NSE 5 – FortiAnalyzer 7.6 Analyst Practice Test – 179 Free Exam Questions with Answers

Correct answer: B. B. Configure a custom view.

Creating a custom view allows you to save specific search filters and configurations for quick access. This prevents analysts from having to recreate complex queries manually. Dashboards and data selectors are for visual summaries, not saving search parameters.

Correct answer: C. C. Logs compressed and saved in files with the .gz extension

Archive logs are older records compressed and saved locally with the dot gz file extension. They are moved out of the active SQL database to save disk space, meaning they cannot be searched immediately in FortiView without restoration.

Correct answer: B. B. It runs as a docker container on FortiAnalyzer.

The FortiSOAR management extension operates seamlessly as a docker container hosted directly on FortiAnalyzer. This integration provides lightweight orchestration without requiring a separate virtual machine. It functions independently of FortiManager and usually offers a limited trial.

Correct answer: A. A. FortiAnalyzer needs that time to parse the new playbook.

FortiAnalyzer needs time to parse and validate a newly created playbook to ensure its syntax and logic are correct before execution. Debugging is a manual administrator process, not an automated step that happens upon playbook creation.

Correct answer: A. A. The generation time for reports is decreased. · B. B. When new logs are received, the hard-cache data is updated automatically.

Enabling auto-cache decreases report generation time by storing pre-generated data and automatically updates that hard-cache data when new logs are received. Auto-cache focuses on generation speed rather than conserving disk space or simply storing final reports.

Correct answer: B. B. All charts and datasets associated with the report will be imported together. · C. C. The ADOMs must be compatible types.

The correct answers are B and C because report dependencies move automatically and ADOM types must match. Remember that converting to a template is unnecessary, and FortiAnalyzer will not automatically rename reports to resolve naming conflicts.

Correct answer: C. C. To display the SQL query connections and hcache status

The correct answer is C because the command displays active SQL query connections alongside the hcache status. Exam takers should memorize this specific diagnostic command for troubleshooting report generation and caching issues.

Correct answer: B. B. Actions · C. C. Triggers

The correct answers are B and C because FortiAnalyzer playbooks are constructed using actions and triggers. Workflow templates and fabric connectors are valuable features, but they are not primary structural components of a playbook.

Correct answer: A. A. It is a device whose registration has not yet been accepted in FortiAnalyzer.

The correct answer is A because the unauthorized status means the device attempted to register but awaits administrator approval. Assignment to an ADOM only happens after you explicitly authorize the device connection.

Correct answer: B. B. Enable auto-cache and run the reports again · D. D. Review report diagnostics

Enabling auto-cache allows FortiAnalyzer to reuse processed data, significantly speeding up report generation. Reviewing report diagnostics is the primary native troubleshooting step to identify bottlenecks. Increasing quotas or deleting cache entries does not resolve underlying performance delays.

Correct answer: A. A. An AV log with action=quarantine.

An antivirus log with the action set to quarantine generates an event with a contained status. The system successfully isolated the malicious file, preventing it from executing or spreading. Actions like pass or drop do not actively isolate the threat.

Correct answer: C. C. Chart exports contain associated datasets.

When exporting a chart from FortiAnalyzer, the system automatically includes its associated datasets. This ensures the chart has the necessary data structure to render correctly upon import. Templates and datasets lack this specific dependency link during export operations.

Correct answer: D. C. FortiView

FortiView provides a graphical, interactive summary of network activity that lists and organizes threats by severity and time. Log View is incorrect because it focuses on raw log data rather than a summarized view, making threat investigation less efficient.

Correct answer: B. B. An IPS log with action=pass.

An IPS log with action equals pass generates an Unhandled status because the system detected a potential threat but did not actively mitigate or block the traffic. Logs showing dropped, blocked, or quarantined actions indicate the threat was actively handled.

Correct answer: B. B. To use information from the trigger to filter the action in a task

Trigger variables extract contextual information from the triggering event so you can use it to filter actions within subsequent tasks. They do not initiate the playbook run itself; they pass data to customize the response after the playbook starts.

Correct answer: B. A. The incident dashboard will be updated.

Changing an incident status to Closed Remediated updates the incident dashboard to accurately reflect the current resolution state in reports and visualizations. Severity is a static attribute based on the event details and is not lowered by status updates.

Correct answer: D. D. A new infected entry is added for the corresponding endpoint under Compromised Hosts.

The IOC engine creates a new infected entry for the endpoint under the Compromised Hosts section to associate the threat with the device. FortiAnalyzer does not directly quarantine endpoints, as that action is managed by FortiGate or FortiClient.

Correct answer: D. D. Enable an output profile on the reports.

You must enable and assign an output profile on the reports to define the email recipients and file formats for generated reports. The report calendar handles scheduling but does not directly manage email distribution on its own.

Correct answer: A. A. You can manually attach generated reports to incidents.

The correct answer is A because analysts can manually attach generated reports to incidents. Incident statuses are managed independently of attached events, and acknowledgment is not a prerequisite for analyzing the details.

Correct answer: D. D. They are not used in macros.

The correct answer is D because standard select queries are not used in FortiAnalyzer macros. Remember that SQL select statements strictly retrieve data and cannot purge logs or display database schemas on the exam.

Correct answer: B. B. The analyst is trying to create an output variable to be used in the playbook.

The correct answer is B because the analyst is creating an output variable. When you see a placeholder identifier being mapped within an action like attaching data, it indicates dynamic output being passed through the playbook.

Correct answer: C. C. Security Operations Center (SOC)

The correct answer is C because the Security Operations Center feature provides the centralized console for managing events and investigating incidents. While logging and reporting are crucial, they serve as supporting tools rather than the primary investigative interface.

