Weekend Special Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code: 70special

Fortinet FCP_FAZ_AD-7.4 FCP - FortiAnalyzer 7.4 Administrator Exam Practice Test

FCP - FortiAnalyzer 7.4 Administrator Questions and Answers

Testing Engine

  • Product Type: Testing Engine
$37.5  $124.99

PDF Study Guide

  • Product Type: PDF Study Guide
$33  $109.99
Question 1

Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

Options:

A.

Must configure the FortiAnalyzer end of the tunnel only--the FortiGate end is auto-negotiated.

B.

Must establish an IPsec tunnel ID and pre-shared key.

C.

IPsec cannot be enabled if SSL is enabled as well.

D.

IPsec is only enabled through the CLI on FortiAnalyzer.

Question 2

Refer to the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

Options:

A.

To add a new chart under FortiView to be used in new reports

B.

To build a dataset and chart automatically, based on the filtered search results

C.

To add charts directly to generate reports in the current ADOM

D.

To build a chart automatically based on the top 100 log entries

Question 3

Which statement describes online logs on FortiAnalyzer?

Options:

A.

Logs that reached a specific size and were rolled over

B.

Logs that can be used to create reports

C.

Logs that can be viewed using Log Browse

D.

Logs that are saved to disk, compressed, and available in FortiView

Question 4

An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.

What should the administrator do to solve this issue?

Options:

A.

Use the execute sql-local rebuild-db command to rebuild all ADOM databases.

B.

Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.

C.

Use the execute sql-report run ADOM1 command to run a report.

D.

Use the execute sql-local rebuild-adom root command to rebuild the ADOM database.

Question 5

What purposes does the auto-cache setting on reports serve? (Choose two.)

Options:

A.

To reduce report generation time

B.

To automatically update the hcache when new logs arrive

C.

To reduce the log insert lag rate

D.

To provide diagnostics on report generation time

Question 6

In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)

Options:

A.

Remote logging must be enabled on FortiGate

B.

Log encryption must be enabled

C.

ADOMs must be enabled

D.

FortiGate must be registered with FortiAnalyzer

Question 7

Which two statements are true regarding FortiAnalyzer operating modes? (Choose two.)

Options:

A.

When in collector mode, FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.

B.

Collector mode is the default operating mode.

C.

When in collector mode. FortiAnalyzer supports event management and reporting features.

D.

By deploying different FortiAnalyzer devices with collector and analyzer mode in a network, you can improve the overall performance of log receiving, analysis, and reporting

Question 8

Which two statements about log forwarding are true? (Choose two.)

Options:

A.

Forwarded logs cannot be filtered to match specific criteria.

B.

Logs are forwarded in real-time only.

C.

The client retains a local copy of the logs after forwarding.

D.

You can use aggregation mode only with another FortiAnalyzer.

Question 9

Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally?

(Choose two.)

Options:

A.

Mail server

B.

Output profile

C.

SFTP server

D.

Report scheduling

Question 10

In FortiAnalyzer’s FormView, source and destination IP addresses from FortiGate devices are not resolving to

a hostname. How can you resolve the source and destination IPs, without introducing any additional

performance impact to FortiAnalyzer?

Options:

A.

Configure local DNS servers on FortiAnalyzer

B.

Resolve IPs on FortiGate

C.

Configure # set resolve-ip enable in the system FortiView settings

D.

Resolve IPs on a per-ADOM basis to reduce delay on FortiView while IPs resolve

Question 11

What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

Options:

A.

There is no need to do anything because the disk will self-recover.

B.

Run execute format disk to format and restart the FortiAnalyzer device.

C.

Perform a hot swap of the disk.

D.

Shut down FortiAnalyzer and replace the disk.

Question 12

Refer to the exhibit.

The exhibit shows the creation of a new administrator on FortiAnalyzer. The new account uses the credentials stored on an LDAP server.

Why would an administrator configure a password for this account?

Options:

A.

This password is used if the authentication server becomes unreachable.

B.

This password authenticates FortiAnalyzer aqainst the LDAP server.

C.

This password is set to comply with FortiAnalvzer password policy

D.

This password is required because this is a restricted user.

