Free Fortinet NSE5_FAZ-6.2 Study Guides Exam Questions & Answer
NSE5_FAZ-6.2 Exam Dumps, NSE5_FAZ-6.2 Practice Test Questions
How to book the Fortinet NSE 5 - FortiAnalyzer (NSE5 FAZ-6.2) Exam
Follow the steps below to register for the Fortinet NSE 5 - FortiAnalyzer (NSE5 FAZ-6.2) Exam:
- Step 1: Visit Fortinet’s website from here
- Step 2: From the panel on the right, click “Book the Exams”
- Step 3: Scroll down and click the register option
- Step 4: Create your account on the website, log in if you already have one
- Step 5: Select your exam, i.e., NSE5 FAZ-6.2 exam test
- Step 6: Pay and schedule your exam
- Step 7: Buy NSE5 FAZ-6.2 dumps pdf and take NSE5 FAZ-6.2 practice test
NEW QUESTION 35
Consider the CLI command:
What is the purpose of the command?
- A. To add a unique tag to each log to prove that it came from this FortiAnalyzer
- B. To add the MD5 hash value and authentication code
- C. To add a log file checksum
- D. To encrypt log communications
Answer: C
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/cli-reference/849211/global
NEW QUESTION 36
For which two purposes would you use the command set log checksum? (Choose two.)
- A. To encrypt log communications
- B. To prevent log modification or tampering
- C. To send an identical set of logs to a second logging server
- D. To help protect against man-in-the-middle attacks during log upload from FortiAnalyzer to an SFTP server
Answer: A,B
NEW QUESTION 37
View the exhibit.
What does the data point at 14:35 tell you?
- A. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.
- B. The sqlplugind daemon is ahead in indexing by one log.
- C. FortiAnalyzer is dropping logs.
- D. FortiAnalyzer is indexing logs faster than logs are being received.
Answer: B
Explanation:
Explanation
Logs are received then they are indexed, no logging server in the world can index logs faster than they are received. When FAZ receives raw logs, they are inserted (indexed) by the SQL database and the sqlplugind daemon, this graph shows that FAZ received 3 logs and sqlplugind indexed 4.
NEW QUESTION 38
Logs are being deleted from one of your ADOMs earlier that the configured setting for archiving in your data policy. What is the most likely problem?
- A. CPU resources are too high.
- B. The ADOM disk quota is set too low based on log rates.
- C. The total disk space is insufficient and you need to add other disk.
- D. Logs in that ADOM are being forwarded in real-time to another FortiAnalyzer device.
Answer: B
NEW QUESTION 39
View the exhibit.
What does the data point at 14:35 tell you?
- A. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.
- B. The sqlplugind daemon is ahead in indexing by one log.
- C. FortiAnalyzer is dropping logs.
- D. FortiAnalyzer is indexing logs faster than logs are being received.
Answer: B
Explanation:
Explanation
Logs are received then they are indexed, no logging server in the world can index logs faster than they are received. When FAZ receives raw logs, they are inserted (indexed) by the SQL database and the sqlplugind daemon, this graph shows that FAZ received 3 logs and sqlplugind indexed 4.
NEW QUESTION 40
What are two advantages of setting up fabric ADOM? (Choose two.)
- A. It can include only FortiGate devices that are part of the same Security Fabric
- B. It can include all Fortinet devices that are part of the same Security Fabric
- C. It can be used to facilitate communication between devices in same Security Fabric
- D. It can be used for fast data processing and log correlation
Answer: B,D
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/448471/creating-a-security-fabric-adom
NEW QUESTION 41
Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally?
(Choose two.)
- A. Output profile
- B. SFTP server
- C. Report scheduling
- D. Mail server
Answer: A,B
NEW QUESTION 42
How do you restrict an administrator's access to a subset of your organization's ADOMs?
- A. Assign the ADOMs to the administrator's account
- B. Configure trusted hosts
- C. Set the ADOM mode to Advanced
- D. Assign the default Super_User administrator profile
Answer: A
NEW QUESTION 43
FortiAnalyzer uses the Optimized Fabric Transfer Protocol (OFTP) over SSL for which purpose?
- A. To send an identical set of logs to a second logging server
- B. To encrypt log communication between devices
- C. To upload logs to an SFTP server
- D. To prevent log modification during backup
Answer: A
Explanation:
Explanation/Reference: https://docs.fortinet.com/document/fortigate/6.4.0/ports-and-protocols/109281/oftp-optimized- fabric-transfer-protocol#:~:text=The%20Optimized%20Fabric%20Transfer%20Protocol,and%2For%
20FortiManager)%20unit.
NEW QUESTION 44
Which two statements about log forwarding are true? (Choose two.)
- A. You can use aggregation mode only with another FortiAnalyzer.
- B. Logs are forwarded in real-time only.
- C. Forwarded logs cannot be filtered to match specific criteria.
- D. The client retains a local copy of the logs after forwarding.
Answer: B,D
NEW QUESTION 45
What is the recommended method of expanding disk space on a FortiAnalyzer VM?