Correct answer: C. C. Report information · D. D. System information

A system backup on FortiAnalyzer includes system configuration information and report information, but it does not include the actual log database. Remember that device logs and database snapshots must be backed up using separate database backup procedures.

Correct answer: B. B. Enable web filtering in firewall policies on FortiGate devices, and make sure these logs are sent to fortiAnalyzer. · D. D. Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.

Compromised Hosts detection relies on security logs like web filtering, so enabling these on FortiGate is essential. FortiAnalyzer also needs an active FortiGuard subscription to correlate these logs against the latest threat intelligence. Endpoint reachability is unnecessary.

Correct answer: A. A. An additional license is required. · B. B. It automatically downloads new event handlers and reports.

Outbreak detection requires an additional FortiGuard license to activate its threat intelligence feeds. Once enabled, it automatically downloads updated event handlers and reports to track emerging threats. Alerts are viewed locally rather than being strictly limited to root ADOM.

Correct answer: D. D. Ten events will be added.

The correct answer is ten events because the playbook filter matches exactly ten medium severity IPS events. For the exam, carefully count the events in the table that meet all configured criteria rather than relying on total numbers.

Correct answer: E. A. The message rate being lower that the log rate is normal.

A lower message rate compared to the log rate is normal because FortiAnalyzer processes logs in batches and groups them into messages for efficient indexing. The output does not indicate indexing completion status or reveal the specific ratio of traffic logs to event logs.

Correct answer: A. A. They can be downloaded to a file. · D. D. They were searched by using text mode.

The search results display raw log entries in plain text format with key value pairs, indicating the search was performed using text mode and can be downloaded. These logs are still available for analysis in FortiView despite the current text view.

Correct answer: B. b. Add the information about FortiGate to FortiAnalyzer using the Device Manager. · D. d. On FortiGate, configure remote logging to FortiAnalyzer.

Adding the device manually via Device Manager or initiating the connection from the FortiGate are the valid discovery methods. FortiAnalyzer does not use a dedicated heartbeat port for automatic discovery, making that option incorrect.

Correct answer: B. B. Threat hunting

Threat hunting represents a proactive approach by actively searching for hidden threats using logs and analytics. While incident dashboards and FortiView monitors are reactive tools, threat hunting focuses on discovering issues before they trigger standard alerts.

Correct answer: B. B. To retrieve data from the database

Datasets use SQL queries to retrieve specific information directly from the FortiAnalyzer database. Layouts and chart types handle the visual presentation, so remember that datasets strictly control the underlying data extraction for your reports.

Correct answer: A. A. Specific matched conditions in the raw logs

Event handlers trigger specific actions when they match defined conditions within the raw logs. They are the foundational alerting mechanism, whereas the other options represent either the resulting notifications or unrelated security features.

Correct answer: C. C. Macros do not need to be associated with a chart. · D. D. Macros are abbreviated dataset queries.

Macros act as abbreviated dataset queries and can function independently without being tied to a specific chart. Do not confuse them with static report text, as they are fully customizable to dynamically insert data.

Correct answer: C. B. Report Template · D. C. Event Handler

The Outbreak Detection Service automatically downloads event handlers and report templates to help identify and respond to emerging threats. Focus on these automated response tools rather than customized playbooks or incident templates.

Correct answer: C. C. RADIUS · D. D. LDAP

FortiAnalyzer validates administrator logins through external RADIUS and LDAP servers to provide centralized authentication management. Syslog is strictly for forwarding logs, not for handling user access control validation.

Correct answer: A. A. FTP · B. B. SFTP · D. D. SCP

FortiAnalyzer supports FTP, SFTP, and SCP for uploading local logs to remote servers. TCP and UDP are network transport protocols rather than file transfer applications, making them incorrect choices here.

Correct answer: A. A. Hot swap the disk.

Hardware RAID supports hot swapping, allowing you to replace a failed disk without powering down. Software RAID requires a full shutdown prior to replacing the disk to prevent data corruption.

Correct answer: B. B. Management extensions may require a minimum number of CPU cores to run.

Management extensions often demand specific hardware, like a minimum number of CPU cores. They do not transform the appliance into a standalone FortiSIEM supervisor or inherently require dedicated virtual machines.

Correct answer: D. D. Export to Report Chart

Exporting a FortiView directly to a Report Chart preserves your active filters to build a dataset. Chart Builder is exclusively for Log View, making it the wrong feature choice for FortiView exports.

Correct answer: A. A. logfiled

The logfiled process enforces the raw log file size limits and monitors overall disk quotas. Other processes handle distinct tasks, with sqlplugind managing the SQL database size and oftpd handling archives.

Correct answer: B. B. Identity provider · D. D. Service provider

FortiAnalyzer can act as a SAML Identity Provider or a Service Provider to enable single sign-on. Identity collector is an Authentication feature, and Principal refers to the user rather than the device role.

Correct answer: C. c. SSH · D. d. HTTP

Secure Shell and Hypertext Transfer Protocol are valid administrative access protocols used for command line and graphical management respectively. Telnet is disabled by default due to clear text vulnerabilities, and DNS is strictly for name resolution.

Correct answer: A. a. It provides redundancy. · B. b. It improves performance.

Redundant array of independent disks provides data redundancy and can significantly improve read performance for log retrieval. It does not replace traditional backups or inherently reduce system resource usage.

Correct answer: D. D. Valid FortiAnalyzer credentials

Using Fabric authorization to connect a FortiGate requires logging into the FortiAnalyzer with valid administrator credentials to approve the connection. A preshared key is used for manual registration methods, so rely on valid credentials to authorize Fabric joins.

Correct answer: C. C. Log fetching can be done only on two FortiAnalyzer devices that are running the same firmware version. · D. D. Log fetching allows the administrator to run queries and reports against historical data by retrieving archived logs from one FortiAnalyzer device and sending them to another FortiAnalyzer device.

