FORTINET-NSE56 Nse5 Fortianalyzer Operations Practice Test 3 — 15 Questions

Question 1

An administrator finds that the disk usage is at 95% and the FortiAnalyzer has stopped receiving new logs. What is the default behavior when the disk reaches the 'Maximum Storage' limit?

Accepted Answer

Overwriting old logs. By default, FortiAnalyzer performs 'Log Overwrite' when the disk is full, but this behavior can be configured.

Answer

Shutdown the device

Answer

Alert via SNMP only

Answer

Pause all services

Question 2

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

Accepted Answer

ADOM Log Policy. Each ADOM has its own 'Log Policy' or 'Disk Quota' configuration.

Answer

FortiView Filters

Answer

Report Settings

Answer

Global System Settings

Question 3

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Accepted Answer

Provisioning Templates. 'Provisioning Templates' allow centralized configuration management.

Answer

Log Forwarding

Answer

Report scheduling

Answer

ADOM grouping

Question 4

Which component of FortiAnalyzer is used to identify top talkers on the network?

Accepted Answer

FortiView. FortiView's 'Sources' or 'Destinations' widgets show traffic volume rankings.

Answer

System Dashboard

Answer

Log View

Answer

Event Handler

Question 5

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Accepted Answer

Playbook Execution logs. The 'Playbook Execution' view provides logs for each task performed by a playbook.

Answer

Device manager logs

Answer

System logs

Answer

FortiView

Question 6

What is the purpose of an 'Event Handler' in FortiAnalyzer?

Accepted Answer

To generate alerts. Event handlers monitor incoming logs and trigger alerts when specific conditions are met.

Answer

To push firmware

Answer

To store logs

Answer

To clear disk space

Question 7

What is the function of the 'Device Manager' in FortiAnalyzer?

Accepted Answer

To manage registered devices. Device Manager is where Fortinet devices are registered and their connection status is monitored.

Answer

To view live threats

Answer

To create playbooks

Answer

To run reports

Question 8

What happens to the logs if a FortiAnalyzer reaches its 'Maximum Storage' limit?

Accepted Answer

They are overwritten (by default). The system follows the configured 'Log Policy', which usually defaults to deleting the oldest logs.

Answer

The FortiGate blocks all traffic

Answer

They are moved to a USB drive

Answer

The FortiAnalyzer reboots

Question 9

When using 'Log Forwarding', can you filter the logs before they are forwarded?

Accepted Answer

Yes, using log filters. Yes, you can apply filters to log forwarding profiles to only send specific traffic types.

Answer

Only for FortiAnalyzer destinations

Answer

No, all logs are forwarded

Answer

Only for Syslog

Question 10

Which dashboard shows the health status of all registered devices?

Accepted Answer

Device Manager. The Device Manager dashboard provides a quick view of the status of all registered devices.

Answer

FortiView

Answer

Reports

Answer

Event Handler

Question 11

What is the purpose of 'Report Templates'?

Accepted Answer

To provide consistent report formats. Report templates provide predefined structures for generating consistent reports.

Answer

To update firmware

Answer

To filter logs

Answer

To configure alerts

Question 12

When configuring an 'Event Handler' with a 'Threshold', what does the 'Count' field represent?

Accepted Answer

The number of matches. The count field specifies the number of occurrences of an event that must happen before an alert is triggered.

Answer

The total number of logs

Answer

The priority of the alert

Answer

The time window in seconds

Question 13

Which protocol does FortiAnalyzer primarily use for Web UI access?

Accepted Answer

HTTPS. FortiAnalyzer uses HTTPS for secure web management.

Answer

SSH

Answer

FTP

Answer

HTTP

Question 14

If a user is locked out of the FortiAnalyzer GUI, which command is used to unlock the account?

Accepted Answer

execute user unlock. Using the CLI as an admin, you can use 'execute user unlock <username>' or reset the password via the system admin account.

Answer

config system admin

Answer

get system status

Answer

set password

Question 15

How can you verify that a FortiGate is sending logs to the FortiAnalyzer?

Accepted Answer

By checking the log status in Device Manager. Check the 'Log View' or 'Device Manager' for active log status.

Answer

By checking the interface status

Answer

By looking at the routing table

Answer

By running a report