FORTINET-NSE56 Nse5 Fortianalyzer Operations Practice Test 4 — 15 Questions

Question 1

Which menu path is used to create a new Administrator account?

Accepted Answer

System Settings > Admin. 'System Settings' -> 'Admin' -> 'Administrators' is the standard path.

Answer

Device Manager

Answer

Report Settings

Answer

FortiSoC

Question 2

When setting up a 'FortiSoC' playbook to send an email, what must be configured first?

Accepted Answer

The SMTP server settings. You must set up the 'Mail Server' or 'SMTP' settings in the System Settings to allow the FortiAnalyzer to send emails.

Answer

The report schedule

Answer

The log forwarder

Answer

The ADOM mode

Question 3

What is the purpose of 'Auto-cache' for reports?

Accepted Answer

To speed up report generation. Auto-cache pre-calculates the data for a report to ensure it can be generated quickly on demand.

Answer

To compress logs

Answer

To alert admins

Answer

To save logs to disk

Question 4

When adding a FortiGate to a FortiAnalyzer, which information is required?

Accepted Answer

Device serial number. You need the serial number and the IP/registration configuration on the FortiGate side.

Answer

The admin password of the FortiAnalyzer

Answer

The SQL database password

Answer

The log file format

Question 5

What happens when you change the 'Log Policy' to 'Archive only'?

Accepted Answer

Real-time analysis stops. The FortiAnalyzer will stop inserting logs into the SQL database, making them unavailable for reports and FortiView, storing them only as raw files.

Answer

Logs are deleted

Answer

The system reboots

Answer

The system automatically upgrades

Question 6

Which of the following is true about 'Report Data Masking'?

Accepted Answer

It masks sensitive information. Data masking allows you to hide sensitive information (like internal IPs or usernames) in reports while maintaining the ability to see trends.

Answer

It encrypts the report file

Answer

It deletes the logs

Answer

It hides the entire report

Question 7

What is a 'Playbook' in the context of FortiSoC?

Accepted Answer

An automated incident response workflow. A playbook is an automated sequence of tasks designed to respond to security incidents.

Answer

A report template

Answer

A device registration script

Answer

A log storage policy

Question 8

Which dashboard provides a 'Threat Map'?

Accepted Answer

FortiView. The FortiView 'Threat Map' shows real-time global threat activity.

Answer

Report module

Answer

Device Manager

Answer

Log View

Question 9

A user reports that they cannot see any data in 'FortiView' for a specific device. What is the most likely cause?

Accepted Answer

The ADOM selection is incorrect. If logs are not being indexed or if the device is not registered, FortiView cannot display data. Also, ensure the ADOM is selected correctly.

Answer

The FortiGate is powered off

Answer

The report is still running

Answer

The FortiAnalyzer is too slow

Question 10

Which TWO actions are commonly performed within the 'Device Manager' module?

Accepted Answer

Monitoring device connection status. Device Manager is for registering devices and managing their connection status.

Answer

Creating custom reports

Answer

Archiving old log files

Answer

Configuring event handlers

Question 11

Which TWO methods can be used to authenticate administrative users on FortiAnalyzer?

Accepted Answer

LDAP. FortiAnalyzer supports both local authentication and external directory services (LDAP/RADIUS).

Answer

FTP

Answer

DHCP

Answer

Syslog

Question 12

Which THREE items are found in the 'System Settings' area?

Accepted Answer

Administrators. System Settings contains global configurations like administrators, mail servers, and maintenance tasks.

Answer

Report templates

Answer

FortiView widget configuration

Question 13

If you want to ensure that only authorized administrators can access the FortiAnalyzer GUI, which feature should you implement?

Accepted Answer

Trusted hosts. Trusted hosts and multifactor authentication (MFA) are the primary security controls for administrative access.

Answer

Log encryption

Answer

ADOM mode switching

Answer

Report scheduling

Question 14

Which TWO actions can be triggered by a FortiSoC Playbook?

Accepted Answer

Sending an email notification. Playbooks can perform actions like notifying an admin via email or updating a security object on a FortiGate.

Answer

Deleting the ADOM

Answer

Changing system time

Answer

Rebooting the FortiAnalyzer

Question 15

Which THREE features are available when FortiAnalyzer is configured in 'Analyzer' mode?

Accepted Answer

Report generation. Analyzer mode provides the full set of FortiAnalyzer features, including reports, SOC, and analysis.

Answer

Collector-only mode

Answer

Hardware acceleration