eluno

Question 1 of 44

1

On FortiAnalyzer, what is a wildcard administrator account?

Select one of the following:

An account that permits access to members of a LDAP group
An account that allows guest access with read-only privileges
An account that requires two-factor authentication
An account that validates against any user account on a FortiAuthenticator

Explanation

Question 2 of 44

1

Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Select one of the following:

Log forwarding in aggregation mode
log upload
log fetching
Indicators of Compromise

Explanation

Question 3 of 44

1

How does FortiAnalyzer retrieve specific log data from the database?

Select one of the following:

SQL FROM statement
SQL GET statement
SQL SELECT statement
SQL EXTRACT statement

Explanation

Question 4 of 44

1

Logs are being deleted from one of your ADOMs earlier than the configured setting for archiving in data policy. What is the most likely problem?

Select one of the following:

Logs in that ADOM are being forwarded in real-time to another Fortianalyzer device
CPU resources are too high
The ADOM disk quota is set too low based on log rates
The total disk space is insufficient and you need to add other disk

Explanation

Question 5 of 44

1

What FortiView tool can you use to automatically build a dataset and chart based on a filtered search result

Select one of the following:

Chart Builder
Dataset Library
Custom View
Export to Report Chart

Explanation

Question 6 of 44

1

FortiAnalyzer uses the Optimized Fabric Transfer Protocol (OFTP) over SSL for what purpose?

Select one of the following:

To prevent log modification during backup
To send an identical set of logs to a second logging server
To encrypt log communication between devices
To upload logs to a SFTP server

Explanation

Question 7 of 44

1

What is the recommended method of expanding disk space on a FortiAnalyzer VM?

Select one of the following:

From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage
From the VM host manager, expand the size of the existing virtual disk
From the VM host manager, add an additional disk and rebuild your RAID array
From the VM host manager, expand the size of the existing virtual disk and use the #execute format disk command to reformat the disk

Explanation

Question 8 of 44

1

What FortiGate process caches logs when FortiAnalyzer is not reachable?

Select one of the following:

oftpd
miglogd
sqlplugind
logfield

Explanation

Question 9 of 44

1

What is the purpose of the followinf CLI command?

Select one of the following:

To add the MD5´s hash value only
To encrypt log communications
To add unique tag to each log to provide that it came from this FortiAnalyzer
To add a log file checksum

Explanation

Question 10 of 44

1

In FortiAnalyzer´s FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAnalyzer?

Select one of the following:

Configure # set resolve-ip enable in the system FortiView settings
Resolve IPs on FortiGate
Configure local DNS server on FortiAnalyzer
Resolve IPs a per-ADOM basis to reduce delay on FortiView while IPs resolve

Explanation

Question 11 of 44

1

What is the purpose of employing RAID with FortiAnalyzer?

Select one of the following:

To provide data separation between ADOMs
To separate analytical and archive data
To back up your logs
To introduce redundancy to your log data

Explanation

Question 12 of 44

1

What happens when a log file saved on FortiAnalyzer disk reaches the size spechified in the device log settings?

Select one of the following:

The log file is stored as a raw log and is available for analytic support
The log file rolls over and is archived
The log file is purged from the database
The log file is overwritten

Explanation

Question 13 of 44

1

Why is the total quota less than the total system storage?

Select one of the following:

The oftpd process has not archived the logs yet
The logfield process is just estimating the total quota
Some space is reserved for system use, such as storage of compression files, and temporary report files
3.6% of the system storage is already being used

Explanation

Question 14 of 44

1

In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)

Select one or more of the following:

ADOMs must be enabled
Log encryption must be enabled
FortiGate must be registered with FortiAnalyzer
Remote logging must be enabled on FortiGate

Explanation

Question 15 of 44

1

What can the CLI command # diagnose test application oftpd 3 help you to determine?

Select one of the following:

What logs, if any, are reaching FortiAnalyzer
What ADOMs are enabled and configured
What devices and IP addresses are connecting to FortiAnalyzer
What devices are registered and unregistered

Explanation

Question 16 of 44

1

If you upgrade your FortiAnalyzer firmware, what report elements can be affected?

Select one of the following:

Report settings
Report scheduling
Output profiles
Custom datasets

Explanation

Question 17 of 44

1

How are logs forwarded when FortiAnalyzer is using aggregation mode?

Select one of the following:

Logs and content files are stored and uploaded at a schedule time
Logs and content files are forwwarded as they are received
Logs are forwarded ad they are received
Logs are forwarded as they are received and content files are uploaded at a scheduled time

Explanation

Question 18 of 44

1

For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registred devices should:

Select one of the following:

Use DNS
Use host name resolution
Use an NTP server
Use real-time forwarding

Explanation

Question 19 of 44

1

What must you configure on FortiAnalyzer report to a supported external server? (Choose two.)