Question 13

Which two statements are true regarding the outbreak detection service? (Choose two.)

Options:

A.

New alerts are received by email.

B.

Outbreak alerts are available on the root ADOM only.

C.

An additional license is required.

D.

It automatically downloads new event handlers and reports.

Question 14

In Log View, you can use the Chart Builder feature to build a dataset and chart based on the filtered search results.

Similarly, which feature you can use for FortiView?

Options:

A.

Export to Report Chart

B.

Export to PDF

C.

Export to Chart Builder

D.

Export to Custom Chart

Question 15

Which two parameters are used to calculate the Total Quota value available on FortiAnalyzer? (Choose two.)

Options:

A.

Used storage

B.

Retention policy

C.

Reserved space

D.

Total system storage

Question 16

Why must you wait for several minutes before you run a playbook that you just created?

Options:

A.

FortiAnalyzer needs that time to parse the new playbook.

B.

FortiAnalyzer needs that time to back up the current playbooks.

C.

FortiAnalyzer needs that time to ensure there are no other playbooks running.

D.

FortiAnalyzer needs that time to debug the new playbook.

Question 17

Which statement describes a dataset in FortiAnalyzer?

Options:

A.

They determine what data is retrieved from the database.

B.

They provide the layout used for reports.

C.

They are used to set the data included in templates.

D.

They define the chart types to be used in reports.

Question 18

What are offline logs on FortiAnalyzer?

Options:

A.

Compressed logs, also known as archive logs

B.

Logs that are indexed and stored in the SQL database

C.

Any logs collected from offline devices after they boot up

D.

Real-time logs that are not yet indexed

Question 19

A play book contains five tasks in total. An administrator executed the playbook and four out of five tasks finished successfully, but one task failed. What will be the status of the playbook after its execution?

Options:

A.

Success

B.

Failed

C.

Running

D.

Upstream_failed

Question 20

You’ve moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?

Options:

A.

FortiAnalyzer resets the disk quota of the new ADOM to default.

B.

FortiAnalyzer migrates archive logs to the new ADOM.

C.

FortiAnalyzer migrates analytics logs to the new ADOM.

D.

FortiAnalyzer removes logs from the old ADOM.

Question 21

Which two methods are the most common methods to control and restrict administrative access on FortiAnalyzer? (Choose two.)

Options:

A.

Virtual domains

B.

Administrative access profiles

C.

Trusted hosts

D.

Security Fabric

Question 22

Refer to the exhibit.

The exhibit shows “remoteservergroup” is an authentication server group with LDAP and RADIUS servers.

Which two statements express the significance of enabling “Match all users on remote server” when configuring a new administrator? (Choose two.)

Options:

A.

It creates a wildcard administrator using LDAP and RADIUS servers.

B.

Administrator can log in to FortiAnalyzer using their credentials on remote servers LDAP and RADIUS.

C.

Use remoteadmin from LDAP and RADIUS servers will be able to log in to FortiAnalyzer at anytime.

D.

It allows administrators to use two-factor authentication.

Question 23

How do you restrict an administrator’s access to a subset of your organization’s ADOMs?

Options:

A.

Set the ADOM mode to Advanced

B.

Assign the ADOMs to the administrator’s account

C.

Configure trusted hosts

D.

Assign the default Super_User administrator profile

Question 24

Which statement regarding the FortiAnalyzer Fabric is true?

Options:

A.

The Fabric supervisor collects logs from the Fabric members.

B.

Logging devices can register to the Fabric supervisor or to Fabric members.

C.

Fabric members support HA.

D.

Administrators can create new incidents from the Fabric supervisor.

Question 25

Which daemon is responsible for enforcing the log file size?

Options:

A.

sqlplugind

B.

logfiled

C.

miglogd

D.

ofrpd

Question 26

Refer to the exhibit.

What does the data point at 14:55 tell you?

Options:

A.

The received rate is almost at its maximum for this device

B.

The sqlplugind daemon is behind in log indexing by two logs

C.

Logs are being dropped

D.

Raw logs are reaching FortiAnalyzer faster than they can be indexed

Question 27

Which two statements are true about FortiAnalyzer log forwarding modes? (Choose two.)

Options:

A.

