Fortinet NSE 5 - FortiAnalyzer 6.4 - NSE5_FAZ-6.4 Exam Questions [2026]

QUESTION NO: 1
What remote authentication servers can you configure to validate your FortiAnalyzer administrator logons? (Choose three)

A. RADIUS B. PKI C. Local D. LDAP E. TACACS+

Correct Answer: A,D,E

QUESTION NO: 2
Which two statements are true regarding ADOM modes? (Choose two.)

A. In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs. B. You can only change ADOM modes through CLI. C. In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM. D. Normal mode is the default ADOM mode.

Correct Answer: A,D

QUESTION NO: 3
On FortiAnalyzer, what is a wildcard administrator account?

A. An account that validates against any user account on a FortiAuthenticator B. An account that allows guest access with read-only privileges C. An account that permits access to members of an LDAP group D. An account that requires two-factor authentication

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?

A. FortiAnalyzer migrates analytics logs to the new ADOM. B. FortiAnalyzer removes logs from the old ADOM. C. FortiAnalyzer migrates archive logs to the new ADOM. D. FortiAnalyzer resets the disk quota of the new ADOM to default.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

A. Indicators of Compromise B. Log fetching C. Log forwarding an aggregation mode D. Log upload

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
View the exhibit.

What does the data point at 14:35 tell you?

A. The sqlplugind daemon is ahead in indexing by one log. B. FortiAnalyzer is dropping logs. C. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed. D. FortiAnalyzer is indexing logs faster than logs are being received.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:

A. Use real-time forwarding B. Use host name resolution C. Use an NTP server D. Use DNS

Correct Answer: C

QUESTION NO: 8
An administrator has configured the following settings:
config system global
set log-checksum md5-auth
end
What is the significance of executing this command?

A. This command records the log file MD5 hash value. B. This command records passwords in log files and encrypts them. C. This command encrypts log transfer between FortiAnalyzer and other devices. D. This command records the log file MD5 hash value and authentication code.

Correct Answer: D

QUESTION NO: 9
Which two statement are true regardless initial Logs sync and Log Data Sync for Ha on FortiAnalyzer?

A. Log Data Sync provides real-time log synchronization to all backup devices. B. By default, Log Data Sync is disabled on all backup devise. C. When Logs Data Sync is turned on, the backup device will reboot and then rebuilt the log database with the synchronized logs. D. With initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

Correct Answer: C,D

QUESTION NO: 10
What statements are true regarding disk log quota? (Choose two)

A. The FortiAnalyzer stops logging once the disk log quota is met. B. The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met. C. The FortiAnalyzer automatically sets the disk log quota based on the device. D. The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

Correct Answer: B,D