Best Preparations of NSE5_FAZ-6.2 Exam 2021 Network Security Analyst Unlimited 68 Questions
Focus on NSE5_FAZ-6.2 All-in-One Exam Guide For Quick Preparation.
For more info read reference:
Exam Blueprint Preparatory Course FAQs and Guide
NEW QUESTION 39
Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?
- A. IPS logs
- B. Application control logs
- C. Web filter logs
- D. Antivirus logs
Answer: C
Explanation:
Reference:
FortiAnalyzer_Admin_Guide/3600_FortiView/0200_Using_FortiView/1200_Compromised_hosts_page.htm?
TocPath=FortiView%7CUsing%20FortiView%7C_____6
NEW QUESTION 40
View the exhibit.
Why is the total quota less than the total system storage?
- A. The oftpd process has not archived the logs yet
- B. Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files
- C. 3.6% of the system storage is already being used.
- D. The logfiled process is just estimating the total quota
Answer: B
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/368682/disk-space-allocation
NEW QUESTION 41
View the exhibit.
Why is the total quota less than the total system storage?
- A. The oftpd process has not archived the logs yet
- B. Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files
- C. 3.6% of the system storage is already being used.
- D. The logfiled process is just estimating the total quota
Answer: B
NEW QUESTION 42
How can you configure FortiAnalyzer to permit administrator logins from only specific locations?
- A. Use administrative profiles
- B. Use static routes
- C. Use secure protocols
- D. Use trusted hosts
Answer: D
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/186508/trusted-hosts
NEW QUESTION 43
In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.
How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?
- A. Configure local DNS servers on FortiAnalyzer
- B. Resolve IP addresses on a per-ADOM basis to reduce delay on FortiView while IPs resolve
- C. Resolve IP addresses on FortiGate
- D. Configure # set resolve-ip enable in the system FortiView settings
Answer: D
NEW QUESTION 44
What is the purpose of the following CLI command?
- A. To add a unique tag to each log to prove that it came from this FortiAnalyzer
- B. To add a log file checksum
- C. To encrypt log communications
- D. To add the MD's hash value and authentication code
Answer: B
Explanation:
https://docs2.fortinet.com/document/fortianalyzer/6.0.3/cli-reference/849211/global
NEW QUESTION 45
For which two purposes would you use the command set log checksum? (Choose two.)
- A. To encrypt log communications
- B. To prevent log modification or tampering
- C. To send an identical set of logs to a second logging server
- D. To help protect against man-in-the-middle attacks during log upload from FortiAnalyzer to an SFTP server
Answer: A,B
NEW QUESTION 46
Logs are being deleted from one of your ADOMs earlier that the configured setting for archiving in your data policy. What is the most likely problem?
- A. CPU resources are too high.
- B. The ADOM disk quota is set too low based on log rates.
- C. The total disk space is insufficient and you need to add other disk.
- D. Logs in that ADOM are being forwarded in real-time to another FortiAnalyzer device.
Answer: B
NEW QUESTION 47
View the exhibit.
What does the data point at 14:35 tell you?
- A. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.
- B. FortiAnalyzer is dropping logs.
- C. FortiAnalyzer is indexing logs faster than logs are being received.
- D. The sqlplugind daemon is ahead in indexing by one log.
Logs are received then they are indexed, no logging server in the world can index logs faster than they are received. When FAZ receives raw logs, they are inserted (indexed) by the SQL database and the sqlplugind daemon, this graph shows that FAZ received 3 logs and sqlplugind indexed 4.
Answer: D
NEW QUESTION 48
Refer to the exhibit.
What does the data point at 14:55 tell you?
- A. The sqlplugind daemon is behind in log indexing by two logs
- B. Logs are being dropped
- C. The received rate is almost at its maximum for this device
- D. Raw logs are reaching FortiAnalyzer faster than they can be indexed
Answer: D
NEW QUESTION 49
What is the purpose of the following CLI command?
- A. To add a unique tag to each log to prove that it came from this FortiAnalyzer
- B. To add a log file checksum
- C. To encrypt log communications
- D. To add the MD's hash value and authentication code
Answer: B
NEW QUESTION 50
How are logs forwarded when FortiAnalyzer is using aggregation mode?
- A. Logs and content files are stored and uploaded at a scheduled time.
- B. Logs and content files are forwarded as they are received.
- C. Logs are forwarded as they are received.
- D. Logs are forwarded as they are received and content files are uploaded at a scheduled time.
Answer: A
Explanation:
https://www.fortinetguru.com/2020/07/log-forwarding-fortianalyzer-fortios-6-2-3/
https://docs.fortinet.com/document/fortianalyzer/6.2.0/administration-guide/420493/modes
NEW QUESTION 51
What FortiGate process caches logs when FortiAnalyzer is not reachable?