Select one or more of the following:

Report scheduling
Output profile
SFTP, FTP, or SCP server
Mail server

Explanation

Question 20 of 44

1

What does the 1000 MB maximum for disk utilization refer to?

Select one of the following:

The disk quota for each device in the ADOM
The disk quota for the ADOM type
The disk quota for all devices in the ADOM
The disk quota for thhe FortiAnalyzer model

Explanation

Question 21 of 44

1

What purposes does the auto-cache setting on reports server? (Choose two.)

Select one or more of the following:

To automatically updates the hcache when new logs arrive
To provide diagnostics on report generation time
To reduce the log insert lag rate
To reduce report generation time

Explanation

Question 22 of 44

1

What does the data point at 14:35 tell you?

Select one of the following:

The sqlplugind daemon is ahead in indexing bt one log
FortiAnalyzer is indexing logs faster than logs are being received
FortiAnalyzer is dropping logs
FortiAnalyzer has temporarily stopped receiving logs so older logs can

Explanation

Question 23 of 44

1

You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?

Select one of the following:

FortiAnalyzer resets the disk quota of the new ADOM to default
FortiAnalyzer migrates analytics logs to the new ADOM
FortiAnalyzer removes analytics logs from the old ADOM
FortiAnalyzer migrates archive logs to the new ADOM

Explanation

Question 24 of 44

1

How can you confoigure FortiAnalzyzer to permit administrator logins from only specific locations?

Select one of the following:

Use trusted hosts
use administrative profiles
Use secure protocols
Use static routes

Explanation

Question 25 of 44

1

What are three different methods you can employ to send event notifications when an event occurs that matches aconfigured event handler?

Select one or more of the following:

Email
SMS
SNMP
IM
Syslog

Explanation

Question 26 of 44

1

What is the problem with the following SQL SELECT statement?

SELECT dstip as Destination IP, count(*) as session FROM $log-traffic GROUP BY dstip WHERE - 5filter and dstip is not null.

Select one of the following:

The clauses are not coded in the right sequence.
The clauses are not a log type.
The FROM clause is not required.
SQL queries are case-sensitive.

Explanation

Question 27 of 44

1

What remote authentication servers can you configure to validate your FortiAnalyzer administrator logons? (Choose three)

Select one or more of the following:

RADIUS
Local
LDAP
PKI
TACACS+

Explanation

Question 28 of 44

1

How does the Log View page display logs when ADOMs are enabled?

Select one of the following:

The Log View page displays logs in ADOMs together so they appear as singledevice.
The Log View page displays logs per ADOM.
The Logs View page cannot display raw logs when ADOMs are enabled.
The Log View page cannot display logs h real-time when ADOMs are enabled.

Explanation

Question 29 of 44

1

If RAID isnt supported, what are other types of backup mechanisms ie.methods to preserve your log data in the event of disk failure, deletion, or corruption? (Choose three)

Select one or more of the following:

Backing up logs through the Web-based manager or CLI.
Forwarding logs a syslog server.
Uploading logs to an FTP, SFTP, or SCP server.
Archiving logs.
Enabling full archiving.

Explanation

Question 30 of 44

1

Refer to the exhibits

Select one of the following:

You can't use SQL syntax h the Search field of the FortiView > Log View page.
Case Sensitive Search is enabled.
There are no logs that include https as a service.
You can´t search for logs from the FortiView > Log View page.

Explanation

Question 31 of 44

1

What is "hot swapping"?

Select one of the following:

Hot swapping means administrators can confine FortiAnalyzer to write to allhard device in order to make the array fault tolerant.
Hot swapping means administrators can replace a failed disk on devices that support software RAID while the device is still running.
Hot swapping means administrators can ensue the party data of a redundant drive is valid while the device is still running.
Hot swapping means administrators can replace a fated d* on devices that support hardware RAID while the device is still running.

Explanation

Question 32 of 44

1

What are the limitations when creating a chart using the Custom Chart wizard? (Choose two)

Select one or more of the following:

You cannot search multiple log types (for example, $log-traffic, $log-webfilter).
You cannot select the format of the data - all charts are table charts by default.
You can only create custom charts within the root ADOM only.
You can only select from two variable charts.

Explanation

Question 33 of 44

1

What statements are true regarding Administrative Domains (ADOMs)? (Choose three)

Select one or more of the following:

ADOMs are a way to group devices for administrators to monitor and manage.
Administrators with the standard_user administrator profile can view all ADOMs.
The Web-based navigation changes when ADOMs are enabled.
The admin administrator can assign one device to multiple ADOMs.
The admin administrator can assign more than one ADOM to a single administrator.

Explanation

Question 34 of 44

1

What are the operating modes of FortiAnalyzer? (Choose two)

Select one or more of the following:

Standalone
Manager
Analyzer
Collector

Explanation

Question 35 of 44

1

What should you always do after erasing the configuration on flash?