Both modes, forwarding and aggregation send logs as soon as they are received.

B.

Aggregation mode requires two FortiAnalyzer devices.

C.

Forwarding mode forwards logs to other FortiAnalyzer devices syslog servers, or CEF servers.

D.

Forwarding mode requires configuration on the server side.

Question 28

If a hard disk fails on a FortiAnalyzer that supports software RAID, what should you do to bring the

FortiAnalyzer back to functioning normally, without losing data?

Options:

A.

Hot swap the disk

B.

Replace the disk and rebuild the RAID manually

C.

Take no action if the RAID level supports a failed disk

D.

Shut down FortiAnalyzer and replace the disk

Question 29

You crested a playbook on FortiAnalyzer that uses a FortiOS connector

When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

Options:

A.

FortiAnalyzer Event Handler

B.

Incoming webhook

C.

FortiOS Event Log

D.

Fabric Connector event

Question 30

In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.

How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?

Options:

A.

Resolve IP addresses on a per-ADOM basis to reduce delay on FortiView while IPs resolve

B.

Configure # set resolve-ip enable in the system FortiView settings

C.

Configure local DNS servers on FortiAnalyzer

D.

Resolve IP addresses on FortiGate

Question 31

After generating a report, you notice the information you were expecting to see is not included in it. What are two possible reasons for this scenario? (Choose two.)

Options:

A.

You enabled auto-cache with extended log filtering.

B.

The logfiled service has not indexed all the expected logs.

C.

The logs were overwritten by the data retention policy.

D.

The time frame selected in the report is wrong.

Question 32

Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?

Options:

A.

First, upgrade the secondary device, and then upgrade the primary device.

B.

Both FortiAnalyzer devices will be upgraded at the same time.

C.

You can enable uninterruptible-upgrade so that the normal FortiAnalyzer operations are not interrupted while the cluster firmware upgrades.

D.

You can perform the firmware upgrade using only a console connection.

Question 33

Which two of the available registration methods place the device automatically in its assigned ADOM? {Choose two.)

Options:

A.

Serial number

B.

Pre-shared key

C.

Fabric Authorization

D.

Request from the device

Question 34

What is the purpose of a predefined template on the FortiAnalyzer?

Options:

A.

It can be edited and modified as required

B.

It specifies the report layout which contains predefined texts, charts, and macros

C.

It specifies report settings which contains time period, device selection, and schedule

D.

It contains predefined data to generate mock reports

Question 35

Which two statements about high availability (HA) on FortiAnalyzer are true? (Choose two.)

Options:

A.

FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings.

B.

FortiAnalyzer HA active-passive mode can function without VRRP.

C.

All devices in a FortiAnalyzer HA cluster must run in the same operation mode, either analyzer mode or collector mode.

D.

All devices in a FortiAnalyzer HA cluster must have the same available disk space.

Question 36

Which two statements about FortiAnalyzer operating modes are true? (Choose two.)

Options:

A.

When in collector mode, FortiAnalyzer offloads the log receiving task to the analyzer.

B.

When in analyzer mode, FortiAnalyzer supports event management and reporting features.

C.

For the collector, you should allocate most of the disk space to analytics logs.

D.

Analyzer mode is the default operating mode.

Question 37

An administrator has configured the following settings:

What is the purpose of executing these commands?

Options:

A.

To record the hash value and authentication code of log files.

B.

To encrypt log transfer between FortiAnalyzer and other devices.

C.

To create the secure channel used by the OFTP process.

D.

To verify the integrity of the log files received.

Question 38

An administrator, fortinet, can view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mail server that can be used to send alert emails.

What can be the problem?

Options:

A.

ADOM mode is configured with Advanced mode.

B.

A trusted host is configured.

C.

fortinet is assigned the default Standard_User administrative profile.

D.

fortinet is assigned the default Restricted_User administrative profile.

Question 39

An administrator has configured the following settings:

config system fortiview settings

set resolve-ip enable

end

What is the significance of executing this command?

Options:

A.

Use this command only if the source IP addresses are not resolved on FortiGate.

B.

It resolves the source and destination IP addresses to a hostname in FortiView on FortiAnalyzer.

C.