Log fetching retrieves archived logs between two FortiAnalyzer devices to run historical queries, and both units must run the same firmware version. The distractor about redundancy fails because fetching is a scheduled pull mechanism, not real-time synchronization.

Correct answer: A. A. By deploying different FortiAnalyzer devices in both modes, you can improve their overall performance. · B. B. When in collector mode. FortiAnalyzer collects logs from multiple devices and forwards these logs in the original binary format.

Deploying collector mode offloads log receiving and forwarding tasks from the analyzer, which improves overall performance. The distractor about event management fails because collectors only forward logs in binary format and lack reporting or analysis features.

Correct answer: A. A. You can send notifications to multiple external platforms.

FortiAnalyzer can send incident notifications to multiple external platforms simultaneously using fabric connectors. The strongest distractor fails because administrators can configure each individual fabric connector with completely different notification settings.

Correct answer: A. A. To provide redundancy of your log data

RAID provides redundancy and fault tolerance for log data storage. While backups create separate offline copies, RAID ensures continuous operation and data availability even if a physical drive fails.

Correct answer: B. B. The security risk was blocked or dropped.

When an event status is mitigated, the security risk was actively blocked or dropped. Unhandled means the risk remains open, and contained indicates the source was isolated by network controls.

Correct answer: B. a. Check if the analytics logs retention data policy is too short. · D. c. Check if the total disk quota has been exceeded.

The analytics log retention policy dictates when processed logs are deleted, while the ADOM disk quota can trigger data purging independently of system-wide free space. Examining the archive logs will not help since FortiView queries strictly utilize the analytics database.

Correct answer: B. B. FortiAnalyzer HA supports synchronization of logs as well as some system and configuration settings. · C. C. All devices in a FortiAnalyzer HA cluster must run in the same operation mode: analyzer or collector.

FortiAnalyzer high availability synchronizes logs and configurations, and all nodes must operate in the same analyzer or collector mode. The strongest distractor fails because HA relies strictly on VRRP, meaning it is generally unsupported by public cloud providers.

Correct answer: C. C. Export to Report Chart (FortiView) · D. D. Chart Builder

Chart Builder and Export to Report Chart generate datasets and charts automatically based on your filtered search results. The Dataset Library only provides static templates, so rely on the chart builder for automated visualizations.

Correct answer: B. B. Fabric connector

Configuring a fabric connector is required to send incident update notifications to external platforms. While an email server handles standard alerts, fabric connectors manage the routing and delivery of those automated incident notifications.

Correct answer: B. A. SQL

FortiAnalyzer relies on Structured Query Language to manage its logging and reporting databases. For the exam, remember that SQL underpins the analytics and chart datasets, while LDAP and XML serve entirely different roles.

Correct answer: D. C. Output variables

Output variables capture data from a completed task, allowing subsequent tasks to consume that information as input. This is a key playbook concept, whereas trigger variables only initiate the workflow itself.

Correct answer: B. A. Local connector

The local connector is enabled by default for playbooks, allowing immediate execution of tasks on the FortiAnalyzer itself. Fabric connectors require explicit configuration before they can interact with downstream devices.

Correct answer: E. D. When at least one of the tasks fails

A playbook execution is marked as failed if at least one of its tasks fails, ensuring prompt identification of workflow issues. A playbook does not require all tasks to fail to trigger a failure status.

Correct answer: D. C. To run reports on the device's analytics logs in the new ADOM

Rebuilding the new ADOM database processes the device's analytics logs so you can generate reports successfully. Without rebuilding, the historical data remains inaccessible for reporting queries in the target ADOM.

Correct answer: B. B. Run the execute format disk command

Running the execute format disk command prepares the disk for use after erasing the device configuration. Rebooting or resetting settings will skip the necessary disk preparation required for normal operation.

Correct answer: A. A. Archive logs and analytics logs

An ADOM disk quota specifically includes analytics logs and archive logs. The system manages raw logs and SQL database tables outside this specific quota limit, so watch for options mixing storage tiers.

Correct answer: D. C. FTP · E. D. SFTP

FortiAnalyzer supports uploading local logs to remote FTP and SFTP servers. TCP and UDP are underlying transport protocols rather than destination server types, making them incorrect choices for remote log uploads.

Correct answer: A. a. Archive logs and Analytics logs

The ADOM disk quota includes both analytics logs and archive logs, as these are the final data sets stored after the system processes incoming raw logs. FortiView and reports rely on this specific quota to function properly.

Correct answer: C. C. SELECT devid FROM $log WHERE 'user'='USER1' GROUP BY devid

The correct query follows the standard SQL clause order, moving sequentially from selecting columns and defining the source to filtering and grouping. Remember that the GROUP BY clause must always appear after the WHERE clause.

Correct answer: A. A. Click Task Monitor and view the tasks performed by that administrator.

The Task Monitor specifically tracks administrative operations and background processes directly on the FortiAnalyzer system. Log View and FortiView focus on device traffic and security logs, making them incorrect for auditing local administrative actions.

Correct answer: A. A. FROM

The FROM clause is mandatory because it identifies the specific log table required to pull reporting data. While clauses like WHERE or ORDER BY are useful for filtering and sorting, they are completely optional in standard SQL queries.

Correct answer: D. D. Hot swap the disk

Hardware RAID configurations support hot swapping, allowing you to replace a failed drive without powering down the appliance. Shutting down the device is unnecessary downtime, and disks never physically self-recover without manual replacement.

Correct answer: B. B. Administrative access profiles · C. C. Trusted hosts

Access profiles restrict what administrators can see and configure, while trusted hosts limit administrative logins to specific IP addresses. Virtual domains are primarily a FortiGate feature for traffic segmentation, not a local FortiAnalyzer administrative control.

