FORTINET-NSE56 Nse5 Fortianalyzer Operations — 20 Questions

Question 1

You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign device-based administrative profiles. Assigning device-based administrative profiles ensures that administrators only have access to the devices (and thus logs) within their assigned device groups, enforcing segregation within the ADOM. This is the setting that restricts log data access between different device groups so that one administrator cannot view another group's logs. It directly addresses the requirement for strict data segregation at the administrative level.

Answer

Enable ADOM-level disk quotas

Answer

Use individual management VDOMs for every device

Answer

Enable log encryption per device

Question 2

An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow you to logically partition devices, policies, and logs into separate administrative containers. By assigning FortiGate devices from different regions to distinct ADOMs, their logs are stored and managed separately, satisfying the geography-based organization requirement. ADOMs are the only feature among the options that provides this multi-tenant, container-level separation for both configuration and logs.

Answer

FortiView Filters

Answer

Log Filtering

Answer

Log Forwarding

Question 3

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. To prevent report generation from timing out when querying six months of historical traffic data, you must configure the report cache, which stores precomputed report data and allows the report to be generated from cached results rather than querying the full log database in real time. This significantly reduces processing time and avoids timeout errors.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change

Question 4

You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?

Accepted Answer

ADOM settings. In FortiAnalyzer, log retention and rollover behavior — including the setting to delete the oldest logs first when storage is full — is configured at the ADOM (Administrative Domain) level. Each ADOM has its own disk quota and log roll settings, so the 'delete oldest first' behavior is governed there.

Answer

FortiView settings

Answer

Log forwarding settings

Answer

Report settings

Question 5

What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?

Accepted Answer

It simplifies ADOM management. Changing an ADOM mode from Advanced to Normal simplifies ADOM management by consolidating to a single ADOM structure where all devices share the same database and configuration scope, removing the segmentation that Advanced mode provides. Normal mode is the default and is easier to administer for smaller or less complex deployments. This simplification is the documented effect of the mode change.

Answer

It forces all devices to reboot

Answer

It increases storage capacity

Answer

It enables full FortiSoC capabilities

Question 6

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Accepted Answer

diagnose sql status. `diagnose sql status` queries the FortiAnalyzer SQL database daemon directly, reporting whether the log database is running, its connection state, and any errors — exactly what is needed when logs stop appearing. It is the standard CLI diagnostic for log database health.

Answer

show system logs

Answer

get log status

Answer

get system status

Question 7

In FortiSoC, what is the purpose of the 'Playbook Trigger'?

Accepted Answer

To define the start condition. In FortiSOAR, a Playbook Trigger defines the specific condition or event that causes a playbook to execute automatically. It acts as the starting point of the automation workflow, evaluating incoming alerts, incidents, or other system events against defined criteria (such as severity, source, or type) to determine when the playbook should run. Without a trigger, the playbook would have no defined start condition and would not initiate on its own.

Answer

To start the logging process

Answer

To generate a report

Answer

To pause the FortiAnalyzer

Question 8

What is the default port used for log transmission from FortiGate to FortiAnalyzer?

Accepted Answer

514. FortiGate sends logs to FortiAnalyzer over UDP or TCP port 514 by default using the syslog protocol (OFTP rides on top of this channel). Port 514 is the IANA-assigned syslog port, and FortiAnalyzer listens on it for incoming device logs. Administrators can change this under config log fortianalyzer setting, but 514 is the out-of-the-box value.

Answer

443

Answer

80

Answer

8888

Question 9

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Accepted Answer

Overwriting old logs. When FortiAnalyzer reaches its Maximum Storage limit, the default behavior is to overwrite the oldest logs to make room for new ones, so log ingestion continues rather than halting. This rolling behavior is controlled by the 'When log disk is full' setting, which defaults to overwrite.

Answer

Shutdown the device

Answer

Alert via SNMP only

Answer

Pause all services

Question 10

If a user is locked out of the FortiAnalyzer GUI, which command is used to unlock the account?

Accepted Answer

execute user unlock. The 'execute user unlock' command in FortiAnalyzer CLI unlocks a GUI or CLI admin account that has been locked due to repeated failed login attempts. It resets the lockout state without changing the password, allowing the legitimate administrator to log in again. This is the documented recovery method when lockout policy (e.g., three failed attempts) has been triggered.

