FORTINET-NSE56 Nse5 Fortianalyzer Operations Practice Test 3 — 15 Questions

Question 1

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

Accepted Answer

It cannot run reports. In FortiAnalyzer, 'Collector' mode is designed purely for high-volume log collection and forwarding/storage — it does not include the analytics and reporting engine. As a result, a FortiAnalyzer operating in Collector mode cannot generate reports, run log-based analytics, or provide the full GUI reporting features available in Analyzer mode. This mode is typically used in large distributed environments where a dedicated collector forwards logs to a central analyzer.

Answer

It cannot forward logs

Answer

It cannot store logs

Answer

It cannot receive logs from FortiGate

Question 2

A customer wants to offload logs from FortiAnalyzer to a remote Syslog server. Where is this configured?

Accepted Answer

Log Forwarding. Log Forwarding is the FortiAnalyzer feature that sends logs to an external syslog server, CEF server, or another FortiAnalyzer. It is configured under the Log Forwarding section, where you define the remote server address, port, protocol, and which log types to forward. This is the standard way to offload logs for long-term retention or third-party SIEM ingestion.

Answer

Device Manager

Answer

FortiView

Answer

Report Settings

Question 3

Which dashboard widget provides a high-level summary of system resource usage?

Accepted Answer

System Information. The System Information dashboard widget in FortiGate displays a high-level summary of system resource usage, including CPU utilization, memory usage, disk usage, and session counts. It provides administrators with an at-a-glance view of the device's health and performance metrics directly on the dashboard.

Answer

Report Settings

Answer

Log View

Answer

FortiView Threats

Question 4

When scheduling a report, what is the purpose of the 'Output Profile'?

Accepted Answer

Defining report formats and destinations. In FortiAnalyzer/FortiManager report scheduling, the Output Profile defines how the finished report is rendered and where it is delivered — for example PDF, CSV, or XML format, and whether it is emailed, saved to a share, or uploaded to a remote server. It is the delivery/formatting layer of the report job, separate from the data selection and time window.

Answer

Configuring data retention

Answer

Setting the report time range

Answer

Adding user permissions

Question 5

Which administrative account type has full access to all ADOMs and system settings?

Accepted Answer

Super_User. The Super_User administrative profile in FortiManager/FortiAnalyzer has full read-write access to all ADOMs and all system settings, including device management, policy packages, and system configuration. It is the highest-privilege built-in account type and is not restricted to any single ADOM or functional area. This is why Super_User is the correct answer for full access across ADOMs and system settings.

Answer

Report Admin

Answer

Log Admin

Answer

Restricted Admin

Question 6

Where do you go to view the real-time logs currently being received by the FortiAnalyzer?

Accepted Answer

Log View. Log View is the FortiAnalyzer module that displays logs as they are received, with real-time refresh and filtering by ADOM, device, log type, and time. It is the direct equivalent of a live log console and is where administrators confirm that logs are actually arriving from a FortiGate. The other modules serve analytics, management, or reporting purposes.

Answer

Report module

Answer

FortiSoC module

Answer

Device Manager

Question 7

You need to restrict an administrator to only viewing reports for a specific ADOM. How do you achieve this?

Accepted Answer

Assign to a specific ADOM. In FortiManager, administrative access is scoped by ADOM (Administrative Domain). To restrict an administrator to only view reports for a specific ADOM, you must assign that administrator to the desired ADOM and configure their permission profile to allow read-only access to reports within that ADOM. This ensures the admin can only see data and reports from that ADOM, not others. Options like changing password, creating a log filter, or enabling 2FA do not affect ADOM-level access control.

Answer

Change their password

Answer

Create a log filter

Answer

Enable 2FA

Question 8

What is the maximum number of ADOMs supported on a FortiAnalyzer?

Accepted Answer

Depends on the model. The maximum number of ADOMs (Administrative Domains) on a FortiAnalyzer is not a fixed number — it depends on the FortiAnalyzer hardware model or VM license tier. Entry-level appliances support fewer ADOMs, while high-end models and larger VM licenses support many more, so 'Depends on the model' is the correct answer.

Answer

50

Answer

10

Answer

Infinite

Question 9

What does the 'FortiView' module provide?

Accepted Answer

Visual traffic analytics. FortiView is FortiAnalyzer's visual analytics module that provides dashboards, drill-down charts, and interactive views of traffic, threats, applications, and user activity. It transforms raw log data into visual traffic analytics, allowing administrators to quickly identify top talkers, threat patterns, and bandwidth consumers without writing queries.

Answer

Configuration templates

Answer

Raw log data

Answer

Firmware management

Question 10

What is the purpose of 'Log Forwarding' in FortiAnalyzer?

Accepted Answer

To send logs to external systems. Log Forwarding in FortiAnalyzer enables the appliance to relay received logs to external destinations such as syslog servers, CEF collectors, or another FortiAnalyzer. This is essential for integrating FortiAnalyzer into a broader SIEM ecosystem (e.g., Splunk, ArcSight) or for long-term archival on external storage. The feature does not alter local storage, CPU, or configuration backup behavior — it simply duplicates/forwards log streams to configured remote endpoints.

Answer

To backup the configuration

Answer

To increase report speed

Answer

To reduce CPU usage

Question 11

When should you use 'Log Archive' instead of 'Log Database'?

Accepted Answer

For long-term storage. Log Archive is designed for long-term storage and compliance retention, storing logs in a compressed format that is not indexed for fast querying. Log Database, by contrast, is optimized for real-time analysis and fast searches. Therefore, Log Archive should be used when the primary requirement is long-term retention rather than immediate analytics.

Answer

For real-time traffic analysis

Answer

For triggering alerts

Answer

For generating daily reports

Question 12

If you need to change the log storage retention period for a specific ADOM, where is this setting located?

Accepted Answer

ADOM Log Policy. In FortiAnalyzer, log retention is configured per ADOM under the ADOM's Log Policy settings (ADOM Log Policy), where you define the retention period, disk quota, and log rollover behavior for that specific ADOM. This allows different ADOMs to have different retention windows based on compliance or operational needs.

Answer

FortiView Filters

Answer

Report Settings

Answer

Global System Settings

Question 13

Which feature in the Device Manager allows you to push configuration changes to multiple FortiGate devices at once?

Accepted Answer

Provisioning Templates. Provisioning Templates in FortiManager's Device Manager let you define reusable configuration templates (e.g., system settings, interface configs, firewall objects) and apply them to multiple FortiGate devices or device groups at once. This is the intended feature for bulk-pushing configuration changes across many devices.

Answer

Log Forwarding

Answer

Report scheduling

Answer

ADOM grouping

Question 14

Which component of FortiAnalyzer is used to identify top talkers on the network?

Accepted Answer

FortiView. FortiView is FortiAnalyzer's analytics module that aggregates logs into visual dashboards showing top talkers, top applications, top destinations, and threat activity. It is specifically designed to answer 'who is using the most bandwidth or generating the most sessions' by ranking sources, destinations, and applications. The other modules are for raw log inspection, device management, or automated alerting.

Answer

System Dashboard

Answer

Log View

Answer

Event Handler

Question 15

A playbook is failing to execute an action on a FortiGate. Which tool is used to view the execution history and logs of the playbook?

Accepted Answer

Playbook Execution logs. FortiSOAR (and FortiGate's automation stitches) maintain dedicated Playbook Execution logs that record each playbook run, the actions executed, their results, and any errors. When a playbook fails to execute an action, the Playbook Execution logs are the correct place to inspect the execution history and diagnose the failure.

Answer

Device manager logs

Answer

System logs

Answer

FortiView