Fortinet NSE 5 - FortiAnalyzer 7.2 Analyst - NSE5

QUESTION NO: 1
You need to upgrade your FortiAnalyzer firmware.
What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?

A. Thelogfiledprocess stores logs in offline mode B. FortiGate uses themiglogdprocess to cache the logs C. FortiAnalyzer uses log fetching to retrieve the logs when back online D. Logs are dropped

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Refer to the exhibit.

The exhibit shows "remoteservergroup" is an authentication server group with LDAP and RADIUS servers.
Which two statements express the significance of enabling "Match all users on remote server" when configuring a new administrator? (Choose two.)

A. It allows administrators to use two-factor authentication. B. Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS. C. It creates a wildcard administrator using LDAP and RADIUS servers. D. Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.

Correct Answer: B,C

QUESTION NO: 3
What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?

A. Log collection B. Real-time forwarding C. Host name resolution D. Log correlation

Correct Answer: D

QUESTION NO: 4
Refer to the exhibit.

What does the data point at 12:20 indicate?

A. The sqlplugind service is caught up with new logs. B. FortiAnalyzer is using its cache to avoid dropping logs. C. The performance of FortiAnalyzer is below the baseline. D. The log insert lag time is increasing.

Correct Answer: A

QUESTION NO: 5
Which two statements are true regarding high availability (HA) on FortiAnalyzer? (Choose two.)

A. All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector. B. FortiAnalyzer HA implementation is supported by many public cloud infrastructures such as AWS, Microsoft Azure, and Google Cloud. C. FortiAnalyzer HA can function without VRRP. and VRRP is required only if you have more than two FortiAnalyzer devices in a cluster. D. FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

Correct Answer: A,D

QUESTION NO: 6
Why should you use an NTP server on FortiAnalyzer and all registered devices that log into FortiAnalyzer?

A. To use real-time forwarding B. To properly correlate logs C. To improve DNS response times D. To resolve host names

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?

A. Threat hunting B. Incidents dashboards C. FortiView Monitor D. Outbreak alert services

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
You have recently grouped multiple FortiGate devices into a single ADOM.System Settings>Storage Info shows the quota used.
What does the disk quota refer to?

A. The maximum disk utilization for the ADOM type B. The maximum disk utilization for all devices in the ADOM C. The maximum disk utilization for each device in the ADOM D. The maximum disk utilization for the FortiAnalyzer model

Correct Answer: B

QUESTION NO: 9
An administrator has configured the following settings:
config system global
set log-checksum md5-auth
end
What is the significance of executing this command?

A. This command records the log file MD5 hash value. B. This command records passwords in log files and encrypts them. C. This command encrypts log transfer between FortiAnalyzer and other devices. D. This command records the log file MD5 hash value and authentication code.

Correct Answer: D

Fortinet NSE 5 - FortiAnalyzer 7.2 Analyst - NSE5_FAZ-7.2 Exam Questions