Answer

config system admin

Answer

get system status

Answer

set password

Question 11

Which THREE features are available when FortiAnalyzer is configured in 'Analyzer' mode?

Accepted Answer

Report generation. In FortiAnalyzer 'Analyzer' mode, the device performs full analysis functions, so report generation (B) is available because Analyzer mode includes the reporting engine that lets you create and schedule reports from collected logs. Log forwarding (C) is also available in Analyzer mode, since the FortiAnalyzer can forward received logs to external syslog servers, CEF servers, or other FortiAnalyzers for aggregation or archival. FortiSoC playbooks (D) are supported in Analyzer mode because this mode enables the automation and orchestration features used to trigger playbooks based on events and alerts. Collector-only mode (A) is not a feature of Analyzer mode; it describes a separate operating mode where the device only receives and stores logs without analysis. Hardware acceleration (E) is not a FortiAnalyzer Analyzer-mode feature; it is a platform/hardware capability, not a mode-specific software feature.

Answer

Collector-only mode

Answer

Hardware acceleration

Question 12

Which TWO of these are valid administrative roles in FortiAnalyzer?

Accepted Answer

Log_Admin. FortiAnalyzer ships with predefined administrative profiles, and Log_Admin (C) is a valid one: it grants read/write access to log-related functions such as log browsing, log forwarding, and log file management without granting full system control. Super_User (E) is also a valid FortiAnalyzer admin profile, providing full read/write access to all FortiAnalyzer features and settings, effectively the all-powerful administrator role. The remaining options are not FortiAnalyzer administrative roles: Storage_Manager (A) is not a defined profile (storage is handled via RAID/disk settings under system administration), Firewall_Admin (B) is not a FortiAnalyzer role (it resembles a FortiGate/FortiManager concept), and Report_Guest (D) is not a valid profile name, since report access is controlled by profiles such as Report_User or restricted read-only admin accounts.

Answer

Storage_Manager

Answer

Firewall_Admin

Answer

Report_Guest

Question 13

Which TWO items are required to configure log forwarding to a remote FortiAnalyzer?

Accepted Answer

Remote server IP address. Option B (Remote server IP address) is correct because configuring log forwarding to a remote FortiAnalyzer requires specifying the FortiAnalyzer's reachable IP address (or FQDN) as the destination under config log fortianalyzer setting, so the FortiGate knows where to send its logs. Option E (Authentication key) is correct because FortiGate-to-FortiAnalyzer communication must be authorized via a shared registration/authentication key (set with the enc-algorithm and auth key on both devices) so the FortiAnalyzer accepts the device's log stream. The current report schedule (A) only governs when reports are generated locally and has no bearing on log transport, a copy of the local firmware (C) is irrelevant to log forwarding configuration, and an SNMP community string (D) is used for SNMP polling/traps, not for FortiAnalyzer log forwarding.

Answer

The current report schedule

Answer

A copy of the local firmware

Answer

SNMP community string

Question 14

Which TWO protocols are commonly used for external communication with FortiAnalyzer?

Accepted Answer

SSH. SSH (B) is correct because FortiAnalyzer supports secure command-line administration and log forwarding over TCP port 22, making it a standard protocol for external management and communication. HTTPS (E) is correct because FortiAnalyzer's web-based GUI and many API/FortiGate-to-FortiAnalyzer log and management exchanges use TLS on TCP port 443 for secure external access. Telnet (A) is not used because it is unencrypted and FortiAnalyzer does not rely on it for external communication. POP3 (C) is a mail retrieval protocol and has no role in FortiAnalyzer communications. HTTP (D) is not the external web protocol used, since FortiAnalyzer enforces HTTPS for its GUI and API access.

Answer

Telnet

Answer

POP3

Answer

HTTP

Question 15

Which THREE settings are part of an ADOM's configuration?

Accepted Answer

Assigned Devices. In FortiManager, an ADOM (Administrative Domain) is defined by its ADOM Name (E), which uniquely identifies the domain, and its ADOM Mode (D), which determines whether it operates in Normal, Backup, or Advanced mode and thus what objects and features are available. Assigned Devices (B) is also part of an ADOM's configuration because devices must be explicitly assigned to an ADOM to be managed within it, and this assignment defines the scope of the domain. Report server IP (A) is not an ADOM setting; report servers are configured globally or per-report, not as an ADOM attribute. Firmware version (C) is a property of the managed devices themselves, not a configurable setting of the ADOM.

