Fortinet NSE 5 Practice Exam Questions and Answers – Part 10/10

Answer: C,D. C. An additional license is required. || D. It automatically downloads new event handlers and reports.

The outbreak detection service requires an active FortiGuard license and automatically downloads newly created event handlers and reports. Alerts are not restricted to the root ADOM and can be viewed globally or within specific ADOMs rather than arriving via direct email.

Answer: A,B. A. The fetch client can retrieve logs from devices that are not added to its local Device Manager. || B. You can use filters to include only logs from a single device.

The fetch client can pull logs for devices not in its local Device Manager, and filters allow you to narrow the retrieval to a single device. Retrieved logs maintain their original type during transfer, meaning archived logs stay archived on the receiving client.

Answer: C,D. C. Upload to a server || D. Email

Email and upload to a server are correct because these are valid output profiles for notifications. Remember that forwarding logs to another analyzer is a log forwarding feature, not a report notification.

Answer: A,C. A. It can be used for fast data processing and log correlation || C. It can include all Fortinet devices that are part of the same Security Fabric

A fabric ADOM centralizes logs from multiple Fortinet Security Fabric devices, not just FortiGates, enabling faster log processing and cross-device correlation. Avoid option B because the ADOM manages logs and analytics, it does not establish or facilitate direct communication between fabric devices.

Answer: A. A. Configure trusted hosts for that administrator.

Configuring trusted hosts for an administrator restricts login attempts to approved IP subnets, securing access by location. Remember that two-factor authentication validates user identity, but it fails to restrict access based on the source location.

Answer: A,C. A. Output profile || C. Mail server

To email reports externally, an output profile dictates the delivery method, while a mail server provides the necessary SMTP relay. Remember that report scheduling only handles timing, whereas the output profile and mail server handle the actual email delivery mechanics.

Answer: B. B. It retrieves log data from the database

Dataset queries extract specific log data from the SQL database, forming the foundation for chart generation. Do not confuse this with log ingestion; FortiAnalyzer handles data insertion automatically, whereas datasets strictly retrieve information for analysis and reporting.

Answer: A,B. A. A local wildcard administrator account || B. A remote LDAP server

You must define the remote LDAP server to handle authentication and create a local wildcard administrator account linked to it. Trusted host profiles restrict IP access but do not define the LDAP group mapping required for authentication.

Answer: B. B. Raw logs display logs as they appear within the log file,

Raw logs are correct because they display the unprocessed data exactly as it appears in the file. Formatted logs are designed to be much more human readable, so raw logs lack that structured presentation.

Answer: B,D. B. Disk size || D. RAID level

FortiAnalyzer calculates reserved disk space as a percentage based on the total disk size, and RAID levels reduce the total usable capacity. Quotas apply to logical data allocation and do not dictate the underlying hardware space the system reserves.

Answer: C,D. C. The client retains a local copy of the logs after forwarding. || D. You can use aggregation mode only with another FortiAnalyzer.

In log forwarding, the client retains a local copy of the logs, and aggregation mode is specifically designed to work between two FortiAnalyzer units. Aggregation reduces bandwidth by grouping logs, whereas standard forwarding sends logs in real time.