FORTINET-NSE56 Nse5 Fortianalyzer Operations — Timed 15 Questions

Question 1

Which THREE components are required to create a functional FortiSoC Playbook?

Accepted Answer

Workflow Actions. A playbook requires a trigger, a workflow of actions, and a target device or connector.

Answer

Report Template

Answer

Log retention policy

Question 2

You are configuring an Event Handler to monitor for failed login attempts. To ensure you do not receive too many alerts for the same source IP in a short duration, what should you configure?

Accepted Answer

Event rate limiting. Event handlers support 'Threshold' and 'Frequency' settings to prevent alert fatigue.

Answer

Log aggregation

Answer

Database auto-delete

Answer

Log forwarding filter

Question 3

You are troubleshooting a scenario where an Event Handler is not triggering as expected. What is the most effective way to verify if the logs are matching the filter criteria defined in the handler?

Accepted Answer

Use the 'Test' button in the Event Handler definition. The 'Test' or 'Filter' verification within the event handler configuration is the primary way to check if logs match the trigger.

Answer

Run a manual report

Answer

Rebuild the SQL database

Answer

Check the FortiAnalyzer system logs

Question 4

When configuring log forwarding from FortiAnalyzer to a remote Syslog server, which TWO of the following parameters must be correctly configured to ensure the remote server accepts the logs?

Accepted Answer

Remote server IP address. The server IP and the log format (Syslog) are critical for successful handshakes.

Answer

Log filter criteria

Answer

Enable compression for all logs

Answer

Include device hostname in logs

Question 5

An administrator needs to identify which application is consuming the most bandwidth on the network. Which feature in FortiView provides the most efficient visual representation for this task?

Accepted Answer

FortiView Applications. The Applications dashboard in FortiView is designed specifically to aggregate bandwidth usage by application.

Answer

Log View

Answer

FortiView Sources

Answer

FortiView Destinations

Answer

Reports

Question 6

A FortiAnalyzer is failing to receive logs from a FortiGate. After verifying the IP connectivity and the FortiGate registration status, which setting should be checked next?

Accepted Answer

FortiGate log-server configuration. The 'log-server' setting on the FortiGate must be correctly configured to point to the FortiAnalyzer IP.

Answer

Report scheduling

Answer

FortiView update interval

Answer

FortiAnalyzer Device registration status

Question 7

You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?

Accepted Answer

Assign device-based administrative profiles. Restricted ADOMs with granular permissions ensure that data visibility is limited based on the administrator's assigned ADOM and device profile.

Answer

Enable ADOM-level disk quotas

Answer

Use individual management VDOMs for every device

Answer

Enable log encryption per device

Question 8

An administrator needs to organize logs from multiple regional FortiGate devices into separate containers based on their geography. Which feature should be configured?

Accepted Answer

Administrative Domains (ADOMs). ADOMs are used to group devices and organize logs into separate logical containers.

Answer

FortiView Filters

Answer

Log Filtering

Answer

Log Forwarding

Question 9

Which protocol is utilized for log forwarding between FortiAnalyzer units?

Accepted Answer

OFTP. FortiAnalyzer uses the proprietary OFTP protocol to securely forward logs between devices.

Answer

SNMP

Answer

Syslog

Answer

HTTPS

Question 10

What is the primary function of the FortiAnalyzer 'Log View' page?

Accepted Answer

Viewing raw log data. Log View provides a raw, searchable view of the logs stored in the database.

Answer

Configuring device passwords

Answer

Creating SOC playbooks

Answer

Generating PDF reports

Question 11

When using FortiSoC playbooks, what is the 'Connector' used for?

Accepted Answer

Integrating with external systems. Connectors are used to integrate FortiAnalyzer with external systems like FortiGate or email servers for automated actions.

Answer

Filtering log traffic

Answer

Managing device firmware

Answer

Linking logs to reports

Question 12

Which FortiView tool allows you to see traffic patterns based on geographical origin?

Accepted Answer

Sources (Map View). The 'Sources' or 'Map' widget in FortiView provides visual geographic location data.

Answer

Event Handler

Answer

Reports

Answer

Log View

Question 13

You are trying to delete an ADOM, but the option is greyed out. What is the most likely cause?

Accepted Answer

The ADOM contains devices. An ADOM cannot be deleted if there are still devices registered within it.

Answer

The ADOM is set to 'Read-Only'

Answer

The ADOM has log data

Answer

The administrator lacks super_admin rights

Question 14

If a FortiAnalyzer is in 'Collector' mode, what is its primary limitation?

Accepted Answer

It cannot run reports. Collector mode is optimized for log reception and forwarding, but it cannot generate reports.

Answer

It cannot forward logs

Answer

It cannot store logs

Answer

It cannot receive logs from FortiGate

Question 15

You need to create a custom report that includes historical traffic data spanning six months. What must be configured to ensure the report generation does not time out?

Accepted Answer

Report cache. Enabling 'Report Data Masking' or using 'Report Cache' improves performance for long-duration reports.

Answer

FortiView data archiving

Answer

Log archive compression

Answer

ADOM mode change