Fortinet NSE5_FAZ-7.2 Exam Questions Instant Access

Question 1

FortiAnalyzer reports are dropping analytical data from 15 days ago, even though the data policy setting for

analytics logs is 60 days.

What is the most likely problem?

AQuota enforcement is acting on analytical data before a report is complete

BLogs are rolling before the report is run

CCPU resources are too high

DDisk utilization for archive logs is set for 15 days

Answer : B

Question 2

If a hard disk fails on a FortiAnalyzer that supports software RAID, what should you do to bring the

FortiAnalyzer back to functioning normally, without losing data?

AHot swap the disk

BReplace the disk and rebuild the RAID manually

CTake no action if the RAID level supports a failed disk

DShut down FortiAnalyzer and replace the disk

Answer : D

https://kb.fortinet.com/kb/documentLink.do?externalID=FD46446#:~:text=On%20FortiAnalyzer%2FFortiManager%20devices%20that,to%20exchanging%20the%20hard%20disk.

If a hard disk on a FortiAnalyzer unit fails, it must be replaced. On FortiAnalyzer devices that support hardware RAID, the hard disk can be replaced while the unit is still running -- known as hot swapping. On FortiAnalyzer units with software RAID, the device must be shutdown prior to exchanging the hard disk.

Question 3

What statements are true regarding disk log quota? (Choose two)

AThe FortiAnalyzer stops logging once the disk log quota is met.

BThe FortiAnalyzer automatically sets the disk log quota based on the device.

CThe FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.

DThe FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

Answer : C, D

Question 4

What statements are true regarding FortiAnalyzer 's treatment of high availability (HA) dusters? (Choose two)

AFortiAnalyzer distinguishes different devices by their serial number.

BFortiAnalyzer receives logs from d devices in a duster.

CFortiAnalyzer receives bgs only from the primary device in the cluster.

DFortiAnalyzer only needs to know (he serial number of the primary device in the cluster-it automaticaly discovers the other devices.

Answer : A, B

Question 5

Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer? (Choose two.)

AEnable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.

BMake sure all endpoints are reachable by FortiAnalyzer.

CEnable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer device.

DSubscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

Answer : A, D

In order to configure IOC, you require the following:

* A one-year subscription to IOC. Note that FortiAnalyzer does include an evaluation license, but it is restrictive and only meant to give you an idea of how the feature works.

* A web filter services subscription on FortiGate device(s)

* Web filter policies on FortiGate device(s) that send traffic to FortiAnalyzer

Compromised Hosts or Indicators of Compromise service (IOC) is a licensed feature.

To view Compromised Hosts, you must turn on the UTM web filter of FortiGate devices and subscribe your FortiAnalyzer unit to FortiGuard to keep its local threat database synchronized with the FortiGuard threat database. See Subscribing FortiAnalyzer to FortiGuard.

Ref : https://docs.fortinet.com/document/fortianalyzer/6.4.0/administration-guide/137635/viewing-compromised-hosts

Question 6

Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

AADOMs are enabled by default.

BADOMs constrain other administrator's access privileges to a subset of devices in the device list.

COnce enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM.

DAll administrators can create ADOMs--not just the admin administrator.

Answer : B, C

Question 7

After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the

purpose of running the following CLI command?

execute sql-local rebuild-adom

ATo reset the disk quota enforcement to default

BTo remove the analytics logs of the device from the old database

CTo migrate the archive logs to the new ADOM

DTo populate the new ADOM with analytical logs for the moved device, so you can run reports

Answer : D

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 128: Are the device analytics logs required for reports in the new ADOM? If so, rebuild the new ADOM database

Fortinet NSE 5 - FortiAnalyzer 7.2 NSE5_FAZ-7.2 Exam Questions