Get Instant Access to NSE5_FAZ-7.2 Practice Exam Questions
Reliable Study Materials & Testing Engine for NSE5_FAZ-7.2 Exam Success!
NEW QUESTION # 14
In Log View, you can use the Chart Builder feature to build a dataset and chart based on the filtered search results.
Similarly, which feature you can use for FortiView?
- A. Export to PDF
- B. Export to Custom Chart
- C. Export to Report Chart
- D. Export to Chart Builder
Answer: C
Explanation:
Reference:
Similar to the Chart Builder feature in Log View, you can export a chart from a FortiView. The chart export includes any filters you set on the FortiView. FortiAnalyzer_7.0_Study_Guide-Online pag. 292.
NEW QUESTION # 15
Refer to the exhibit.
The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster.
What can you conclude from the configuration displayed?
- A. This FortiAnalyzer is configured to receive logs in its port1.
- B. This FortiAnalyzer will trigger a failover after losing communication with its peers for 10 seconds.
- C. After joining to the cluster, this FortiAnalyzer will keep an updated log database.
- D. This FortiAnalyzer will join to the existing HA cluster as the primary.
Answer: A
Explanation:
"If the preferred role is Primary, then this unit becomes the primary unit if it is configured first in a new HA cluster. If there is an existing primary unit, then this unit becomes a secondary unit." (https://docs.fortinet.com/document/fortianalyzer/7.0.5/administration-guide/275104)
NEW QUESTION # 16
For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered devices should:
- A. Use real-time forwarding
- B. Use host name resolution
- C. Use an NTP server
- D. Use DNS
Answer: C
NEW QUESTION # 17
FortiAnalyzer centralizes which functions? (Choose three)
- A. Vulnerability assessment
- B. Network analysis
- C. Content archiving / data mining
- D. Security log analysis / forensics
- E. Graphical reporting
Answer: C,D,E
NEW QUESTION # 18
What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?
- A. There is no need to do anything because the disk will self-recover.
- B. Hot swap the disk.
- C. Shut down FortiAnalyzer and replace the disk
- D. Run execute format disk to format and restart the FortiAnalyzer device.
Answer: B
Explanation:
https://help.fortinet.com/fa/faz50hlp/56/5-6-2/FMG-FAZ/0700_RAID/0800_Swapping%20Disks.htm#:~:text=If%20a%20hard%20disk%20on,to%20exchanging%20the%20hard%20disk.
NEW QUESTION # 19
What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?
- A. A new Infected entry is added for the corresponding endpoint.
- B. FortiAnalyzer flags the associated host for further analysis.
- C. The detection engine classifies those logs as Suspicious
- D. The endpoint is marked as Compromised and. optionally, can be put in quarantine.
Answer: D
NEW QUESTION # 20
If you upgrade the FortiAnalyzer firmware, which report element can be affected?
- A. Report settings
- B. Output profiles
- C. Custom datasets
- D. Report scheduling
Answer: C
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/upgrade-guide/669300/checking-reports
NEW QUESTION # 21
Refer to the exhibit.
The exhibit shows "remoteservergroup" is an authentication server group with LDAP and RADIUS servers.
Which two statements express the significance of enabling "Match all users on remote server" when configuring a new administrator? (Choose two.)
- A. Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.
- B. It creates a wildcard administrator using LDAP and RADIUS servers.
- C. Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.
- D. It allows administrators to use two-factor authentication.
Answer: A,B
NEW QUESTION # 22
What is required to authorize a FortiGate on FortiAnalyzer using Fabric authorization?
- A. A pre-shared key
- B. Valid FortiAnalyzer credentials
- C. The FortiGate serial number
- D. A FortiGate ADOM
Answer: B
Explanation:
FortiAnalyzer_7.0_Study_Guide-Online.pdf page 93: The fourth method uses the Fortinet Security Fabric authorization process. This method requires that both FortiGate and FortiAnalyzer are running version 7.0.1 or higher. It is also required that the FortiGate administrator has valid credentials to log in on FortiAnalyzer and complete the registration.
https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/13897/adding-a-fortigate-using-security-fabric-authorization
NEW QUESTION # 23
What purposes does the auto-cache setting on reports serve? (Choose two.)
- A. To reduce the log insert lag rate
- B. To reduce report generation time
- C. To provide diagnostics on report generation time
- D. To automatically update the hcache when new logs arrive
Answer: B,D
NEW QUESTION # 24
Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?