Answer

Report server IP

Answer

Firmware version

Question 16

Which TWO actions can be taken when an event handler triggers?

Accepted Answer

Log the event. Option A (Log the event) is correct because an event handler in FortiGate automation stitches can write the triggering event to the local event log or syslog, preserving an audit trail of what occurred. Option E (Send an email) is correct because event handlers support email notification actions, allowing administrators to be alerted in real time when the defined trigger fires. These two are standard, non-disruptive response actions available for automation stitches. Options B (Delete the logs), C (Auto-patch the FGT), and D (Reboot the device) are not valid event-handler actions: deleting logs would destroy evidence, FortiGate does not auto-patch firmware via event handlers, and rebooting is a disruptive manual operation not offered as an event-handler response.

Answer

Delete the logs

Answer

Auto-patch the FGT

Answer

Reboot the device

Question 17

Which THREE types of information are displayed in the System Information widget?

Accepted Answer

Firmware version. The System Information widget in FortiGate/FortiManager dashboards is designed to show the device's identity and health at a glance. Option B (Firmware version) is correct because the widget displays the currently running FortiOS/FortiManager firmware build, which is essential for verifying version and upgrade status. Option C (Resource usage (CPU/RAM)) is correct because the widget includes live CPU and memory utilization meters, allowing administrators to monitor performance in real time. Option D (System uptime) is correct because the widget shows how long the system has been running since the last reboot, which helps assess stability and recent restarts. Option A (ADOM mode) is not part of this widget; ADOM mode is an administrative/management setting shown elsewhere, such as in system settings or the ADOM list. Option E (Log forwarding destination) is not displayed here either; log forwarding targets are configured under Log & Report settings, not in the System Information widget.

Answer

ADOM mode

Answer

Log forwarding destination

Question 18

Which TWO FortiAnalyzer tools help in troubleshooting connection issues?

Accepted Answer

Device Manager. Option B, Device Manager, is correct because it lets you verify and manage the FortiGate's connectivity status to FortiAnalyzer, including checking whether the device is authorized/registered and whether its logs are being received, which directly helps isolate connection problems between the device and the analyzer. Option C, CLI tools such as ping and get sys status, is correct because these commands let you test reachability (e.g., ping the FortiAnalyzer IP or FQDN) and inspect system health, interface, and service status to pinpoint where a connection failure originates. Option A, Log View, is not a troubleshooting tool for connection issues; it is used to browse and analyze already-collected log entries. Option D, Report module, is for generating scheduled or on-demand reports and does not diagnose connectivity. Option E, FortiView map, is a visualization of traffic and threat data, not a tool for resolving connection problems.

Answer

Log View

Answer

Report module

Answer

FortiView map

Question 19

An analyst must investigate an incident that occurred three weeks ago on a FortiGate managed by FortiAnalyzer. The FortiGate's local logs have already rotated out, but the FortiAnalyzer log database still contains the relevant entries. Which FortiAnalyzer workflow is most appropriate for reconstructing the timeline of the incident?

Accepted Answer

Use Log View with a filtered search on the affected device and the incident time range, then pivot on relevant fields to correlate events.. FortiAnalyzer's retained log database plus Log View filtering is the intended path for historical investigations. Scoping by device and time, then pivoting on correlated fields, reconstructs the sequence of events even after the source device has discarded its own copies.

Answer

Export the entire ADOM log database to a CSV file and search it manually in a spreadsheet.

Answer

Generate a scheduled report covering the last 30 days and review the summary charts for anomalies.

Answer

Run a real-time monitor on the FortiGate to observe current traffic matching the incident signature.

Question 20

Which THREE components are required to create a functional FortiSoC Playbook?

Accepted Answer

Workflow Actions. A FortiSoC playbook requires Workflow Actions (A), which are the individual executable steps such as running a CLI command, querying a log, or sending a notification that define what the playbook actually does. It also requires a Target Connector/Device (D), which specifies the endpoint, firewall, or integrated tool where those actions are executed, providing the connection and credentials needed for the workflow to run. Finally, a Playbook Trigger (E) is mandatory because it defines the event or condition (for example, an alert, incident, or manual invocation) that starts the playbook; without a trigger the workflow would never execute. A Report Template (B) is only used for generating formatted reports and is not a playbook building block, and a Log retention policy (C) governs how long log data is stored rather than how a playbook is constructed or launched.

Answer

Report Template

Answer

Log retention policy