Correct answer: D. D. Shut down FortiAnalyzer and then replace the disk.

Software RAID requires a full system shutdown before replacing the failed disk to prevent data corruption and ensure array stability. Unlike hardware RAID, software RAID does not safely support hot swapping, so never attempt to replace it live.

Correct answer: A. A. It specifies the report layout which contains predefined texts, charts, and macros

A predefined template dictates the visual layout and structure of a report using predefined texts, charts, and macros. Do not confuse templates with report settings, which handle the schedule, target devices, and delivery configuration.

Correct answer: H. D. This command records the log file MD5 hash value and authentication code.

Using the md5-auth setting ensures the system records both the MD5 hash value and an authentication code for log files. This provides strict integrity verification, whereas other options merely record the hash without the authentication element.

Correct answer: A. A. SNMP · D. D. Email

Event handlers natively support sending alerts through email and SNMP traps when specific triggers are met. FortiAnalyzer does not have built-in modules for sending direct SMS or instant messaging alerts without relying on external scripts.

Correct answer: A. A. Compressed logs, which are also known as archive logs, are considered to be offline logs.

Offline logs refer to compressed archive logs that FortiAnalyzer moves to the hard drive to free up database space. Do not confuse these with indexed logs in the SQL database, which are considered online logs available for fast searching.

Correct answer: A. A. Some space is reserved for system use

The correct answer works because FortiAnalyzer reserves a specific portion of disk space for the operating system and databases. Remember that current utilization only affects free space, not the total hard limit.

Correct answer: A. A. To help protect against man-in-the-middle attacks during log upload from FortiAnalyzer to an SFTP server · B. B. To prevent log modification or tampering

The correct answer works because checksums calculate cryptographic hashes to verify file integrity and prevent tampering. Checksums detect unauthorized modifications during transfer, but they do not encrypt the actual payload.

Correct answer: D. D. The maximum disk utilization for all devices in the ADOM

The correct answer works because an ADOM quota sets the maximum storage limit shared collectively by all devices inside. The system reserves this space specifically for that ADOM, rather than dividing it per device.

Correct answer: A. A. To properly correlate logs

The correct answer works because synchronized clocks ensure timestamps match perfectly for accurate event tracking. Without NTP, forensic correlation fails, as logs from different devices appear completely out of sequence.

Correct answer: A. A. Log fetching

Log fetching pulls archived logs from another FortiAnalyzer based on a specific timeframe. Log forwarding pushes live logs upstream, whereas fetching is strictly a pull operation used for retrospective analysis.

Correct answer: B. B. Web filter logs

The indicators of compromise feature correlates destination IP addresses and domains from web filter logs against known threat databases. While IPS logs show attacks, web filter logs reveal successful outbound communications to malicious servers.

Correct answer: B. B. Mirroring and striping

RAID 10 combines mirroring for redundancy and striping for performance. It requires a minimum of four disks and is well supported across FortiAnalyzer hardware models, making it distinct from parity based levels.

Correct answer: B. b. They can be generated on demand or by schedule.

FortiAnalyzer reports can be generated manually on demand or automatically via a configured schedule. You do not need an output profile or a password to generate the report itself, though profiles dictate the final delivery format.

Correct answer: D. d. This FortiAnalyzer device can collect logs from other devices, but will not provide analysis.

A FortiAnalyzer in collector mode receives logs from connected devices but does not analyze them locally. It forwards those logs upstream to an analyzer mode device for processing, which reduces the processing load on the collector.

Correct answer: A. A. SFTP, FTP, or SCP server · C. C. Output profile

You must configure an external server definition and an output profile to successfully upload reports. While report scheduling determines when generation occurs, the output profile explicitly dictates the delivery method and destination.

Correct answer: A. A. Output profile

An output profile acts as the central configuration point to define email delivery settings for generated reports. Report scheduling only triggers the report generation itself, while the output profile controls exactly how and where it is delivered.

Correct answer: B. B. FortiAnalyzer is indexing logs faster than logs are being received.

The correct answer works because the insert rate line tracking processing is higher than the receive rate. For the exam, carefully track which line is which; dropping logs would typically show a wide unprocessed gap.

Correct answer: D. D. Resolve IP addresses on FortiGate

The correct answer works because offloading DNS resolution to FortiGate prevents heavy lookup loads on the FortiAnalyzer database. Remember that local FortiAnalyzer resolution directly consumes analytical resources.

Correct answer: B. B. FortiGate uses the miglogd process to cache the logs

The correct answer works because the miglogd daemon caches logs locally on the FortiGate during outages. The FortiAnalyzer does not automatically fetch dropped logs unless explicitly configured.

Correct answer: A. A. Custom datasets

Custom datasets often break during firmware upgrades due to changes in the underlying database schema. Standard report settings and schedules generally carry over cleanly, but your custom dataset syntax might require manual adjustments.

Correct answer: A. A. Quota enforcement is acting on analytical data before a report is complete

Quota enforcement deletes older analytical data to free up disk space, overriding the configured data retention policy. If your disk fills up before the sixty day policy expires, the system automatically purges the oldest analytics.

Correct answer: A. A. Mail server · B. B. Output profile

A mail server and an output profile are required because the profile dictates email delivery and the server handles transmission. Scheduling only automates generation time, not the actual delivery mechanism itself.

Correct answer: C. C. FortiAnalyzer is writing to all of its hard drives to make the array fault tolerant

The correct answer works because initializing writes parity data across all drives to establish the array. Do not confuse this with rebuilding, which only reconstructs parity data onto a newly added replacement drive.

Correct answer: D. D. Shut down FortiAnalyzer and replace the disk

With software RAID, you must shut down the FortiAnalyzer before replacing the failed disk to prevent data corruption. Hot swapping is reserved for hardware RAID configurations, making that distractor incorrect for this specific scenario.

