FORTINET-NSE56 Nse5 Fortianalyzer Operations Practice Test 1 — 15 Questions

Question 1

You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Assign device-based administrative profiles. Assigning device-based administrative profiles ensures that administrators only have access to the devices (and thus logs) within their assigned device groups, enforcing segregation within the ADOM. This is the setting that restricts log data access between different device groups so that one administrator cannot view another group's logs. It directly addresses the requirement for strict data segregation at the administrative level.

Answer

Enable ADOM-level disk quotas

Answer

Use individual management VDOMs for every device

Answer

Enable log encryption per device

Question 2

An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). Administrative Domains (ADOMs) in FortiManager allow you to logically partition devices, policies, and logs into separate administrative containers. By assigning FortiGate devices from different regions to distinct ADOMs, their logs are stored and managed separately, satisfying the geography-based organization requirement. ADOMs are the only feature among the options that provides this multi-tenant, container-level separation for both configuration and logs.

Answer

FortiView Filters

Answer

Log Filtering

Answer

Log Forwarding

Question 3

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. To prevent report generation from timing out when querying six months of historical traffic data, you must configure the report cache, which stores precomputed report data and allows the report to be generated from cached results rather than querying the full log database in real time. This significantly reduces processing time and avoids timeout errors.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change

Question 4

You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?

Accepted Answer

ADOM settings. In FortiAnalyzer, log retention and rollover behavior — including the setting to delete the oldest logs first when storage is full — is configured at the ADOM (Administrative Domain) level. Each ADOM has its own disk quota and log roll settings, so the 'delete oldest first' behavior is governed there.

Answer

FortiView settings

Answer

Log forwarding settings

Answer

Report settings

Question 5

What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?

Accepted Answer

It simplifies ADOM management. Changing an ADOM mode from Advanced to Normal simplifies ADOM management by consolidating to a single ADOM structure where all devices share the same database and configuration scope, removing the segmentation that Advanced mode provides. Normal mode is the default and is easier to administer for smaller or less complex deployments. This simplification is the documented effect of the mode change.

Answer

It forces all devices to reboot

Answer

It increases storage capacity

Answer

It enables full FortiSoC capabilities

Question 6

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Accepted Answer

diagnose sql status. `diagnose sql status` queries the FortiAnalyzer SQL database daemon directly, reporting whether the log database is running, its connection state, and any errors — exactly what is needed when logs stop appearing. It is the standard CLI diagnostic for log database health.

Answer

show system logs

Answer

get log status

Answer

get system status

Question 7

In FortiSoC, what is the purpose of the 'Playbook Trigger'?

Accepted Answer

To define the start condition. In FortiSOAR, a Playbook Trigger defines the specific condition or event that causes a playbook to execute automatically. It acts as the starting point of the automation workflow, evaluating incoming alerts, incidents, or other system events against defined criteria (such as severity, source, or type) to determine when the playbook should run. Without a trigger, the playbook would have no defined start condition and would not initiate on its own.

Answer

To start the logging process

Answer

To generate a report

Answer

To pause the FortiAnalyzer

Question 8

What is the default port used for log transmission from FortiGate to FortiAnalyzer?

Accepted Answer

514. FortiGate sends logs to FortiAnalyzer over UDP or TCP port 514 by default using the syslog protocol (OFTP rides on top of this channel). Port 514 is the IANA-assigned syslog port, and FortiAnalyzer listens on it for incoming device logs. Administrators can change this under config log fortianalyzer setting, but 514 is the out-of-the-box value.

Answer

443

Answer

80

Answer

8888

Question 9

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Accepted Answer

Overwriting old logs. When FortiAnalyzer reaches its Maximum Storage limit, the default behavior is to overwrite the oldest logs to make room for new ones, so log ingestion continues rather than halting. This rolling behavior is controlled by the 'When log disk is full' setting, which defaults to overwrite.

Answer

Shutdown the device

Answer

Alert via SNMP only

Answer

Pause all services

Question 10

If a user is locked out of the FortiAnalyzer GUI, which command is used to unlock the account?

Accepted Answer

execute user unlock. The 'execute user unlock' command in FortiAnalyzer CLI unlocks a GUI or CLI admin account that has been locked due to repeated failed login attempts. It resets the lockout state without changing the password, allowing the legitimate administrator to log in again. This is the documented recovery method when lockout policy (e.g., three failed attempts) has been triggered.

