FORTINET-NSE56 Nse5 Fortianalyzer Operations — 10 Questions

Question 1

Which THREE components are required to create a functional FortiSoC Playbook?

Accepted Answer

Workflow Actions. A playbook requires a trigger, a workflow of actions, and a target device or connector.

Answer

Report Template

Answer

Log retention policy

Question 2

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

Accepted Answer

Event rate limiting. Event handlers support 'Threshold' and 'Frequency' settings to prevent alert fatigue.

Answer

Log aggregation

Answer

Database auto-delete

Answer

Log forwarding filter

Question 3

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Accepted Answer

Use the 'Test' button in the Event Handler definition. The 'Test' or 'Filter' verification within the event handler configuration is the primary way to check if logs match the trigger.

Answer

Run a manual report

Answer

Rebuild the SQL database

Answer

Check the FortiAnalyzer system logs

Question 4

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Accepted Answer

Remote server IP address. The server IP and the log format (Syslog) are critical for successful handshakes.

Answer

Log filter criteria

Answer

Enable compression for all logs

Answer

Include device hostname in logs

Question 5

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

Accepted Answer

FortiView Applications. The Applications dashboard in FortiView is designed specifically to aggregate bandwidth usage by application.

Answer

Log View

Answer

FortiView Sources

Answer

FortiView Destinations

Answer

Reports

Question 6

A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?

Accepted Answer

FortiGate log-server configuration. The 'log-server' setting on the FortiGate must be correctly configured to point to the FortiAnalyzer IP.

Answer

Report scheduling

Answer

FortiView update interval

Answer

FortiAnalyzer Device registration status

Question 7

You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?

Accepted Answer

Assign device-based administrative profiles. Restricted ADOMs with granular permissions ensure that data visibility is limited based on the administrator's assigned ADOM and device profile.

Answer

Enable ADOM-level disk quotas

Answer

Use individual management VDOMs for every device

Answer

Enable log encryption per device

Question 8

An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). ADOMs are used to group devices and organize logs into separate logical containers.

Answer

FortiView Filters

Answer

Log Filtering

Answer

Log Forwarding

Question 9

Which protocol is utilized for log forwarding between FortiAnalyzer units?

Accepted Answer

OFTP. FortiAnalyzer uses the proprietary OFTP protocol to securely forward logs between devices.

Answer

SNMP

Answer

Syslog

Answer

HTTPS

Question 10

What is the primary function of the FortiAnalyzer 'Log View' page?

Accepted Answer

Viewing raw log data. Log View provides a raw, searchable view of the logs stored in the database.

Answer

Configuring device passwords

Answer

Creating SOC playbooks

Answer

Generating PDF reports