Correct answer: B. B. Graphical reporting · C. C. Content archiving / data mining · E. E. Security log analysis / forensics

FortiAnalyzer centralizes graphical reporting, content archiving, and security log analysis to streamline network forensics. Remember that active vulnerability assessment and raw network analysis are typically handled by other dedicated Fortinet tools, not the analyzer.

Correct answer: E. D. To populate the new ADOM with analytical logs for the moved device, so you can run reports

The command works by repopulating the new domain database with historical logs so reports function correctly. Remember that simply moving the device in the GUI does not automatically migrate its older logs.

Correct answer: A. A. Data

Report templates define the layout, macros, and datasets for generating a report, but they do not contain the actual data. The data is populated dynamically from the FortiAnalyzer database when the report runs.

Correct answer: B. B. The log file rolls over and is archived.

When a log file reaches its maximum configured size, FortiAnalyzer rolls over the active file and archives it. This prevents any single file from consuming excessive space and keeps the logging service running without interruption.

Correct answer: A. A. To introduce redundancy to your log data

Using RAID introduces redundancy to protect your log data against disk failures. While ADOMs handle logical data separation, RAID provides the physical fault tolerance required to maintain continuous log availability.

Correct answer: B. B. Assign the ADOMs to the administrator's account

Assigning specific ADOMs to an administrator account restricts their access to only those domains. Trusted hosts only limit management access by IP address, and assigning a super user profile grants unrestricted access across the system.

Correct answer: A. A. Remote logging must be enabled on FortiGate · D. D. FortiGate must be registered with FortiAnalyzer

Enabling remote logging on FortiGate and registering the device with FortiAnalyzer are both required to collect logs. While ADOMs and encryption offer organizational and security benefits, they are not strictly required for basic log ingestion.

Correct answer: A. A. An account that permits access to members of a LDAP group

A wildcard administrator account allows members of a specified remote authentication group, such as an LDAP group, to access FortiAnalyzer without creating individual accounts. For the exam, remember that wildcard administration relies on group-based authentication rather than generic guest access.

Correct answer: C. C. Log fetching

Log fetching allows a FortiAnalyzer to pull archived logs matching a specific timeframe from another FortiAnalyzer. In contrast, log forwarding pushes real-time logs, and aggregation mode synchronizes the entire database rather than querying a specific window.

Correct answer: C. C. SQL SELECT statement

FortiAnalyzer uses the SQL SELECT statement to query and retrieve specific log data from its database. Candidates should note that standard SQL syntax applies here, meaning GET and EXTRACT are either invalid or irrelevant for general data retrieval.

Correct answer: C. C. The ADOM disk quota is set too low based on log rates

ADOM disk quotas dictate exactly how much space an individual ADOM can consume, causing premature log deletion if set too low. While global disk space is a primary hardware constraint, the specific ADOM quota is the localized setting that overrides retention policies.

Correct answer: C. C. To encrypt log communication between devices

OFTP over SSL is used to encrypt log communication between Fortinet devices, ensuring data confidentiality and integrity during transit. Remember that OFTP handles secure transfer, whereas options like log modification prevention or forwarding duplicate streams are policy features.

Correct answer: B. B. miglogd

The miglogd process on FortiGate caches logs locally whenever FortiAnalyzer is unreachable, forwarding them automatically upon restored connectivity. Candidates should memorize core daemons, distinguishing miglogd for logging from oftpd which handles the actual transfer protocol.

Correct answer: D. D. To add a log file checksum

This command configures FortiAnalyzer to attach an MD5 checksum to log files, verifying data integrity during storage or transit. A common exam trap is confusing this security feature with standard encryption protocols or general log forwarding mechanisms.

Correct answer: A. A. Both modes, forwarding and aggregation, support encryption of logs between devices. · C. C. Aggregation mode stores logs and content files and uploads them to another FortiAnalyzer device at a scheduled time.

Both forwarding and aggregation modes support encryption, and aggregation mode specifically uploads logs and content files at scheduled times. Avoid confusing the two, as forwarding happens in real-time and supports syslog servers, unlike aggregation which is strictly between FortiAnalyzers.

Correct answer: D. D. Macros are ADOM specific and each ADOM has unique macros relevant to that ADOM.

Macros are ADOM specific, meaning each administrative domain utilizes unique macros tailored to its specific log data and reporting requirements. Remember that these dynamic variables populate report fields and are not limited to generic templates or restricted solely to FortiGate ADOMs.

Correct answer: D. D. To use the output of the previous task as the input of the current task

Output variables pass the results of a previous task as input for the current task, enabling seamless data chaining within automated workflows. For the exam, associate these variables strictly with task-to-task data flow rather than connector metadata or execution statistics.

Correct answer: A. A. Failed

If any single task within a playbook execution fails, the overall playbook status is marked as Failed in the monitor. Success requires all tasks to complete without errors, while upstream failed only applies to dependent tasks skipped due to a prior failure.

Correct answer: B. B. Incoming webhook

An incoming webhook trigger is required on the FortiGate so it can receive actionable requests from the FortiAnalyzer playbook. Local event handlers and log triggers will not expose the automation stitch actions to the external FortiOS connector.

Correct answer: B. B. Use the execute sql-local rebuild-adom ADOM1 command to rebuild the ADOM database.

Moving a device between ADOMs requires rebuilding the destination SQL database so new reports can generate correctly. Use the specific rebuild-adom command for the new ADOM to avoid the heavy processing time of rebuilding all databases.

Correct answer: A. A. Device list · B. B. System information

A system backup includes the device list and essential system information to restore the unit to its previous state. Generated reports and authorized device logs are operational data stored separately, so they are not captured within the configuration file.