Answer

config system admin

Answer

get system status

Answer

set password

Question 11

Which THREE features are available when FortiAnalyzer is configured in 'Analyzer' mode?

Accepted Answer

Report generation. In FortiAnalyzer 'Analyzer' mode, the device performs full analysis functions, so report generation (B) is available because Analyzer mode includes the reporting engine that lets you create and schedule reports from collected logs. Log forwarding (C) is also available in Analyzer mode, since the FortiAnalyzer can forward received logs to external syslog servers, CEF servers, or other FortiAnalyzers for aggregation or archival. FortiSoC playbooks (D) are supported in Analyzer mode because this mode enables the automation and orchestration features used to trigger playbooks based on events and alerts. Collector-only mode (A) is not a feature of Analyzer mode; it describes a separate operating mode where the device only receives and stores logs without analysis. Hardware acceleration (E) is not a FortiAnalyzer Analyzer-mode feature; it is a platform/hardware capability, not a mode-specific software feature.

Answer

Collector-only mode

Answer

Hardware acceleration

Question 12

Which TWO of these are valid administrative roles in FortiAnalyzer?

Accepted Answer

Log_Admin. FortiAnalyzer ships with predefined administrative profiles, and Log_Admin (C) is a valid one: it grants read/write access to log-related functions such as log browsing, log forwarding, and log file management without granting full system control. Super_User (E) is also a valid FortiAnalyzer admin profile, providing full read/write access to all FortiAnalyzer features and settings, effectively the all-powerful administrator role. The remaining options are not FortiAnalyzer administrative roles: Storage_Manager (A) is not a defined profile (storage is handled via RAID/disk settings under system administration), Firewall_Admin (B) is not a FortiAnalyzer role (it resembles a FortiGate/FortiManager concept), and Report_Guest (D) is not a valid profile name, since report access is controlled by profiles such as Report_User or restricted read-only admin accounts.

Answer

Storage_Manager

Answer

Firewall_Admin

Answer

Report_Guest

Question 13

Which TWO items are required to configure log forwarding to a remote FortiAnalyzer?

Accepted Answer

Remote server IP address. Option B (Remote server IP address) is correct because configuring log forwarding to a remote FortiAnalyzer requires specifying the FortiAnalyzer's reachable IP address (or FQDN) as the destination under config log fortianalyzer setting, so the FortiGate knows where to send its logs. Option E (Authentication key) is correct because FortiGate-to-FortiAnalyzer communication must be authorized via a shared registration/authentication key (set with the enc-algorithm and auth key on both devices) so the FortiAnalyzer accepts the device's log stream. The current report schedule (A) only governs when reports are generated locally and has no bearing on log transport, a copy of the local firmware (C) is irrelevant to log forwarding configuration, and an SNMP community string (D) is used for SNMP polling/traps, not for FortiAnalyzer log forwarding.

Answer

The current report schedule

Answer

A copy of the local firmware

Answer

SNMP community string

Question 14

Which TWO protocols are commonly used for external communication with FortiAnalyzer?

Accepted Answer

SSH. SSH (B) is correct because FortiAnalyzer supports secure command-line administration and log forwarding over TCP port 22, making it a standard protocol for external management and communication. HTTPS (E) is correct because FortiAnalyzer's web-based GUI and many API/FortiGate-to-FortiAnalyzer log and management exchanges use TLS on TCP port 443 for secure external access. Telnet (A) is not used because it is unencrypted and FortiAnalyzer does not rely on it for external communication. POP3 (C) is a mail retrieval protocol and has no role in FortiAnalyzer communications. HTTP (D) is not the external web protocol used, since FortiAnalyzer enforces HTTPS for its GUI and API access.

Answer

Telnet

Answer

POP3

Answer

HTTP

Question 15

Which THREE settings are part of an ADOM's configuration?

Accepted Answer

Assigned Devices. In FortiManager, an ADOM (Administrative Domain) is defined by its ADOM Name (E), which uniquely identifies the domain, and its ADOM Mode (D), which determines whether it operates in Normal, Backup, or Advanced mode and thus what objects and features are available. Assigned Devices (B) is also part of an ADOM's configuration because devices must be explicitly assigned to an ADOM to be managed within it, and this assignment defines the scope of the domain. Report server IP (A) is not an ADOM setting; report servers are configured globally or per-report, not as an ADOM attribute. Firmware version (C) is a property of the managed devices themselves, not a configurable setting of the ADOM.

Answer

Report server IP

Answer

Firmware version