NSE5-FAZ-7-2 Practice Exam — 46 Free Fortinet Questions

Join Us Among the Stars

Sign Up & unlock 100% of Exam Questions

Log in / Sign up

No Strings Attached!

46Practice Questions

3Study Modes

Free

TopicSort

Question 1

Security Operations

Which two statements are correct regarding the export and import of playbooks? (Choose two.)

A You can import a playbook even if there is another one with the same name in the destination.
B Playbooks can be exported and imported only within the same FortiAnalyzer device.
C You can export only one playbook at a time.
D A playbook that was disabled when it was exported will be disabled when it is imported.

Question 2

Security Operations

Question 3

Security Operations

Question 4

Security Operations

Question 5

Security Operations

Question 6

Security Operations

Question 7

Security Operations

Question 8

Security Operations

Question 9

Security Operations

Question 10

Security Operations

Question 11

Security Operations

Question 12

Security Operations

Question 13

Security Operations

Question 14

Security Operations

Question 15

Security Operations

Question 16

Security Operations

Question 17

Security Operations

Question 18

Security Operations

Question 19

Security Operations

That's the end of the Preview

This exam has 46 community-verified practice questions. Create a free account to access all questions, comments, and explanations.

Topics covered:

Security Operations

Log In / Sign Up

Page 1 of 2 • Questions 1-25 of 46

1 2

→

Know a question that should be here? Contribute to this exam

A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails.
What will be the status of the playbook after it is run?

A Running
B Failed
C Upstream_failed
D Success

Which statement about the FortiSIEM management extension is correct?

A Allows you to manage the entire life cycle of a threat or breach.
B Its use of the available disk space is capped at 50%.
C It requires a licensed FortiSIEM supervisor.
D It can be installed as a dedicated VM.

What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

A The size of newly generated reports is optimized to conserve disk space.
B FortiAnalyzer local cache is used to store generated reports.
C When new logs are received, the hard-cache data is updated automatically.
D The generation time for reports is decreased.

Refer to the exhibit.

Question Image

Based on the partial outputs displayed, which devices can be members of a FortiAnalyzer Fabric?

A FortiAnalyzer1 and FortiAnalyzer3
B FortiAnalyzer1 and FortiAnalyzer2
C All devices listed can be members
D FortiAnalyzer2 and FortiAnalyzer3

Question 6

Security Operations

Question 7

Security Operations

Question 8

Security Operations

Question 9

Security Operations

Question 10

Security Operations

Question 11

Security Operations

Question 12

Security Operations

Question 13

Security Operations

Question 14

Security Operations

Question 15

Security Operations

Question 16

Security Operations

Question 17

Security Operations

Question 18

Security Operations

Question 19

Security Operations

Which two statements are true regarding the outbreak detection service? (Choose two.)

A New alerts are received by email.
B Outbreak alerts are available on the root ADOM only.
C An additional license is required.
D It automatically downloads new event handlers and reports.

What must you consider when using log fetching? (Choose two.)

A The fetch client can retrieve logs from devices that are not added to its local Device Manager.
B You can use filters to include only logs from a single device.
C The fetching profile must include a user with the Super_User profile.
D The archive logs retrieved from the server become archive logs in the client.

Which statement describes a dataset in FortiAnalyzer?

A They determine what data is retrieved from the database.
B They provide the layout used for reports.
C They are used to set the data included in templates.
D They define the chart types to be used in reports.

You created a playbook on FortiAnalyzer that uses a FortiOS connector.
When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

A FortiAnalyzer Event Handler
B Incoming webhook
C Fabric Connector event
D FortiOS Event Log

Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?

A Outbreak alert services
B FortiView Monitor
C Threat hunting
D Incidents dashboard

Refer to the exhibit.

Question Image

What does the data point at 12:20 indicate?

A The performance of FortiAnalyzer is below the baseline.
B FortiAnalyzer is using its cache to avoid dropping logs.
C The log insert lag time is increasing.
D The sqlplugind service is caught up with new logs.

Which log will generate an event with the status Contained?

A An IPS log with action=pass.
B AWebFilter log with action=dropped.
C An AV log with action=quarantine.
D An AppControl log with action=blocked.

What is the purpose of trigger variables?

A To display statistics about the playbook runtime
B To use information from the trigger to filter the action in a task
C To provide the trigger information to make the playbook start running
D To store the start times of playbooks with On_Schedule triggers

What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

A The endpoint is marked as Compromised and, optionally, can be put in quarantine.
B FortiAnalyzer flags the associated host for further analysis.
C A new Infected entry is added for the corresponding endpoint.
D The detection engine classifies those logs as Suspicious.

After generating a report, you notice the information you were expecting to see is not included in it.
What are two possible reasons for this scenario? (Choose two.)

A You enabled auto-cache with extended log filtering.
B The logfiled service has not indexed all the expected logs.
C The logs were overwritten by the data retention policy.
D The time frame selected in the report is wrong.

Which statement about sending notifications with incident updates is true?

A Notifications can be sent only when an incident is created or deleted.
B You must configure an output profile to send notifications by email.
C Each incident can send notifications to a single external platform.
D Each connector used can have different notification settings.

Refer to the exhibit.

Question Image

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

A To add a new chart under FortiView to be used in new reports
B To build a dataset and chart automatically, based on the filtered search results
C To add charts directly to generate reports in the current ADOM
D To build a chart automatically based on the top 100 log entries

Why must you wait for several minutes before you run a playbook that you just created?

A FortiAnalyzer needs that time to parse the new playbook.
B FortiAnalyzer needs that time to back up the current playbooks.
C FortiAnalyzer needs that time to ensure there are no other playbooks running.
D FortiAnalyzer needs that time to debug the new playbook.

An administrator has configured the following settings:
config system fortiview setting
set resolve-ip enable
end
What is the significance of running this command?

A Use this command only if the source IP addresses are not resolved on FortiGate.
B It resolves the source and destination IP addresses to a hostname in FortiView on FortiAnalyzer.
C It resolves the destination IP address to a hostname in FortiView on FortiAnalyzer.
D You must configure local DNS servers on FortiGate for this command to resolve IP addresses on FortiAnalyzer.

Join Us Among the Stars

NSE5-FAZ-7-2Preview

About the NSE5-FAZ-7-2 Exam

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

Join Us Among the Stars

NSE5-FAZ-7-2Preview

About the NSE5-FAZ-7-2 Exam

Mode Selection

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19

That's the end of the Preview

Question 6

Question 7

Question 8

Question 9

Question 10

Question 11

Question 12

Question 13

Question 14

Question 15

Question 16

Question 17

Question 18

Question 19