NSE5_FAZ-7.2: Fortinet NSE 5 -FortiAnalyzer 7-2.VCEPlus

Which two statements are true regarding ADOM modes? (Choose two.)

You can only change ADOM modes through CLI.
In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM.
In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.
Normal mode is the default ADOM mode.

Correct answer: CD

Explanation:

Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-1/FMGFAZ/0800_ADOMs/0400_ADOM%20Device%20Modes.htm

Which two statements are true regarding FortiAnalyzer log forwarding? (Choose two.)

Both modes, forwarding and aggregation, support encryption of logs between devices.
In aggregation mode, you can forward logs to syslog and CEF servers as well.
Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.
Forwarding mode forwards logs in real time only to other FortiAnalyzer devices.

Correct answer: AC

Explanation:

A) FortiAnalyzer_7.0_Study_Guide-Online.pdf page 148: The log communication between devices can be protected by encryption, with the desired encryption level, using the commands shown on the slide. (You need to interpret this. "Real time" and "aggregation" is about the "moment" when Fortigate sends the logs. However, no matter the moment, Fortigate will upload logs encrypted or unencrypted based on previous / differente config). C) FortiAnalyzer_7.0_Study_Guide-Online.pdf page 147: Aggregation: Logs and content files stored and uploaded at scheduled time.

A) FortiAnalyzer_7.0_Study_Guide-Online.pdf page 148: The log communication between devices can be protected by encryption, with the desired encryption level, using the commands shown on the slide. (You need to interpret this. "Real time" and "aggregation" is about the "moment" when Fortigate sends the logs. However, no matter the moment, Fortigate will upload logs encrypted or unencrypted based on previous / differente config).

C) FortiAnalyzer_7.0_Study_Guide-Online.pdf page 147: Aggregation: Logs and content files stored and uploaded at scheduled time.

An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.

What should the administrator do to solve this issue?

Use the execute sql-local rebuild-db command to rebuild all ADOM databases.
Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.
Use the execute sql-report run ADOM1 command to run a report.
Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

Correct answer: B

Explanation:

Reference: https://help.fortinet.com/fmgr/cli/5-6-1/FortiManager_CLI_Reference/700_execute/sqllocal+.htm

Reference: https://help.fortinet.com/fmgr/cli/5-6-1/FortiManager_CLI_Reference/700_execute/sqllocal+.

htm

Which statement is true regarding Macros on FortiAnalyzer?

Macros are ADOM specific and each ADOM will have unique macros relevant to that ADOM.
Macros are supported only on the FortiGate ADOM.
Macros are useful in generating excel log files automatically based on the reports settings.
Macros are predefined templates for reports and cannot be customized.

Correct answer: A

Explanation:

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 283: Note that macros are ADOM-specific and supported in FortiGate and FortiCarrier ADOMs only.

Which two statements are true regarding FortiAnalyzer operating modes? (Choose two.)

When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.
Collector mode is the default operating mode.
When in collector mode. FortiAnalyzer supports event management and reporting features.
By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting

Correct answer: AD

Explanation:

Reference: https://docs.fortinet.com/document/fortianalyzer/7.0.0/administrationguide/227478/collector-modehttps://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/312644/analyzercollector-collaboration

Reference:

https://docs.fortinet.com/document/fortianalyzer/7.0.0/administrationguide/227478/collector-mode

https://docs.fortinet.com/document/fortianalyzer/7.0.0/administration-guide/312644/analyzercollector-collaboration

Refer to the exhibit.

The exhibit shows "remoteservergroup" is an authentication server group with LDAP and RADIUS servers.

Which two statements express the significance of enabling "Match all users on remote server" when configuring a new administrator? (Choose two.)

It creates a wildcard administrator using LDAP and RADIUS servers.
Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.
Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.
It allows administrators to use two-factor authentication.

Correct answer: AB

Explanation:

Reference: https://docs.fortinet.com/document/fortimanager/7.0.1/administrationguide/858351/creating-administrators

A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer.

What can you do on FortiAnalyzer to accomplish this?

Click FortiView and generate a report for that administrator.
Click Task Monitor and view the tasks performed by that administrator.
Click Log View and generate a report for that administrator.
View the tasks performed by the rogue administrator in Fabric View.

Correct answer: B

Explanation:

Reference: https://docs.fortinet.com/document/fortimanager/6.4.1/administrationguide/792943/task-monitorFortiAnalyzer_7.0_Study_Guide-Online.pdf page 54: View the tasks FortiAnalyzer administrators have performed, including progress and status.

Reference: https://docs.fortinet.com/document/fortimanager/6.4.1/administrationguide/792943/task-monitor

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 54: View the tasks FortiAnalyzer administrators have performed, including progress and status.

The admin administrator is failing to register a FortiClient EMS on the FortiAnalyzer device.

What can be the reason for this failure?

FortiAnalyzer is in an HA cluster.
ADOM mode should be set to advanced, in order to register the FortiClient EMS device.
ADOMs are not enabled on FortiAnalyzer.
A separate license is required on FortiAnalyzer in order to register the FortiClient EMS device.

Correct answer: C

Explanation:

Reference: https://help.fortinet.com/fa/faz50hlp/56/5-6-2/FMGFAZ/0800_ADOMs/0015_FortiClient%20and%20ADOMs.htm

Refer to the exhibit.

Which two statements are true regarding enabling auto-cache on FortiAnalyzer? (Choose two.)

Report size will be optimized to conserve disk space on FortiAnalyzer.
Reports will be cached in the memory.
This feature is automatically enabled for scheduled reports.
Enabling auto-cache reduces report generation time for reports that require a long time to assemble datasets.

Correct answer: CD

Explanation:

"Enable auto-cache in the report settings to boost the reporting performance and reduce report generation time. Scheduled reports have auto-cache enabled already." FortiAnalyzer_7.0_Study_Guide-Online page 306

"Enable auto-cache in the report settings to boost the reporting performance and reduce report generation time. Scheduled reports have auto-cache enabled already."

FortiAnalyzer_7.0_Study_Guide-Online page 306

Which two statements are true regarding high availability (HA) on FortiAnalyzer? (Choose two.)

FortiAnalyzer HA can function without VRRP. and VRRP is required only if you have more than two FortiAnalyzer devices in a cluster.
FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.
All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector.
FortiAnalyzer HA implementation is supported by many public cloud infrastructures such as AWS, Microsoft Azure, and Google Cloud.

Correct answer: BC

Explanation:

Reference: https://help.fortinet.com/fa/faz50hlp/60/6-0-2/Content/FMGFAZ/4600_HA/0000_HA.htm?TocPath=High%20Availability%7C_____0FortiAnalyzer HA implementation works only in networks where Virtual Router Redundancy Protocol (VRRP) is permitted. Therefore it may not be supported by some public cloud infrastructures.

Reference: https://help.fortinet.com/fa/faz50hlp/60/6-0-2/Content/FMGFAZ/4600_HA/0000_HA.htm?TocPath=High%20Availability%7C_____0

FortiAnalyzer HA implementation works only in networks where Virtual Router Redundancy Protocol (VRRP) is permitted. Therefore it may not be supported by some public cloud infrastructures.