- A. You can perform the firmware upgrade using only a console connection.
- B. Both FortiAnalyzer devices will be upgraded at the same time.
- C. You can enable uninterruptible-upgrade so that the normal FortiAnalyzer operations are not interrupted while the cluster firmware upgrades.
- D. First, upgrade the secondary device, and then upgrade the primary device.
Answer: D
Explanation:
FortiAnalyzer_7.0_Study_Guide-Online.pdf page 64: To upgrade FortiAnalyzer HA cluster firmware:
1. Log in to each secondary device.
2. Upgrade the firmware of all secondary devices.
3. Wait for the upgrades to complete and verify that all secondary devices joined the cluster.
4. Verify that logs on all secondary devices are synchronized with the primary device.
5. Upgrade the primary device.
https://docs.fortinet.com/document/fortianalyzer/7.2.0/upgrade-guide/262607/upgrading-fortianalyzer-firmware
NEW QUESTION # 25
In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)
- A. ADOMs must be enabled
- B. FortiGate must be registered with FortiAnalyzer
- C. Log encryption must be enabled
- D. Remote logging must be enabled on FortiGate
Answer: B,D
Explanation:
Pg 70: "after you add and register a FortiGate device with the FortiAnalyzer unit, you must also ensure that the FortiGate device is configured to send logs to the FortiAnalyzer unit."
https://docs.fortinet.com/uploaded/files/4614/FortiAnalyzer-5.4.6-Administration%20Guide.pdf Pg 45: "ADOMs must be enabled to support the logging and reporting of NON-FORTIGATE devices, such as FortiCarrier, FortiClientEMS, FortiMail, FortiWeb, FortiCache, and FortiSandbox."
NEW QUESTION # 26
Which statement about the FortiSIEM management extension is correct?
- A. It requires a licensed FortiSIEM supervisor.
- B. Its use of the available disk space is capped at 50%.
- C. Allows you to manage the entire life cycle of a threat or breach.
- D. It can be installed as a dedicated VM.
Answer: C
NEW QUESTION # 27
Which tabs do not appear when FortiAnalyzer is operating in Collector mode?
- A. Device Manger
- B. Event Management
- C. FortiView
- D. Reporting
Answer: B
NEW QUESTION # 28
What must you consider when using log fetching? (Choose two.)
- A. The archive logs retrieved from the server become archive logs in the client.
- B. You can use filters to include only logs from a single device.
- C. The fetch client can retrieve logs from devices that are not added to its local Device Manager
- D. The fetching profile must include a user with the Super_User profile.
Answer: B,D
NEW QUESTION # 29
Which two constraints can impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)
- A. Disk size
- B. License type
- C. RAID level
- D. Total quota
Answer: A,C
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/368682/disk-space-allocation
NEW QUESTION # 30
Which statement about sending notifications with incident updates is true?
- A. Notifications can be sent only when an incident is created or deleted.
- B. Each incident can send notifications to a single external platform.
- C. You must configure an output profile to send notifications by email.
- D. Each connector used can have different notification settings.
Answer: D
NEW QUESTION # 31
Which two statements about log forwarding are true? (Choose two.)
- A. You can use aggregation mode only with another FortiAnalyzer.
- B. Logs are forwarded in real-time only.
- C. Forwarded logs cannot be filtered to match specific criteria.
- D. The client retains a local copy of the logs after forwarding.
Answer: A,D
Explanation:
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/420493/modes
https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/621804/log-forwarding
NEW QUESTION # 32
......
Fortinet NSE5_FAZ-7.2 exam is designed for individuals who want to become Fortinet NSE 5 certified as FortiAnalyzer 7.2 Analysts. Fortinet NSE 5 - FortiAnalyzer 7.2 Analyst certification is meant for professionals who want to showcase their expertise in managing and analyzing Fortinet security devices using FortiAnalyzer 7.2. NSE5_FAZ-7.2 exam ensures that the candidates have the necessary skills to configure, manage and analyze data from Fortinet devices.
Validate your Skills with Updated NSE5_FAZ-7.2 Exam Questions & Answers and Test Engine: https://www.vcetorrent.com/NSE5_FAZ-7.2-valid-vce-torrent.html
Tested & Approved NSE5_FAZ-7.2 Study Materials Download: https://drive.google.com/open?id=1JmQNclMdXmefkV1bXeMGWlrSbk6EFk-M