- A. sqlplugind
- B. logfiled
- C. miglogd
- D. oftpd
Answer: C
NEW QUESTION 52
View the exhibit.
What does the data point at 14:35 tell you?
- A. FortiAnalyzer has temporarily stopped receiving logs so older logs' can be indexed.
- B. The sqlplugind daemon is ahead in indexing by one log.
- C. FortiAnalyzer is dropping logs.
- D. FortiAnalyzer is indexing logs faster than logs are being received.
Answer: B
Explanation:
Explanation
Logs are received then they are indexed, no logging server in the world can index logs faster than they are received. When FAZ receives raw logs, they are inserted (indexed) by the SQL database and the sqlplugind daemon, this graph shows that FAZ received 3 logs and sqlplugind indexed 4.
NEW QUESTION 53
On the RAID management page, the disk status is listed as Initializing.
What does the status Initializing indicate about what the FortiAnalyzer is currently doing?
- A. FortiAnalyzer is writing data to a newly added hard drive to restore it to an optimal state
- B. FortiAnalyzer is functioning normally
- C. FortiAnalyzer is writing to all of its hard drives to make the array fault tolerant
- D. FortiAnalyzer is ensuring that the parity data of a redundant drive is valid
Answer: C
NEW QUESTION 54
Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)
- A. SSL is the default setting.
- B. SSL encryption levels are globally set on FortiAnalyzer.
- C. FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.
- D. SSL communications are auto-negotiated between the two devices.
- E. SSL can send logs in real-time only.
Answer: A,B
NEW QUESTION 55
Which two constraints can impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)
- A. Disk size
- B. RAID level
- C. License type
- D. Total quota
Answer: A,B
NEW QUESTION 56
What statements are true regarding the "store and upload" log transfer option between FortiAnalyzer and FortiGate? (Choose three.)
- A. Disk logging is enabled on the FortiGate through the CLI only.
- B. Disk logging is enabled by default on the FortiGate.
- C. All FortiGates can send logs to FortiAnalyzer using the store and upload option.
- D. Only FortiGate models with hard disks can send logs to FortiAnalyzer using the store and upload option.
- E. Both secure communications methods (SSL and IPsec) allow the store and upload option.
Answer: A,D,E
NEW QUESTION 57
For which two SAML roles can the FortiAnalyzer be configured? (Choose two.)
- A. Identity collector
- B. Identity provider
- C. Service provider
- D. Principal
Answer: B,C
Explanation:
Reference:
20the%20identity%20provider%20(IdP,external%20identity%20provider%20is%20available.
https://docs.fortinet.com/document/fortianalyzer/6.2.0/administration-guide/981386/saml-admin-authentication
NEW QUESTION 58
You need to upgrade your FortiAnalyzer firmware.
What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?
- A. FortiGate uses the miglogd process to cache the logs
- B. FortiAnalyzer uses log fetching to retrieve the logs when back online
- C. Logs are dropped
- D. The logfiled process stores logs in offline mode
Answer: A
Explanation:
NEW QUESTION 59
What is the recommended method of expanding disk space on a FortiAnalyzer VM?
- A. From the VM host manager, expand the size of the existing virtual disk
- B. From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage
- C. From the VM host manager, expand the size of the existing virtual disk and use the # execute format disk command to reformat the disk
- D. From the VM host manager, add an additional virtual disk and rebuild your RAID array
Answer: B
NEW QUESTION 60
Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally?
(Choose two.)
- A. Output profile
- B. SFTP server
- C. Report scheduling
- D. Mail server
Answer: A,B
NEW QUESTION 61
What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?
- A. Real-time forwarding
- B. Host name resolution
- C. Log collection
- D. Log correlation
Answer: A
NEW QUESTION 62
What is the purpose of a dataset query in FortiAnalyzer?
- A. It sorts log data into tables
- B. It injects log data into the database
- C. It extracts the database schema
- D. It retrieves log data from the database
Answer: D
NEW QUESTION 63
......
How to book the Fortinet NSE 5 - FortiAnalyzer (NSE5 FAZ-6.2) Exam
Follow the steps below to register for the Fortinet NSE 5 - FortiAnalyzer (NSE5 FAZ-6.2) Exam:
- Step 1: Visit Fortinet’s website from here
- Step 2: From the panel on the right, click “Book the Exams”
- Step 3: Scroll down and click the register option
- Step 4: Create your account on the website, log in if you already have one
- Step 5: Select your exam, i.e., NSE5 FAZ-6.2 exam test
- Step 6: Pay and schedule your exam
- Step 7: Buy NSE5 FAZ-6.2 dumps pdf and take NSE5 FAZ-6.2 practice test
Guaranteed Success with NSE5_FAZ-6.2 Dumps: https://www.test4engine.com/NSE5_FAZ-6.2_exam-latest-braindumps.html