Fortinet NSE 5 - FortiAnalyzer 6.4 - NSE5_FAZ-6.4 Exam Questions [2025]

QUESTION NO: 1
On FortiAnalyzer, what is a wildcard administrator account?

A. An account that validates against any user account on a FortiAuthenticator B. An account that allows guest access with read-only privileges C. An account that permits access to members of an LDAP group D. An account that requires two-factor authentication

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Which statements are true of Administrative Domains (ADOMs) in FortiAnalyzer? (Choose two.)

A. Once enabled, the Device Manager, FortiView, Event Management, and Reports tab display per ADOM. B. ADOMs are enabled by default. C. ADOMs constrain other administrator's access privileges to a subset of devices in the device list. D. All administrators can create ADOMs--not just the admin administrator.

Correct Answer: A,C

QUESTION NO: 3
What FortiGate process caches logs when FortiAnalyzer is not reachable?

A. logfiled B. oftpd C. sqlplugind D. miglogd

Correct Answer: D

QUESTION NO: 4
By default, what happens when a log file reaches its maximum file size?

A. FortiAnalyzer stops logging. B. FortiAnalyzer rolls the active log by renaming the file. C. FortiAnalyzer overwrites the log files. D. FortiAnalyzer forwards logs to syslog.

Correct Answer: B

QUESTION NO: 5
What happens when a log file saved on FortiAnalyzer disks reaches the size specified in the device log settings?

A. The log file rolls over and is archived. B. The log file is stored as a raw log and is available for analytic support. C. The log file is purged from the database. D. The log file is overwritten.

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
What statements are true regarding disk log quota? (Choose two)

A. The FortiAnalyzer stops logging once the disk log quota is met. B. The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met. C. The FortiAnalyzer automatically sets the disk log quota based on the device. D. The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

Correct Answer: B,D

QUESTION NO: 7
How are logs forwarded when FortiAnalyzer is using aggregation mode?

A. Logs and content files are forwarded as they are received. B. Logs are forwarded as they are received and content files are uploaded at a scheduled time. C. Logs and content files are stored and uploaded at a scheduled time. D. Logs are forwarded as they are received.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Refer to the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

A. This feature allows you to build a chart under FortiView. B. In Log View, this feature allows you to build a chart and chart automatically, on the top 100 log entries. C. In Log View, this feature allows you to build a dataset and chart automatically, based on the filtered search results. D. You can add charts to generated reports using this feature.

Correct Answer: C

QUESTION NO: 9
View the exhibit.

What does the data point at 14:35 tell you?

A. The sqlplugind daemon is ahead in indexing by one log. B. FortiAnalyzer is dropping logs. C. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed. D. FortiAnalyzer is indexing logs faster than logs are being received.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
How does FortiAnalyzer retrieve specific log data from the database?

A. SQL FROM statement B. SQL GET statement C. SQL SELECT statement D. SQL EXTRACT statement

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).