Practice for the NSE 5 – FortiAnalyzer 7.6 Analyst exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: Which SQL query is in the correct order to query the database in FortiAnalyzer?. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the NSE 5 – FortiAnalyzer 7.6 Analyst practice test →
What you will practice
- Which SQL query is in the correct order to query the database in FortiAnalyzer?
- A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity…
- Which clause is considered mandatory in SELECT statements used by FortiAnalyzer to generate reports?
- If a hard disk on FortiAnalyzer that supports hardware RAID fails, what can be done on FortiAnalyzer?
- Which two methods are the most common methods to control and restrict administrative access on FortiAnalyzer?…
- You are using RAID with a FortiAnalyzer that supports software RAID, and one of the hard disks on FortiAnalyz…
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. Which SQL query is in the correct order to query the database in FortiAnalyzer?
Answer: C. C. SELECT devid FROM $log WHERE 'user'='USER1' GROUP BY devid
The correct query follows the standard SQL clause order, moving sequentially from selecting columns and defining the source to filtering and grouping. Remember that the GROUP BY clause must always appear after the WHERE clause.
Q2. A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer. What can you do on FortiAnalyzer to accomplish this?
Answer: A. A. Click Task Monitor and view the tasks performed by that administrator.
The Task Monitor specifically tracks administrative operations and background processes directly on the FortiAnalyzer system. Log View and FortiView focus on device traffic and security logs, making them incorrect for auditing local administrative actions.
Q3. Which clause is considered mandatory in SELECT statements used by FortiAnalyzer to generate reports?
Answer: A. A. FROM
The FROM clause is mandatory because it identifies the specific log table required to pull reporting data. While clauses like WHERE or ORDER BY are useful for filtering and sorting, they are completely optional in standard SQL queries.
Q4. If a hard disk on FortiAnalyzer that supports hardware RAID fails, what can be done on FortiAnalyzer?
Answer: D. D. Hot swap the disk
Hardware RAID configurations support hot swapping, allowing you to replace a failed drive without powering down the appliance. Shutting down the device is unnecessary downtime, and disks never physically self-recover without manual replacement.
Q5. Which two methods are the most common methods to control and restrict administrative access on FortiAnalyzer? (Choose two.)
Answer: B,C. B. Administrative access profiles || C. Trusted hosts
Access profiles restrict what administrators can see and configure, while trusted hosts limit administrative logins to specific IP addresses. Virtual domains are primarily a FortiGate feature for traffic segmentation, not a local FortiAnalyzer administrative control.
Q6. You are using RAID with a FortiAnalyzer that supports software RAID, and one of the hard disks on FortiAnalyzer has failed. What is the recommended method to replace the disk?
Answer: D. D. Shut down FortiAnalyzer and then replace the disk.
Software RAID requires a full system shutdown before replacing the failed disk to prevent data corruption and ensure array stability. Unlike hardware RAID, software RAID does not safely support hot swapping, so never attempt to replace it live.
Q7. What is the purpose of a predefined template on FortiAnalyzer?
Answer: A. A. It specifies the report layout which contains predefined texts, charts, and macros
A predefined template dictates the visual layout and structure of a report using predefined texts, charts, and macros. Do not confuse templates with report settings, which handle the schedule, target devices, and delivery configuration.
Q8. An administrator has configured the following settings: config system global set log-checksum md5-auth end What is the significance of executing this command?
Answer: H. D. This command records the log file MD5 hash value and authentication code.
Using the md5-auth setting ensures the system records both the MD5 hash value and an authentication code for log files. This provides strict integrity verification, whereas other options merely record the hash without the authentication element.
Q9. Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)
Answer: A,D. A. SNMP || D. Email
Event handlers natively support sending alerts through email and SNMP traps when specific triggers are met. FortiAnalyzer does not have built-in modules for sending direct SMS or instant messaging alerts without relying on external scripts.
Q10. What are offline logs on FortiAnalyzer?
Answer: A. A. Compressed logs, which are also known as archive logs, are considered to be offline logs.
Offline logs refer to compressed archive logs that FortiAnalyzer moves to the hard drive to free up database space. Do not confuse these with indexed logs in the SQL database, which are considered online logs available for fast searching.
Q11. Refer to the exhibit. Why is the total quota less than the total system storage?
Answer: A. A. Some space is reserved for system use
The correct answer works because FortiAnalyzer reserves a specific portion of disk space for the operating system and databases. Remember that current utilization only affects free space, not the total hard limit.
Q12. For which two purposes would you use the command set log checksum? (Choose two.)
Answer: A,B. A. To help protect against man-in-the-middle attacks during log upload from FortiAnalyzer to an SFTP server || B. To prevent log modification or tampering
The correct answer works because checksums calculate cryptographic hashes to verify file integrity and prevent tampering. Checksums detect unauthorized modifications during transfer, but they do not encrypt the actual payload.
Q13. You have recently grouped multiple FortiGate devices into a single ADOM. System Settings > Storage Info shows the quota used. What does the disk quota refer to?
Answer: D. D. The maximum disk utilization for all devices in the ADOM
The correct answer works because an ADOM quota sets the maximum storage limit shared collectively by all devices inside. The system reserves this space specifically for that ADOM, rather than dividing it per device.
Q14. Why should you use an NTP server on FortiAnalyzer and all registered devices that log into FortiAnalyzer?
Answer: A. A. To properly correlate logs
The correct answer works because synchronized clocks ensure timestamps match perfectly for accurate event tracking. Without NTP, forensic correlation fails, as logs from different devices appear completely out of sequence.
Q15. Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe, from another FortiAnalyzer device?
Answer: A. A. Log fetching
Log fetching pulls archived logs from another FortiAnalyzer based on a specific timeframe. Log forwarding pushes live logs upstream, whereas fetching is strictly a pull operation used for retrospective analysis.
Q16. Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?
Answer: B. B. Web filter logs
The indicators of compromise feature correlates destination IP addresses and domains from web filter logs against known threat databases. While IPS logs show attacks, web filter logs reveal successful outbound communications to malicious servers.
More NSE 5 – FortiAnalyzer 7.6 Analyst drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.