You must configure local DNS servers on FortiGate for this command to resolve IP addresses on Forti Analyzer.

D.

It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.

Question 40

Which two statements are true regarding ADOM modes? (Choose two.)

Options:

A.

You can only change ADOM modes through CLI.

B.

In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advance mode, the disk quota of the ADOM is flexible because new devices are added to the ADOM.

C.

In an advanced mode ADOM. you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

D.

Normal mode is the default ADOM mode.

Question 41

What is the purpose of the FortiAnalyzer command execute format disk?

Options:

A.

To reset all settings from flash except the current IP addresses and routes.

B.

To erase all device settings and images, databases, and log data from the disk, but preserve the IP and routing info.

C.

To perform a low-level format of the disk overwriting the hard disk with random data.

D.

To reset to factory default settings from flash.

Question 42

When you perform a system backup, what does the backup configuration contain? (Choose two.)

Options:

A.

Generated reports

B.

Device list

C.

Authorized devices logs

D.

System information

Question 43

Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

Options:

A.

SSL is the default setting.

B.

SSL communications are auto-negotiated between the two devices.

C.

SSL can send logs in real-time only.

D.

SSL encryption levels are globally set on FortiAnalyzer.

E.

FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.

Question 44

You are trying to initiate an authorization request from FortiGate to FortiAnalyzer, but the Security Fabric window does not open when you click Authorize.

Which two reasons can cause this to happen? (Choose two.)

Options:

A.

A pre-shared key needs to be established on both sides.

B.

The management computer does not have connectivity to the authorization IP address and port combination.

C.

The Security Fabric root is unauthorized and needs to be added as a trusted host.

D.

The fabric authorization settings on FortiAnalyzer are misconfigured.

Question 45

After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the

purpose of running the following CLI command?

execute sql-local rebuild-adom

Options:

A.

To reset the disk quota enforcement to default

B.

To remove the analytics logs of the device from the old database

C.

To migrate the archive logs to the new ADOM

D.

To populate the new ADOM with analytical logs for the moved device, so you can run reports

Question 46

In a Fortinet Security Fabric, what can make an upstream FortiGate create traffic logs associated with sessions initiated on downstream FortiGate devices?

Options:

A.

The traffic destination is another FortiGate in the fabric.

B.

The upstream FortiGate is configured to do NAT

C.

Log redundancy is configured in the fabric.

D.

The downstream device cannot connect to FortiAnalyzer.

Question 47

Which daemon is responsible for enforcing raw log file size?

Options:

A.

logfiled

B.

oftpd

C.

sqlplugind

D.

miglogd

Question 48

Consider the CLI command:

What is the purpose of the command?

Options:

A.

To add a unique tag to each log to prove that it came from this FortiAnalyzer

B.

To add the MD5 hash value and authentication code

C.

To add a log file checksum

D.

To encrypt log communications

Question 49

What statements are true regarding disk log quota? (Choose two)

Options:

A.

The FortiAnalyzer stops logging once the disk log quota is met.

B.

The FortiAnalyzer automatically sets the disk log quota based on the device.

C.

The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.

D.

The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

Question 50

Which two statements regarding ADOM modes are true? (Choose two.)

Options:

A.

In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advanced mode, the disk quota of the ADOM is flexible.

B.

You can change ADOM modes only through the CLI.

C.

In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.

D.

Normal mode is the default ADOM mode.

Question 51

On FortiAnalyzer, what is a wildcard administrator account?

Options:

A.

An account that permits access to members of an LDAP group

B.

An account that allows guest access with read-only privileges

C.

An account that requires two-factor authentication

D.

An account that validates against any user account on a FortiAuthenticator

Question 52

For proper log correlation between the logging devices and FortiAnalyzer, FortiAnalyzer and all registered

devices should:

Options:

A.

Use DNS

B.

Use host name resolution

C.

Use real-time forwarding

D.

Use an NTP server

Question 53

Which statement about the FortiSOAR management extension is correct?

Options:

A.

It requires a FortiManager configured to manage FortiGate

B.

It requires a dedicated FortiSOAR device or VM.

C.

It does not include a limited trial by default.

D.

It runs as a docker container on FortiAnalyzer