Practice for the NSE 5 – FortiAnalyzer 7.6 Analyst exam with 16 exam-style practice questions, instant answer reveals, and concise explanations of every correct answer. Topics include: An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate r. Follow @CertPunch and visit certpunch.com for more certification practice exams and study content.
Prefer hands-on? Take this round as an interactive practice test — answer every question, get instant feedback, and see your score: Start the NSE 5 – FortiAnalyzer 7.6 Analyst practice test →
What you will practice
- An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to…
- When you perform a system backup, what does the backup configuration contain? (Choose two.)
- Which two purposes does the auto cache setting on reports serve? (Choose two.)
- You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild t…
- What is the recommended method of expanding disk space on a FortiAnalyzer VM?
- How are logs forwarded when FortiAnalyzer is using aggregation mode?
Answers and explanations
Tap a question to expand the answer and the exam reasoning. Try to commit to your own pick first.
Q1. An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1. What should the administrator do to solve this issue?
Answer: B. B. Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.
Moving a device between ADOMs requires rebuilding the destination SQL database so new reports can generate correctly. Use the specific rebuild-adom command for the new ADOM to avoid the heavy processing time of rebuilding all databases.
Q2. When you perform a system backup, what does the backup configuration contain? (Choose two.)
Answer: A,B. A. Device list || B. System information
A system backup includes the device list and essential system information to restore the unit to its previous state. Generated reports and authorized device logs are operational data stored separately, so they are not captured within the configuration file.
Q3. Which two purposes does the auto cache setting on reports serve? (Choose two.)
Answer: A,D. A. It automatically updates the hcache when new logs arrive. || D. It reduces report generation time.
Auto-cache reduces report generation time by automatically updating the hcache when new logs arrive. Do not confuse this with log insert rates; the cache strictly pre-calculates datasets so heavy reports render much faster on demand.
Q4. You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?
Answer: C. C. FortiAnalyzer migrates analytics logs to the new ADOM.
Rebuilding the database in the new ADOM triggers the migration of analytics logs to that ADOM. Exam cue: raw logs stay put unless explicitly handled, but the indexed analytics logs follow the device during the rebuild.
Q5. What is the recommended method of expanding disk space on a FortiAnalyzer VM?
Answer: A. A. From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage
Adding a new virtual disk and extending the logical volume is the recommended expansion method. Expanding the existing disk often requires destructive formatting, so using the logical volume manager ensures you expand storage without data loss.
Q6. How are logs forwarded when FortiAnalyzer is using aggregation mode?
Answer: B. B. Logs and content files are stored and uploaded at a scheduled time.
Aggregation mode stores logs and content files locally before uploading them at a scheduled time. This behavior directly contrasts with forwarding mode, which immediately transmits logs as they are received to save local disk space.
Q7. What can the CLI command # diagnose test application oftpd 3 help you to determine?
Answer: A. A. What devices and IP addresses are connecting to FortiAnalyzer
The OFTP daemon test command displays active device connections and their IP addresses. To verify if logs are actually reaching the device, you would use a different diagnostic command level rather than checking connection status.
Q8. What FortiView tool can you use to automatically build a dataset and chart based on a filtered search result?
Answer: B. B. Export to Report Chart
The Export to Report Chart feature in FortiView automatically builds a dataset and chart from your filtered search results. Remember that Chart Builder is specifically associated with the Log View, not FortiView.
Q9. In FortiAnalyzer's FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAna…
Answer: B. B. Resolve IPs on FortiGate
Resolving IP addresses to hostnames directly on the FortiGate offloads the DNS lookup process away from FortiAnalyzer. Configuring local DNS resolution on FortiAnalyzer would introduce a performance impact during dashboard rendering.
Q10. Refer to the exhibit. Which two statements are true regarding enabling auto-cache on FortiAnalyzer? (Choose two.)
Answer: A,B. A. Enabling auto-cache reduces report generation time for reports that require a long time to assemble datasets. || B. This feature is automatically enabled for scheduled reports.
Enabling auto-cache significantly reduces report generation time by pre-calculating datasets for long-running reports. As a practical tip, remember that FortiAnalyzer automatically enables this performance feature for all scheduled reports by default.
Q11. Which two statements are true regarding ADOM modes? (Choose two.)
Answer: C,D. C. In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs. || D. Normal mode is the default ADOM mode.
Advanced mode allows you to assign individual virtual domains from a single FortiGate to multiple FortiAnalyzer ADOMs. Normal mode is the default setting that restricts VDOM assignment flexibility, so use advanced mode when splitting logging duties.
Q12. How can you configure FortiAnalyzer to permit administrator logins from only specific locations?
Answer: C. C. Use trusted hosts
Trusted hosts restrict administrative access to specific IP subnets, ensuring logins only originate from approved locations. For the exam, remember that administrative profiles control what an administrator can edit, while secure protocols dictate traffic encryption rather than the source location.
Q13. Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin", and coming from Laptop1. Which fi…
Answer: F. D. operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin
The filter matches login operations performed on the web GUI from the laptop IP address while excluding the admin account. Remember that audit logs track access using the performed on field, making it the correct attribute for GUI activity.
Q14. Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?
Answer: A. A. First, upgrade the secondary device, and then upgrade the primary device.
Upgrading the secondary device first ensures the primary remains active to minimize downtime and maintain cluster stability. A practical exam cue is that FortiAnalyzer lacks an uninterruptible upgrade feature, meaning a temporary failover is required when updating the primary node.
Q15. After generating a report, you notice the information you were expecting to see is not included in it. What are two possible reasons for this scenario? (Choose two.)
Answer: C,D. C. The logs were overwritten by the data retention policy. || D. The time frame selected in the report is wrong.
Incorrect report time frames and aggressive data retention policies are common reasons for missing report data. Note that auto-cache with extended log filtering is a distractor because it improves dashboard query performance rather than permanently deleting logs needed for the dataset.
More NSE 5 – FortiAnalyzer 7.6 Analyst drills and other practice exams are on @CertPunch. New rounds drop every few days at certpunch.com.