NSE5_FAZ-7.0 Sample Questions Answers

https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/717578/assigning-administrators-to-an-adom

What does the System Configuration backup include?

System information, such as the device IP address and administrative user information.

Device list, such as any devices you configured to allow log access.

Report information, such as any configured report settings, as well as all your custom report details. These are not the actual reports.

FortiAnalyzer_7.0_Study_Guide-Online pag. 29

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 29: What does the System Configuration backup include?

• System information, such as the device IP address and administrative user information

• Device list, such as any devices you configured to allow log access

• Report information, such as any configured report settings, as well as all your custom report details. These are not the actual reports.

https://docs.fortinet.com/document/fortianalyzer/6.2.0/administration-guide/651442/fetcher-management

Option B is correct because you must establish an IPsec tunnel ID and pre-shared key to secure the communication between FortiAnalyzer and FortiGate with IPsec12. The tunnel ID is a unique identifier for each tunnel and the pre-shared key is a secret passphrase that authenticates the peers.

Option D is correct because IPsec is only enabled through the CLI on FortiAnalyzer1. You cannot configure IPsec settings through the GUI on FortiAnalyzer.

https://packetplant.com/fortigate-and-fortianalyzer-resolve-source-and-destination-ip/

“As a best practice, it is recommended to resolve IPs on the FortiGate end. This is because you get both source and destination, and it offloads the work from FortiAnalyzer. On FortiAnalyzer, this IP resolution does destination IPs only”

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 259: The main clauses FortiAnalyzer reports use are as follows:

•FROM

•WHERE

•GROUP BY

•ORDER BY

• LIMIT

• OFFSET

Accordingly, following the SELECT keyword, the statement must be followed by one or more clauses in the order in which they appear in the table shown on this slide.

"One possible scenario is shown on the slide:

1. Traffic flows through the FortiGate

2. FortiGate sends logs to FortiAnalyzer

3. FortiAnalyzer detects some suspicious traffic and generates an event

4. The event triggers the execution of a playbook in FortiAnalyzer, which sends a webhook call to

FortiGate so that it runs an automation stitch

5. FortiGate runs the automation stitch with the corrective or preventive actions"

FortiAnalyzer_7.0_Study_Guide-Online page 228

In order to see the actions related to the FOS connector, you must enable an automation rule using the Incoming Webhook Call trigger on the FortiGate side. FortiAnalyzer_7.0_Study Guide page no 233

• Super_User, which, like in FortiGate, provides access to all device and system privileges.

• Standard_User, which provides read and write access to device privileges, but not system privileges.

• Restricted_User, which provides read access only to device privileges, but not system privileges. Access

to the Management extensions is also removed.

• No_Permissions_User, which provides no system or device privileges. Can be used, for example, to

temporarily remove access granted to existing admins.

FortiAnalyzer_7.0_Study_Guide-Online page 42