Fortinet NSE5_FAZ-7.2 Exam Practice Test Instant Access

Question 1

Which log will generate an event with the status Contained?

AAn IPS log with action=pass.

BA WebFilter log with action=dropped.

CAn AV log with action=quarantine.

DAn AppControl log with action=blocked.

Answer : C

Question 2

Which SQL query is in the correct order to query the database in the FortiAnslyzer?

ASELECT devid FROM Slog GROOP BY devid WHERE * user' =* USERl'

BSELECT devid WHERE 'u3er'='USERl' FROM $ log GROUP BY devid

CSELECT devid FROM Slog- WHERE *user' =' USERl' GROUP BY devid

DFROM Slog WHERE 'user* =' USERl' SELECT devid GROUP BY devid

Answer : C

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 259: The main clauses FortiAnalyzer reports use are as follows:

*FROM

*WHERE

*GROUP BY

*ORDER BY

* LIMIT

* OFFSET

Accordingly, following the SELECT keyword, the statement must be followed by one or more clauses in the order in which they appear in the table shown on this slide.

Question 3

Which two statements are correct regarding the export and import of playbooks? (Choose two.)

AYou can export only one playbook at a time.

BYou can import a playbook even if there is another one with the same name in the destination.

CPlaybooks can be exported and imported only within the same FortiAnaryzer.

DA playbook that was disabled when it was exported, will be disabled when it is imported.
If the imported playbook has the same name as an existing one, FortiAnalyzer will create a new name that includes a timestamp to avoid conflicts.
Playbooks are imported with the same status they had (enabled or disabled) when they were exported.
Playbooks set to run automatically should be exported while they are disabled to avoid unintended runs on the destination.

Answer : B, D

Question 4

Which two elements are contained in a system backup created on FortiAnalyzer? (Choose two.)

ASystem information

BLogs from registered devices

CReport information

DDatabase snapshot

Answer : A, C

What does the System Configuration backup include?

System information, such as the device IP address and administrative user information.

Device list, such as any devices you configured to allow log access.

Report information, such as any configured report settings, as well as all your custom report details. These are not the actual reports.

FortiAnalyzer_7.0_Study_Guide-Online pag. 29

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 29: What does the System Configuration backup include?

* System information, such as the device IP address and administrative user information

* Device list, such as any devices you configured to allow log access

* Report information, such as any configured report settings, as well as all your custom report details. These are not the actual reports.

Question 5

What is the purpose of output variables?

ATo store playbook execution statistics

BTo use the output of the previous task as the input of the current task

CTo display details of the connectors used by a playbook

DTo save all the task settings when a playbook is exported
FortiAnalyzer_7.0_Study_Guide-Online.pdf page 242: Output variables allow you to use the output from a preceding task as an input to the current task.
'Output variables allow you to use the output from a preceding task as an input to the current task.' FortiAnalyzer_7.0_Study_Guide-Online page 242

Answer : B

Question 6

Which two statements express the advantages of grouping similar reports? (Choose two.)

AImprove report completion time.

BConserve disk space on FortiAnalyzer by grouping multiple similar reports.

CReduce the number of hcache tables and improve auto-hcache completion time.

DProvides a better summary of reports.

Answer : A, C

Question 7

An administrator fortinet, is able to view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mall server that can be used to send email.

What could be the problem?

AFortinet is assigned the Standard_ User administrator profile.

BA trusted host is configured.

CADOM mode is configured with Advanced mode.

DFortinet is assigned the Restricted_ User administrator profile.

Answer : A

* Super_User, which, like in FortiGate, provides access to all device and system privileges.

* Standard_User, which provides read and write access to device privileges, but not system privileges.

* Restricted_User, which provides read access only to device privileges, but not system privileges. Access

to the Management extensions is also removed.

* No_Permissions_User, which provides no system or device privileges. Can be used, for example, to

temporarily remove access granted to existing admins.

FortiAnalyzer_7.0_Study_Guide-Online page 42

Fortinet NSE5_FAZ-7.2 Fortinet NSE 5 - FortiAnalyzer 7.2 Exam Practice Test