FORTINET-NSE56 Nse5 Fortianalyzer Operations Practice Test 2 — 15 Questions

Question 1

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Accepted Answer

Log Forwarding. Log forwarding is managed in the Device Manager or under System Settings for log forwarding configurations.

Answer

Device Manager

Answer

FortiView

Answer

Report Settings

Question 2

Which dashboard widget provides a high-level summary of system resource usage?

Accepted Answer

System Information. The 'Dashboard' includes a System Information widget showing CPU/Memory/Disk usage.

Answer

Report Settings

Answer

Log View

Answer

FortiView Threats

Question 3

When scheduling a report, what is the purpose of the 'Output Profile'?

Accepted Answer

Defining report formats and destinations. The output profile determines the format (PDF, HTML, CSV) and the destination of the generated report.

Answer

Configuring data retention

Answer

Setting the report time range

Answer

Adding user permissions

Question 4

Which administrative account type has full access to all ADOMs and system settings?

Accepted Answer

Super_User. The 'Super_User' account has unrestricted access.

Answer

Report Admin

Answer

Log Admin

Answer

Restricted Admin

Question 5

You have a high volume of logs and need to ensure that the oldest logs are deleted first to make room for new data. Where is this configured?

Accepted Answer

ADOM settings. The 'Log Policy' or 'Disk Quota' settings under System Settings define how logs are managed when storage is full.

Answer

FortiView settings

Answer

Log forwarding settings

Answer

Report settings

Question 6

What is the effect of changing an ADOM mode from 'Advanced' to 'Normal'?

Accepted Answer

It simplifies ADOM management. Normal mode simplifies the ADOM by disabling features like per-device log management, but it may require removing devices.

Answer

It forces all devices to reboot

Answer

It increases storage capacity

Answer

It enables full FortiSoC capabilities

Question 7

When troubleshooting a missing log issue in FortiAnalyzer, which CLI command is most useful for checking the status of the log database?

Accepted Answer

diagnose sql status. 'diagnose sql status' is the primary command to check the health and status of the SQL database which stores the logs.

Answer

show system logs

Answer

get log status

Answer

get system status

Question 8

In FortiSoC, what is the purpose of the 'Playbook Trigger'?

Accepted Answer

To define the start condition. The trigger defines the condition (e.g., an event) that initiates the playbook execution.

Answer

To start the logging process

Answer

To generate a report

Answer

To pause the FortiAnalyzer

Question 9

What is the default port used for log transmission from FortiGate to FortiAnalyzer?

Accepted Answer

514. FortiAnalyzer uses TCP port 514 for Syslog, but OFTP/FortiGate-to-Analyzer traffic typically uses port 514 or SSL-encrypted channels.

Answer

443

Answer

80

Answer

8888

Question 10

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

Accepted Answer

Log View. The 'Log View' page shows incoming logs in real-time.

Answer

Report module

Answer

FortiSoC module

Answer

Device Manager

Question 11

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

Accepted Answer

Assign to a specific ADOM. You assign the administrator to an 'Admin Profile' and associate them with a specific ADOM.

Answer

Change their password

Answer

Create a log filter

Answer

Enable 2FA

Question 12

What is the maximum number of ADOMs supported on a FortiAnalyzer?

Accepted Answer

Depends on the model. The number of ADOMs is limited by the specific hardware/VM model and licensing.

Answer

50

Answer

10

Answer

Infinite

Question 13

What does the 'FortiView' module provide?

Accepted Answer

Visual traffic analytics. FortiView provides a visual representation of network traffic and threats.

Answer

Configuration templates

Answer

Raw log data

Answer

Firmware management

Question 14

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

Accepted Answer

To send logs to external systems. It allows you to send logs to a secondary system (like another FortiAnalyzer or a Syslog server).

Answer

To backup the configuration

Answer

To increase report speed

Answer

To reduce CPU usage

Question 15

When should you use 'Log Archive' instead of 'Log Database'?

Accepted Answer

For long-term storage. 'Log Archive' is used for long-term cold storage of raw logs, whereas the database is for active searching.

Answer

For real-time traffic analysis

Answer

For triggering alerts

Answer

For generating daily reports