NEW QUESTION 1
Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with SSL? (Choose two.)

• A. SSL is the default setting.
• B. SSL communications are auto-negotiated between the two devices.
• C. SSL can send logs in real-time only.
• D. SSL encryption levels are globally set on FortiAnalyzer.
• E. FortiAnalyzer encryption level must be equal to, or higher than, FortiGate.

Answer: AD

NEW QUESTION 2
Which statements are correct regarding FortiAnalyzer reports? (Choose two)

• A. FortiAnalyzer provides the ability to create custom reports.
• B. FortiAnalyzer glows you to schedule reports to run.
• C. FortiAnalyzer includes pre-defined reports only.
• D. FortiAnalyzer allows reporting for FortiGate devices only.

Answer: AB

NEW QUESTION 3
What remote authentication servers can you configure to validate your FortiAnalyzer administrator logons? (Choose three)

• A. RADIUS
• B. Local
• C. LDAP
• D. PKI
• E. TACACS+

Answer: ACE

NEW QUESTION 4
View the exhibit.

What does the data point at 14:35 tell you?

• A. FortiAnalyzer is dropping logs.
• B. FortiAnalyzer is indexing logs faster than logs are being received.
• C. FortiAnalyzer has temporarily stopped receiving logs so older logs’ can be indexed.
• D. The sqlplugind daemon is ahead in indexing by one log.

Answer: D

Explanation:
Logs are received then they are indexed, no logging server in the world can index logs faster than they are received. When FAZ receives raw logs, they are inserted (indexed) by the SQL database and the sqlplugind daemon, this graph shows that FAZ received 3 logs and sqlplugind indexed 4.

NEW QUESTION 5
View the exhibit.

Why is the total quota less than the total system storage?

• A. 3.6% of the system storage is already being used.
• B. Some space is reserved for system use, such as storage of compression files, upload files, and temporary report files
• C. The oftpd process has not archived the logs yet
• D. The logfiled process is just estimating the total quota

Answer: B

NEW QUESTION 6
Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

• A. Must configure the FortiAnalyzer end of the tunnel only--the FortiGate end is auto-negotiated.
• B. Must establish an IPsec tunnel ID and pre-shared key.
• C. IPsec cannot be enabled if SSL is enabled as well.
• D. IPsec is only enabled through the CLI on FortiAnalyzer.

Answer: C

NEW QUESTION 7
How does FortiAnalyzer retrieve specific log data from the database?

• A. SQL FROM statement
• B. SQL GET statement
• C. SQL SELECT statement
• D. SQL EXTRACT statement

Answer: C

NEW QUESTION 8
Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

• A. Log upload
• B. Indicators of Compromise
• C. Log forwarding an aggregation mode
• D. Log fetching

Answer: D

NEW QUESTION 9
What is the purpose of the following CLI command?

• A. To add a log file checksum
• B. To add the MD’s hash value and authentication code
• C. To add a unique tag to each log to prove that it came from this FortiAnalyzer
• D. To encrypt log communications

Answer: A

NEW QUESTION 10
View the exhibit:

What does the 1000MB maximum for disk utilization refer to?

• A. The disk quota for the FortiAnalyzer model
• B. The disk quota for all devices in the ADOM
• C. The disk quota for each device in the ADOM
• D. The disk quota for the ADOM type

Answer: B

NEW QUESTION 11
What is the purpose of employing RAID with FortiAnalyzer?

• A. To introduce redundancy to your log data
• B. To provide data separation between ADOMs
• C. To separate analytical and archive data
• D. To back up your logs

Answer: A

NEW QUESTION 12
In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required? (Choose two.)

• A. Remote logging must be enabled on FortiGate
• B. Log encryption must be enabled
• C. ADOMs must be enabled
• D. FortiGate must be registered with FortiAnalyzer

Answer: AD

NEW QUESTION 13
What FortiGate process caches logs when FortiAnalyzer is not reachable?

• A. logfiled
• B. sqlplugind
• C. oftpd
• D. miglogd

Answer: D

NEW QUESTION 14
On FortiAnalyzer, what is a wildcard administrator account?

• A. An account that permits access to members of an LDAP group
• B. An account that allows guest access with read-only privileges
• C. An account that requires two-factor authentication
• D. An account that validates against any user account on a FortiAuthenticator

Answer: D

NEW QUESTION 15
What are two of the key features of FortiAnalyzer? (Choose two.)

• A. Centralized log repository
• B. Cloud-based management
• C. Reports
• D. Virtual domains (VDOMs)

Answer: AC

NEW QUESTION 16
What statements are true regarding disk log quota? (Choose two)

• A. The FortiAnalyzer stops logging once the disk log quota is met.
• B. The FortiAnalyzer automatically sets the disk log quota based on the device.
• C. The FortiAnalyzer can overwrite the oldest logs or stop logging once the disk log quota is met.
• D. The FortiAnalyzer disk log quota is configurable, but has a minimum o 100mb a maximum based on the reserved system space.

Answer: CD

NEW QUESTION 17
FortiAnalyzer centralizes which functions? (Choose three)

• A. Network analysis
• B. Graphical reporting
• C. Content archiving / data mining
• D. Vulnerability assessment
• E. Security log analysis / forensics

Answer: BCE

NEW QUESTION 18
......