Correct answer: A. A. It automatically updates the hcache when new logs arrive. · D. D. It reduces report generation time.

Auto-cache reduces report generation time by automatically updating the hcache when new logs arrive. Do not confuse this with log insert rates; the cache strictly pre-calculates datasets so heavy reports render much faster on demand.

Correct answer: C. C. FortiAnalyzer migrates analytics logs to the new ADOM.

Rebuilding the database in the new ADOM triggers the migration of analytics logs to that ADOM. Exam cue: raw logs stay put unless explicitly handled, but the indexed analytics logs follow the device during the rebuild.

Correct answer: A. A. From the VM host manager, add an additional virtual disk and use the #execute lvm extend <disk number> command to expand the storage

Adding a new virtual disk and extending the logical volume is the recommended expansion method. Expanding the existing disk often requires destructive formatting, so using the logical volume manager ensures you expand storage without data loss.

Correct answer: B. B. Logs and content files are stored and uploaded at a scheduled time.

Aggregation mode stores logs and content files locally before uploading them at a scheduled time. This behavior directly contrasts with forwarding mode, which immediately transmits logs as they are received to save local disk space.

Correct answer: A. A. What devices and IP addresses are connecting to FortiAnalyzer

The OFTP daemon test command displays active device connections and their IP addresses. To verify if logs are actually reaching the device, you would use a different diagnostic command level rather than checking connection status.

Correct answer: B. B. Export to Report Chart

The Export to Report Chart feature in FortiView automatically builds a dataset and chart from your filtered search results. Remember that Chart Builder is specifically associated with the Log View, not FortiView.

Correct answer: B. B. Resolve IPs on FortiGate

Resolving IP addresses to hostnames directly on the FortiGate offloads the DNS lookup process away from FortiAnalyzer. Configuring local DNS resolution on FortiAnalyzer would introduce a performance impact during dashboard rendering.

Correct answer: A. A. Enabling auto-cache reduces report generation time for reports that require a long time to assemble datasets. · B. B. This feature is automatically enabled for scheduled reports.

Enabling auto-cache significantly reduces report generation time by pre-calculating datasets for long-running reports. As a practical tip, remember that FortiAnalyzer automatically enables this performance feature for all scheduled reports by default.

Correct answer: C. C. In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs. · D. D. Normal mode is the default ADOM mode.

Advanced mode allows you to assign individual virtual domains from a single FortiGate to multiple FortiAnalyzer ADOMs. Normal mode is the default setting that restricts VDOM assignment flexibility, so use advanced mode when splitting logging duties.

Correct answer: C. C. Use trusted hosts

Trusted hosts restrict administrative access to specific IP subnets, ensuring logins only originate from approved locations. For the exam, remember that administrative profiles control what an administrator can edit, while secure protocols dictate traffic encryption rather than the source location.

Correct answer: F. D. operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin

The filter matches login operations performed on the web GUI from the laptop IP address while excluding the admin account. Remember that audit logs track access using the performed on field, making it the correct attribute for GUI activity.

Correct answer: A. A. First, upgrade the secondary device, and then upgrade the primary device.

Upgrading the secondary device first ensures the primary remains active to minimize downtime and maintain cluster stability. A practical exam cue is that FortiAnalyzer lacks an uninterruptible upgrade feature, meaning a temporary failover is required when updating the primary node.

Correct answer: C. C. The logs were overwritten by the data retention policy. · D. D. The time frame selected in the report is wrong.

Incorrect report time frames and aggressive data retention policies are common reasons for missing report data. Note that auto-cache with extended log filtering is a distractor because it improves dashboard query performance rather than permanently deleting logs needed for the dataset.

Correct answer: A. A. They determine what data is retrieved from the database.

A dataset consists of an SQL select query that dictates exactly what information gets extracted from the FortiAnalyzer database. Report layouts, templates, and chart types are managed independently using other FortiAnalyzer components rather than the datasets themselves.

Correct answer: D. D. Ten events will be added.

The correct answer works because the create incident action adds only events matching all defined criteria. Be sure to cross-reference severity, type, and tags, as overlapping event properties often create distractors.

Correct answer: C. C. The log insert lag time is increasing.

The graph correctly indicates that the log insert lag time is increasing. The system cannot index logs as fast as it receives them, so focus on the growing gap between the receive and insert rates.

Correct answer: B. B. To use information from the trigger to filter the action in a task

Trigger variables are correct because they let you use dynamic information from the trigger to filter subsequent tasks. Remember these variables pass details like endpoint IP addresses into your playbook actions.

Correct answer: B. B. Must establish an IPsec tunnel ID and pre-shared key. · D. D. IPsec is only enabled through the CLI on FortiAnalyzer.

Securing communication with IPsec requires configuring a tunnel ID and pre-shared key on both ends. Remember that enabling IPsec on FortiAnalyzer is a CLI-only configuration, while option A fails because the FortiGate end must also be explicitly configured.

Correct answer: D. D. Resolve IP addresses on FortiGate

Resolving IP addresses directly on the FortiGate offloads the DNS lookup processing completely, preventing any performance degradation on FortiAnalyzer. The distractors fail because executing local FortiAnalyzer lookups directly adds unnecessary CPU overhead to your log collector.

Correct answer: C. C. ADOMs are not enabled on FortiAnalyzer.

Registering FortiClient EMS requires ADOMs to be enabled so the EMS server can be managed within a dedicated FortiClient ADOM. Advanced mode is not required for registration, and no separate license is needed beyond standard device management slots.

Correct answer: A. A. It automatically updates the hcache when new logs arrive · B. B. It reduces report generation time

The auto-cache feature updates the cache automatically when new logs arrive, ensuring data is ready for report generation. By using these pre-processed caches, FortiAnalyzer significantly reduces the time it takes to generate large reports.