- A. From the VM host manager, expand the size of the existing virtual disk
- B. From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage
- C. From the VM host manager, expand the size of the existing virtual disk and use the # execute format disk command to reformat the disk
- D. From the VM host manager, add an additional virtual disk and rebuild your RAID array
Answer: B
Explanation:
https://kb.fortinet.com/kb/documentLink.do?externalID=FD40848
NEW QUESTION 46
Refer to the exhibit.
What does the data point at 14:55 tell you?
- A. Raw logs are reaching FortiAnalyzer faster than they can be indexed
- B. Logs are being dropped
- C. The sqlplugind daemon is behind in log indexing by two logs
- D. The received rate is almost at its maximum for this device
Answer: B
NEW QUESTION 47
In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.
How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?
- A. Configure local DNS servers on FortiAnalyzer
- B. Resolve IP addresses on a per-ADOM basis to reduce delay on FortiView while IPs resolve
- C. Resolve IP addresses on FortiGate
- D. Configure # set resolve-ip enable in the system FortiView settings
Answer: D
Explanation:
Explanation/Reference: https://forum.fortinet.com/tm.aspx?m=156950
NEW QUESTION 48
What statements are true regarding the "store and upload" log transfer option between FortiAnalyzer and FortiGate? (Choose three.)
- A. Disk logging is enabled on the FortiGate through the CLI only.
- B. Disk logging is enabled by default on the FortiGate.
- C. All FortiGates can send logs to FortiAnalyzer using the store and upload option.
- D. Only FortiGate models with hard disks can send logs to FortiAnalyzer using the store and upload option.
- E. Both secure communications methods (SSL and IPsec) allow the store and upload option.
Answer: A,D,E
NEW QUESTION 49
On FortiAnalyzer, what is a wildcard administrator account?
- A. An account that allows guest access with read-only privileges
- B. An account that permits access to members of an LDAP group
- C. An account that validates against any user account on a FortiAuthenticator
- D. An account that requires two-factor authentication
Answer: B
Explanation:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/747268/configuring-wildcard-admin-accounts
NEW QUESTION 50
When you perform a system backup, what does the backup configuration contain? (Choose two.)
- A. System information
- B. Authorized devices logs
- C. Generated reports
- D. Device list
Answer: A,D
NEW QUESTION 51
How does FortiAnalyzer retrieve specific log data from the database?
- A. SQL SELECT statement
- B. SQL EXTRACT statement
- C. SQL GET statement
- D. SQL FROM statement
Answer: D
Explanation:
https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/137bb60e-ff37-11e8-8524-f8bc1258b856/fortianalyzer-fortigate-sql-technote-40-mr2.pdf
NEW QUESTION 52
For which two purposes would you use the command set log checksum? (Choose two.)
- A. To prevent log modification or tampering
- B. To encrypt log communications
- C. To send an identical set of logs to a second logging server
- D. To help protect against man-in-the-middle attacks during log upload from FortiAnalyzer to an SFTP server
Answer: A,D
Explanation:
Explanation
To prevent the log in the store from being modified, you can add a log checksum by using the config system global command. When the log is split, archived, and the log is uploaded (if the feature is enabled), you can configure the FortiAnalyzer to log the log file hash value, timestamp, and authentication code. This can help defend against man-in-the-middle attacks when uploading log transmission data from the FortiAnalyzer to the SFTP server.
NEW QUESTION 53
Which two statements about log forwarding are true? (Choose two.)
- A. You can use aggregation mode only with another FortiAnalyzer.
- B. Logs are forwarded in real-time only.
- C. Forwarded logs cannot be filtered to match specific criteria.
- D. The client retains a local copy of the logs after forwarding.
Answer: B,D
Explanation:
Explanation/Reference: www.fortinetguru.com/2020/07/log-forwarding-fortianalyzer-fortios-6-2-3/
NEW QUESTION 54
Which clause is considered mandatory in SELECT statements used by the FortiAnalyzer to generate reports?
- A. LIMIT
- B. FROM
- C. WHERE
- D. ORDER BY
Answer: C
NEW QUESTION 55
You are using RAID with a FortiAnalyzer that supports software RAID, and one of the hard disks on FortiAnalyzer has failed.
What is the recommended method to replace the disk?
- A. Perform a hot swap
- B. Shut down FortiAnalyzer and then replace the disk
- C. Clear all RAID alarms and replace the disk while FortiAnalyzer is still running
- D. Downgrade your RAID level, replace the disk, and then upgrade your RAID level
Answer: A
NEW QUESTION 56
After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the purpose of running the following CLI command?
execute sql-local rebuild-adom <new-ADOM-name>
- A. To reset the disk quota enforcement to default
- B. To remove the analytics logs of the device from the old database
- C. To populate the new ADOM with analytical logs for the moved device, so you can run reports
- D. To migrate the archive logs to the new ADOM
Answer: C
Explanation:
NEW QUESTION 57
......
Latest NSE5_FAZ-6.2 Actual Free Exam Questions Updated 68 Questions: https://www.fast2test.com/NSE5_FAZ-6.2-premium-file.html