Fortinet NSE5_FAZ-7.0 Test Engine Practice Test Questions, Exam Dumps
100% Free NSE5_FAZ-7.0 Daily Practice Exam With 116 Questions
Fortinet NSE5_FAZ-7.0 certification is a valuable credential for IT professionals who work with FortiAnalyzer 7.0. Fortinet NSE 5 - FortiAnalyzer 7.0 certification demonstrates that the individual has the knowledge and skills to manage and analyze security information effectively. To pass the exam, candidates should have a strong understanding of FortiAnalyzer 7.0 and take advantage of the various training resources available.
NEW QUESTION # 13
In FortiAnalyzer's FormView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAnalyzer?
- A. Resolve IPs on FortiGate
- B. Configure # set resolve-ip enable in the system FortiView settings
- C. Resolve IPs on a per-ADOM basis to reduce delay on FortiView while IPs resolve
- D. Configure local DNS servers on FortiAnalyzer
Answer: A
NEW QUESTION # 14
By default, what happens when a log file reaches its maximum file size?
- A. FortiAnalyzer forwards logs to syslog.
- B. FortiAnalyzer stops logging.
- C. FortiAnalyzer rolls the active log by renaming the file.
- D. FortiAnalyzer overwrites the log files.
Answer: C
NEW QUESTION # 15
What are the operating modes of FortiAnalyzer? (Choose two)
- A. Collector
- B. Manager
- C. Standalone
- D. Analyzer
Answer: A,D
NEW QUESTION # 16
A play book contains five tasks in total. An administrator executed the playbook and four out of five tasks finished successfully, but one task failed. What will be the status of the playbook after its execution?
- A. Failed
- B. Upstream_failed
- C. Success
- D. Running
Answer: A
Explanation:
Playbook jobs that include one or more failed tasks are labeled as Failed in Playbook Monitor. FortiAnalyzer_7.0_Study Guide page No: 247 Playbook jobs that include one or more failed tasks are labeled as Failed in Playbook Monitor. A failed status, however, does not mean that all tasks failed. Some individual actions may have been completed successfully.
NEW QUESTION # 17
What is required to authorize a FortiGate on FortiAnalyzer using Fabric authorization?
- A. Valid FortiAnalyzer credentials
- B. A pre-shared key
- C. A FortiGate ADOM
- D. The FortiGate serial number
Answer: A
Explanation:
FortiAnalyzer_7.0_Study_Guide-Online.pdf page 93: The fourth method uses the Fortinet Security Fabric authorization process. This method requires that both FortiGate and FortiAnalyzer are running version 7.0.1 or higher. It is also required that the FortiGate administrator has valid credentials to log in on FortiAnalyzer and complete the registration.
https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/13897/adding-a-fortigate-using-security-fabric-authorization
NEW QUESTION # 18
What is Log Insert Lag Time on FortiAnalyzer?
- A. The amount of time FortiAnalyzer takes to receive logs from a registered device
- B. The amount of lag time that occurs when the administrator is rebuilding the ADOM database.
- C. The amount of time that passes between the time a log was received and when it was indexed on FortiAnalyzer.
- D. The number of times in the logs where end users experienced slowness while accessing resources.
Answer: C
NEW QUESTION # 19
You crested a playbook on FortiAnalyzer that uses a FortiOS connector
When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?
- A. Fabric Connector event
- B. FortiOS Event Log
- C. FortiAnalyzer Event Handler
- D. Incoming webhook
Answer: A
NEW QUESTION # 20
How does FortiAnalyzer retrieve specific log data from the database?
- A. SQL EXTRACT statement
- B. SQL GET statement
- C. SQL SELECT statement
- D. SQL FROM statement
Answer: D
Explanation:
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/137bb60e-ff37-11e8-8524-f8bc1258b856/fortianalyzer-fortigate-sql-technote-40-mr2.pdf
NEW QUESTION # 21
Consider the CLI command:
What is the purpose of the command?
- A. To encrypt log communications
- B. To add the MD5 hash value and authentication code
- C. To add a unique tag to each log to prove that it came from this FortiAnalyzer
- D. To add a log file checksum
Answer: D
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/cli-reference/849211/global
NEW QUESTION # 22
Which two statement are true regardless initial Logs sync and Log Data Sync for Ha on FortiAnalyzer?
- A. With initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.
- B. Log Data Sync provides real-time log synchronization to all backup devices.
- C. By default, Log Data Sync is disabled on all backup devise.
- D. When Logs Data Sync is turned on, the backup device will reboot and then rebuilt the log database with the synchronized logs.
Answer: A,D
NEW QUESTION # 23
Which statement correctly describes the management extensions available on FortiAnalyzer?
- A. Management extensions may require a minimum number of CPU cores to run.
- B. Management extensions require a dedicated VM for best performance.
- C. Management extensions do not require additional licenses.
- D. Management extensions allow FortiAnalyzer to act as a ForbSIEM supervisor.
Answer: A
Explanation:
Events in FortiAnalyzer will be in one of four statuses. The current status will determine if more actions need to be taken by the security team or not.
The possible statuses are:
Unhandled: The security event risk is not mitigated or contained, so it is considered open.
Contained: The risk source is isolated.
Mitigated: The security risk is mitigated by being blocked or dropped.
(Blank): Other scenarios.
FortiAnalyzer_7.0_Study_Guide-Online pag. 189.