Correct answer: D. D. Use an NTP server

Accurate log correlation across multiple logging devices requires matching timestamps, making a synchronized NTP server essential. While DNS or hostname resolution improves readability, it does not guarantee that chronological event sequences line up correctly.

Correct answer: A. A. You can import a playbook even if there is another one with the same name in the destination. · D. D. A playbook that was disabled when it was exported will be disabled when it is imported.

Importing a playbook with an existing name automatically appends a timestamp to prevent conflicts, and playbooks retain their original enabled or disabled status during transfer. Playbooks can be exported across different FortiAnalyzer devices, and multiple playbooks can be exported simultaneously.

Correct answer: B. B. Failed

If any single task within a playbook execution fails, the Playbook Monitor displays the overall job status as failed. Even if the remaining four tasks execute perfectly, a single task failure is enough to trigger the global failed indicator.

Correct answer: C. C. It requires a licensed FortiSIEM supervisor.

The FortiSIEM management extension operates as a collector and requires registration with a fully licensed FortiSIEM Supervisor to function properly. It is tightly integrated into FortiAnalyzer rather than being deployed independently as a dedicated virtual machine.

Correct answer: C. C. An additional license is required. · D. D. It automatically downloads new event handlers and reports.

The outbreak detection service requires an active FortiGuard license and automatically downloads newly created event handlers and reports. Alerts are not restricted to the root ADOM and can be viewed globally or within specific ADOMs rather than arriving via direct email.

Correct answer: A. A. The fetch client can retrieve logs from devices that are not added to its local Device Manager. · B. B. You can use filters to include only logs from a single device.

The fetch client can pull logs for devices not in its local Device Manager, and filters allow you to narrow the retrieval to a single device. Retrieved logs maintain their original type during transfer, meaning archived logs stay archived on the receiving client.

Correct answer: C. C. Upload to a server · D. D. Email

Email and upload to a server are correct because these are valid output profiles for notifications. Remember that forwarding logs to another analyzer is a log forwarding feature, not a report notification.

Correct answer: A. A. It can be used for fast data processing and log correlation · C. C. It can include all Fortinet devices that are part of the same Security Fabric

A fabric ADOM centralizes logs from multiple Fortinet Security Fabric devices, not just FortiGates, enabling faster log processing and cross-device correlation. Avoid option B because the ADOM manages logs and analytics, it does not establish or facilitate direct communication between fabric devices.

Correct answer: A. A. Configure trusted hosts for that administrator.

Configuring trusted hosts for an administrator restricts login attempts to approved IP subnets, securing access by location. Remember that two-factor authentication validates user identity, but it fails to restrict access based on the source location.

Correct answer: A. A. Output profile · C. C. Mail server

To email reports externally, an output profile dictates the delivery method, while a mail server provides the necessary SMTP relay. Remember that report scheduling only handles timing, whereas the output profile and mail server handle the actual email delivery mechanics.

Correct answer: B. B. It retrieves log data from the database

Dataset queries extract specific log data from the SQL database, forming the foundation for chart generation. Do not confuse this with log ingestion; FortiAnalyzer handles data insertion automatically, whereas datasets strictly retrieve information for analysis and reporting.

Correct answer: A. A. A local wildcard administrator account · B. B. A remote LDAP server

You must define the remote LDAP server to handle authentication and create a local wildcard administrator account linked to it. Trusted host profiles restrict IP access but do not define the LDAP group mapping required for authentication.

Correct answer: B. B. Raw logs display logs as they appear within the log file,

Raw logs are correct because they display the unprocessed data exactly as it appears in the file. Formatted logs are designed to be much more human readable, so raw logs lack that structured presentation.

Correct answer: B. B. Disk size · D. D. RAID level

FortiAnalyzer calculates reserved disk space as a percentage based on the total disk size, and RAID levels reduce the total usable capacity. Quotas apply to logical data allocation and do not dictate the underlying hardware space the system reserves.

Correct answer: C. C. The client retains a local copy of the logs after forwarding. · D. D. You can use aggregation mode only with another FortiAnalyzer.

In log forwarding, the client retains a local copy of the logs, and aggregation mode is specifically designed to work between two FortiAnalyzer units. Aggregation reduces bandwidth by grouping logs, whereas standard forwarding sends logs in real time.

Correct answer: C. C. Triage playbook

A triage playbook is explicitly designed to automate the initial sorting, prioritization, and assignment of security alerts. For the exam, differentiate this from incident playbooks, which are used later to coordinate the actual response and remediation phases after triage is completed.

Correct answer: D. D. Policy Hit Count report

The Policy Hit Count report tracks how many times each firewall policy has been triggered. This is crucial for identifying unused or heavily loaded policies. Traffic volume focuses on bandwidth, while user activity tracks behavior.

Correct answer: C. C. By applying log compression

The correct answer works because applying log compression reduces the physical disk space required to store logs without altering or deleting the actual data. For the exam, remember that pruning directly deletes older logs based on retention policies to free up space, whereas compression preserves the data.

Correct answer: A. A. Compliance report templates

Compliance report templates provide pre-defined formats and datasets specifically designed to meet industry standards like PCI DSS or HIPAA. While forwarding logs or viewing dashboards provides raw visibility, only structured compliance reports fulfill formal regulatory auditing requirements on FortiAnalyzer.

Correct answer: C. C. By generating user activity reports based on web and application usage

Generating user activity reports based on web and application usage is correct because it directly translates raw traffic and UTMP logs into readable behavioral insights. While analyzing raw traffic logs provides the underlying data, it does not summarize the activity into human-readable compliance formats.

