured priority is checked first

18. Refer to the exhibits.

How many events will be added to the incident created after running this playbook?

Ten events will be added.

No events will be added.

Five events will be added.

Thirteen events will be added.

19. Which daemon is responsible for enforcing raw log file size?

logfiled

oftpd

sqlplugind

miglogd

20. Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?

Incidents dashboards

Threat hunting

FortiView Monitor

Outbreak alert services

Page 3 of 3

21. What can the CLI command # diagnose test application oftpd 3 help you to determine?

What devices and IP addresses are connecting to FortiAnalyzer

What logs, if any, are reaching FortiAnalyzer

What ADOMs are enabled and configured

What devices are registered and unregistered

22. Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy.

What is the most likely problem?

CPU resources are too high

Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device

The total disk space is insufficient and you need to add other disk

The ADOM disk quota is set too low, based on log rates

23. Which two statements are true regarding FortiAnalyzer operating modes? (Choose two.)

When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.

Collector mode is the default operating mode.

When in collector mode. FortiAnalyzer supports event management and reporting features.

By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting

24. After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the purpose of running the following CLI command?

execute sql-local rebuild-adom <new-ADOM-name>

To reset the disk quota enforcement to default

To remove the analytics logs of the device from the old database

To migrate the archive logs to the new ADOM

To populate the new ADOM with analytical logs for the moved device, so you can run reports