FortiAnalyzer_7.0_Study_Guide-Online.pdf page 189: Review the hardware requirements before you enable a management extension application. Some of them require a minimum amount of memory or a minimum number of CPU cores.
NEW QUESTION # 24
Refer to the exhibit.
What is the purpose of using the Chart Builder feature on FortiAnalyzer?
- A. You can add charts to generated reports using this feature.
- B. This feature allows you to build a chart under FortiView.
- C. In Log View, this feature allows you to build a chart and chart automatically, on the top 100 log entries.
- D. In Log View, this feature allows you to build a dataset and chart automatically, based on the filtered search results.
Answer: D
NEW QUESTION # 25
If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?
- A. The active port number is checked first.
- B. The configured IP address is checked first.
- C. The firmware version is checked first.
- D. The configured priority is checked first
Answer: C
NEW QUESTION # 26
Which two purposes does the auto cache setting on reports serve? (Choose two.)
- A. It provides diagnostics on report generation time.
- B. It reduces report generation time.
- C. It reduces the log insert lag rate.
- D. It automatically updates the hcache when new logs arrive.
Answer: B,D
Explanation:
Reference:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/384416/how-auto-cache-works
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/86926/enabling-auto-cache
NEW QUESTION # 27
On FortiAnalyzer, what is a wildcard administrator account?
- A. An account that allows guest access with read-only privileges
- B. An account that permits access to members of an LDAP group
- C. An account that requires two-factor authentication
- D. An account that validates against any user account on a FortiAuthenticator
Answer: B
Explanation:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/747268/configuring-wildcard-admin-accounts
NEW QUESTION # 28
View the exhibit.
What does the data point at 14:35 tell you?
- A. The sqlplugind daemon is ahead in indexing by one log.
- B. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.
- C. FortiAnalyzer is indexing logs faster than logs are being received.
- D. FortiAnalyzer is dropping logs.
Answer: C
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/47690/insert-rate-vs-receive-rate-widget
NEW QUESTION # 29
You need to upgrade your FortiAnalyzer firmware.
What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?
- A. FortiGate uses the miglogd process to cache the logs
- B. The logfiled process stores logs in offline mode
- C. FortiAnalyzer uses log fetching to retrieve the logs when back online
- D. Logs are dropped
Answer: A
Explanation:
NEW QUESTION # 30
What purposes does the auto-cache setting on reports serve? (Choose two.)
- A. To reduce the log insert lag rate
- B. To automatically update the hcache when new logs arrive
- C. To provide diagnostics on report generation time
- D. To reduce report generation time
Answer: B,D
NEW QUESTION # 31
What can you do on FortiAnalyzer to restrict administrative access from specific locations?
- A. Enable geo-location services on accessible interface.
- B. Configure trusted hosts for that administrator.
- C. Configure an ADOM for respective location.
- D. Configure two-factor authentication with a remote RADIUS server.
Answer: B
NEW QUESTION # 32
Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)
- A. SNMP
- B. IM
- C. SMS
- D. Email
Answer: A,D
Explanation:
Reference:
FortiAnalyzer_Admin_Guide/1800_Events/0200_Event_handlers/0600_Create_event_handlers.htm
NEW QUESTION # 33
What is the purpose of output variables?
- A. To display details of the connectors used by a playbook
- B. To store playbook execution statistics
- C. To use the output of the previous task as the input of the current task
- D. To save all the task settings when a playbook is exported
Answer: B
NEW QUESTION # 34
Why should you use an NTP server on FortiAnalyzer and all registered devices that log into FortiAnalyzer?
- A. To use real-time forwarding
- B. To improve DNS response times
- C. To resolve host names
- D. To properly correlate logs
Answer: D
NEW QUESTION # 35
What two things should an administrator do to view Compromised Hosts on FortiAnalyzer? (Choose two.)
- A. Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to FortiAnalyzer.
- B. Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up-to-date.
- C. Make sure all endpoints are reachable by FortiAnalyzer.
- D. Enable device detection on an interface on the FortiGate devices that are connected to the FortiAnalyzer.
Answer: B,D
NEW QUESTION # 36
You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?
- A. FortiAnalyzer migrates analytics logs to the new ADOM.
- B. FortiAnalyzer removes logs from the old ADOM.
- C. FortiAnalyzer resets the disk quota of the new ADOM to default.
- D. FortiAnalyzer migrates archive logs to the new ADOM.
Answer: A
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD40383
NEW QUESTION # 37
......
To earn the Fortinet NSE5_FAZ-7.0 certification, candidates must pass a comprehensive exam that covers a wide range of topics related to FortiAnalyzer 7.0. These topics include FortiAnalyzer installation and configuration, device management, log management and analysis, user and device monitoring, and reporting and alerting. NSE5_FAZ-7.0 exam also tests candidates' knowledge of security policies, event management, and troubleshooting techniques. The Fortinet NSE5_FAZ-7.0 certification is a valuable credential for network professionals who want to demonstrate their expertise in managing security analytics and reporting using FortiAnalyzer 7.0. It is also a prerequisite for advanced Fortinet certifications, such as the NSE 6 and NSE 7 certifications.
Use Valid New NSE5_FAZ-7.0 Test Notes & NSE5_FAZ-7.0 Valid Exam Guide: https://www.freecram.com/Fortinet-certification/NSE5_FAZ-7.0-exam-dumps.html
NSE5_FAZ-7.0 exam torrent Fortinet study guide: https://drive.google.com/open?id=1uWunL5Tc5bpm_8-UQdPHAKXTTJ5CbNag