Correct answer: A. A. To monitor and respond to specific log events

Event handlers monitor incoming logs and trigger automated responses when specific criteria are met. This is a key exam concept for proactive threat management and incident creation, not routine disk management.

Correct answer: C. C. Event correlation

Event correlation automatically detects potential security incidents by analyzing and finding relationships between various log events. Incident management handles events after detection, whereas correlation actively identifies them.

Correct answer: C. C. By providing dashboards to track, escalate, and resolve incidents

FortiAnalyzer provides dashboards that let SOC teams track, escalate, and resolve incidents through a structured workflow. It is an analytics platform, so it does not actively disable network devices or run penetration tests.

Correct answer: A. A. To automate repetitive SOC tasks

Playbooks are automated workflows designed to handle repetitive SOC tasks and speed up incident response. They are built for operational efficiency, rather than managing device configurations or acting as a backup repository.

Correct answer: C. C. Action blocks

Action blocks are the fundamental building blocks used to construct automated playbooks, dictating what the workflow executes. Device management and firmware schedulers are administrative tools unrelated to playbook logic.

Correct answer: B. B. To provide a summary of log types and quantities over time

Log statistics provide a high-level summary of log types and quantities generated over a specific time. This helps analysts identify network trends. They do not directly measure security posture or configure retention policies.

Correct answer: C. C. Syslog

FortiGate devices primarily use the standard Syslog protocol over UDP or TCP to send logs to FortiAnalyzer. Remember that while Syslog is the protocol, you must ensure port 514 is open for communication.

Correct answer: C. C. To customize reports for specific organizational needs

Custom report templates let you tailor content and format to meet specific organizational or compliance requirements. Standard templates might be too generic, so customizing ensures stakeholders receive relevant security data.

Correct answer: C. C. To document and manage security events for further investigation

Incidents are used to document, track, and manage security events that require further investigation. They package related event logs together, providing context for incident response rather than just recording system performance.

Correct answer: C. C. To narrow down search results based on specific criteria

Filters refine log searches by applying specific criteria to narrow down results. This allows analysts to quickly isolate relevant security events from massive datasets. Without filters, finding specific threats is practically impossible.

Correct answer: C. C. Report layouts, content, and templates

Customizing report layouts, content, and templates is correct because FortiAnalyzer provides dedicated report design tools. For the exam, remember that device firmware and system retention policies are administrative configurations, not design elements.

Correct answer: B. B. Automating response actions to detected incidents

Automating response actions to detected incidents is correct because playbooks execute predefined connector workflows. A key exam cue is that playbooks orchestrate responses after detection, rather than enforcing policies or replacing your log retention requirements.

Correct answer: D. D. Event correlation

Event correlation is correct because it evaluates aggregated logs against specific rules to identify threats instantly. Note that incident management handles the remediation workflow after threats are flagged, rather than performing the real-time detection.

Correct answer: B. B. To display real-time log and event summaries

Displaying real-time log and event summaries is correct because dashboards use widgets to visualize live network activity. Firmware updates and network configurations are handled by FortiManager, so eliminate those distractors immediately.

Correct answer: D. D. Firmware update logs

Firmware update logs is correct because this is not a distinct log type in the FortiAnalyzer taxonomy. Instead, firmware activities are recorded under standard system or event logs, whereas traffic and web filter logs are primary categories.

Correct answer: D. D. Log analysis and correlation

Log analysis and correlation is correct because cross-referencing data points reveals hidden patterns and emerging trends. While reporting displays these findings visually, the underlying correlation engine is what actually detects the security trends.

Correct answer: B. B. It tracks and manages incidents for SOC teams to resolve

Tracking and managing incidents is correct because FortiAnalyzer provides a dedicated console for investigating and resolving events. Watch out for distractors claiming the platform automatically patches systems or independently shuts down suspicious network devices.

Correct answer: B. B. To view and analyze logs in a graphical format

Viewing and analyzing logs graphically is correct because the analytics section leverages charts and visual dashboards for threat hunting. Remember that system settings and access control profiles are located elsewhere in the navigation tree.

Correct answer: A. A. Log type and severity

Using log type and severity is correct because event handlers rely on specific log filters to trigger alerts. Device models and firmware versions are inventory details, which are not standard criteria for generating real-time event triggers.

Correct answer: A. A. Centralized logging

FortiAnalyzer's core function is providing centralized logging for Fortinet devices. For the exam, remember that routing, switching, or wireless management are network functions, not the primary analytics role.

Correct answer: C. C. To centralize logs from multiple FortiGate devices

Log aggregation centralizes logs from multiple FortiGate devices into a single pane of glass for analysis. Content filtering and network performance are handled directly by the firewalls, not by the analyzer platform.

Correct answer: C. C. Sending logs to a syslog or other external log server

Log forwarding involves sending logs from FortiAnalyzer to an external syslog server or SIEM. Do not confuse this with the initial collection phase, where FortiGates send their logs to the analyzer for storage.

Correct answer: B. B. A log showing detected security events

An event log records security-related events detected on the network, such as intrusions or malware. Distinguish this from standard traffic logs, which simply record network connections and firewall actions.

Correct answer: B. B. Report manager

The Report Manager handles the creation, management, and scheduling of automated reports. Event handlers respond to specific alerts, while playbooks automate incident response actions.

Correct answer: C. C. It centralizes them for analysis and reporting

Centralizing logs for analysis and reporting is correct because FortiAnalyzer acts as the repository for multiple network devices. While forwarding logs is possible, the primary purpose is analyzing data internally rather than merely exporting it elsewhere.

Correct answer: B. B. Set a maximum storage allocation per ADOM

The correct answer works because the disk quota feature allows administrators to set maximum storage limits for each ADOM. This prevents a single ADOM from consuming all available disk space. A strong distractor is limiting the number of devices, which is actually controlled by the platform license tier.