Select one of the following:

Run the excecute reset all-settings command.
Run the execute reboot command.
Run the execute format disk command.
Perform a system backup.

Explanation

Question 36 of 44

1

Which external servers can you configure to validate administrator logins? (Choose two)

Select one or more of the following:

Syslog.
Administrator logins can only be valdated locally by FortiAnalyzer
RADIUS.
LDAP.

Explanation

Question 37 of 44

1

Which database language does FortiAnalyzer support for the purposes of logging and reporting?

Select one of the following:

LDAP.
SQL.
SSH.
XML.

Explanation

Question 38 of 44

1

Which statements about macros are true? (Choose two.)

Select one or more of the following:

Macros are abbreviated dataset queries.
Macros are supported in FortiGate ADOMs only
Macros do not need to be associated with a chart
Macros cannot be customized

Explanation

Question 39 of 44

1

Which FortiAnalyzer features allow you to automatically build a dataset and based on a filtered search result? (Choose two.)

Select one or more of the following:

Chart Builder.
Export to Report Chart (FortiView).
Dataset Library.
Custom View.

Explanation

Question 40 of 44

1

When you move a FortiGate device from one ADOM to a new ADOM, what is the purpose of rebuilding the new ADOM database?

Select one of the following:

To run reports on the device's analytics logs in the new ADOM.
To remove the device's analytics logs from the old ADOM.
To reset the disk quota enforcement to default
To migrate the archive logs to the new ADOM

Explanation

Question 41 of 44

1

What compreises (makes up) the disk quota?

Select one of the following:

SQL tables and archives files.
Archive logs and analytics logs.
Raw logs, archive files, SQL database tables.
Raw logs and archives files

Explanation

Question 42 of 44

1

What are event handlers?

Select one of the following:

Alert notifications
SNMP traps
Threats identified by FortiGuard
Specific matched conditions in the raw logs

Explanation

Question 43 of 44

1

It is best practice to upload FortiAnalyzer local logs to a remote server. Which remote servers are supported for the upload? (Choose three.)

Select one or more of the following:

SCP
TCP
SFTP
FTP
UDP

Explanation

Question 44 of 44

1

How do you restrict an administrator's access to a subset of your organization's ADOMs?

Select one of the following:

Set the ADOM mode to Advanced.
Configure trusted hosts.
Assign the ADOMs to the administrator´s account.
Assign the default Super_User administrator profile.

	Created by Mauricio Gutierrez almost 7 years ago

unoel

eluno

Question 1 of 44

On FortiAnalyzer, what is a wildcard administrator account?

Select one of the following:

Explanation

Question 2 of 44

Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Select one of the following:

Explanation

Question 3 of 44

How does FortiAnalyzer retrieve specific log data from the database?

Select one of the following:

Explanation

Question 4 of 44

Logs are being deleted from one of your ADOMs earlier than the configured setting for archiving in data policy. What is the most likely problem?

Select one of the following:

Explanation

Question 5 of 44

What FortiView tool can you use to automatically build a dataset and chart based on a filtered search result

Select one of the following:

Explanation

Question 6 of 44

FortiAnalyzer uses the Optimized Fabric Transfer Protocol (OFTP) over SSL for what purpose?

Select one of the following:

Explanation

Question 7 of 44

What is the recommended method of expanding disk space on a FortiAnalyzer VM?

Select one of the following:

Explanation

Question 8 of 44

What FortiGate process caches logs when FortiAnalyzer is not reachable?

Select one of the following:

Explanation

Question 9 of 44

What is the purpose of the followinf CLI command?

Select one of the following:

Explanation

Question 10 of 44

In FortiAnalyzer´s FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAnalyzer?

Select one of the following:

Explanation

Question 11 of 44

What is the purpose of employing RAID with FortiAnalyzer?

Select one of the following:

Explanation

Question 12 of 44

What happens when a log file saved on FortiAnalyzer disk reaches the size spechified in the device log settings?

Select one of the following:

Explanation

Question 13 of 44

Why is the total quota less than the total system storage?

Select one of the following:

Explanation

Question 14 of 44

In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)

Select one or more of the following:

Explanation

Question 15 of 44

What can the CLI command # diagnose test application oftpd 3 help you to determine?

Select one of the following:

Explanation

Question 16 of 44

If you upgrade your FortiAnalyzer firmware, what report elements can be affected?

Select one of the following:

Explanation

Question 17 of 44

How are logs forwarded when FortiAnalyzer is using aggregation mode?

Select one of the following:

Explanation

Question 18 of 44

For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registred devices should:

Select one of the following:

Explanation

Question 19 of 44

What must you configure on FortiAnalyzer report to a supported external server? (Choose two.)

Select one or more of the following:

Explanation

Question 20 of 44

What is the problem with the following SQL SELECT statement?

SELECT dstip as Destination IP, count(*) as session FROM $log-traffic GROUP BY dstip WHERE - 5filter and dstip is not null.