Fortinet Fortianalyzer 6.4 Practice Test

These questions are part of the practice quiz. Start practicing

• In which environments is HA implementation not supported?
• Which command retrieves the message receive rate for each second?
• What is the primary requirement when creating a new data set?
• What type of information does the SMART tool provide when diagnosing system disk information?
• What is the function of macros in FortiAnalyzer?
• How are logs processed when received from registered devices by Fortianalyzer?
• When using 'diagnose system print route', what kind of output is expected?
• When creating a new chart, what options are available for selection?
• Where can you adjust your disk quota if ADOMS are enabled?
• Which sequence is correct for creating a new admin account?
• Where will the Fortigate request appear after a registration request is made?
• What must you understand to create a query effectively?
• What are administrative profiles used for?
• In SAML, what does IdP stand for?
• Is it possible to delete cloned templates?
• Templates in report design specify what?
• Why is it advantageous to resolve IPs on the FortiGate side instead of the FortiAnalyzer side?
• When is it necessary to validate your custom data sets?
• Which step is NOT part of the IOC workflow for analyzing logs?
• Where can visual representations of insert and receive rates be found?
• What configuration should be set up to permit administrator logins on FortiAnalyzer from specific locations only?
• Which data is NOT displayed in the FortiSOC incidents dashboard?
• What does FortiAnalyzer help to prevent concerning data?
• How are multiple remote admin accounts managed when using a wildcard admin account?
• Which modules are enhanced by the A-A HA mode for improved performance?
• True or false: An HA pair generates only one set of logs.
• What is the purpose of correlating logs in FortiAnalyzer SIEM?
• What does the 'Diagnose hardware info' command provide?
• Which of the following methods can be used to troubleshoot communication issues?
• What must be done if you add a new disk and the previous disks are configured in a RAID?
• How are endpoints detected and displayed in Fabric View?
• Which feature of FortiAnalyzer becomes available when subscribing to the FortiSOC service?
• How can report grouping be configured?
• In which scenario would you utilize cloning and editing of charts in FortiAnalyzer?
• What report elements can potentially change due to a firmware upgrade?
• Which database system does Fortianalyzer utilize?
• Why is it advisable to keep the level of detail in reports to a minimum?
• What does the insert vs receive rate graph illustrate in system settings?
• Is it necessary to power off the FortiAnalyzer device to replace a failed drive when RAID is supported?
• Are reports generated in the root ADOM?
• What information is provided by the command 'diagnose system print hosts'?
• What must the FortiAnalyzer administrator do to either approve or deny a registration request?
• What happens when a new custom template is saved?
• In a cloned template, which aspect can be edited after cloning?
• What is the command to configure a log file checksum in FortiAnalyzer?
• What type of log is included under the Fortiweb category?
• What does 'diagnose ha failover' command do?
• What does the local system performance monitor NOT track?
• What is required to resolve hostnames in logs on a FortiAnalyzer?
• What section would you find options to run a report on a schedule?
• What category do new or cloned data sets, charts, templates, and reports fall under?
• What role does audience consideration play in report generation?
• How soon do configuration changes take effect in FortiAnalyzer?
• What is the default operating mode of Fortianalyzer?
• True or False: Data is added to a report when it is generated.
• What feature ensures changes to passwords are made regularly in FortiAnalyzer?
• Which RAID level combines both mirroring and striping?
• What does the total playbook actions executed metric indicate?
• What should you do if you want to restrict an admin's access to specific functionalities?
• What is indicated by the connection conditional "dstport == 514 or dstport == 515"?
• If an ORDER BY clause is not used, how are the rows returned?
• After selecting a data set and chart type, which section is automatically adjusted?
• How do you make or edit an administrative profile?
• Which of the following is a feature of a password policy for FortiAnalyzer?
• What is the default maximum disk quota for an ADOM in FortiAnalyzer?
• What are the four FortiView monitor dashboards available for FortiClient?
• What type of capabilities does FortiSOC provide beyond traditional SIEM?
• When a user logs into a Service Provider (SP), what does the SP do next?
• Which FortiAnalyzer feature allows you to obtain archive logs from another FortiAnalyzer device?
• What is the purpose of the 'Diagnose ha restart-int-sync' command?
• What is the primary function of the playbook monitor in FortiSOC?
• What is a requirement for a RAID array?
• During an HA firmware upgrade, what happens to the secondary device after the primary is rebooted?
• What is one of the first steps to take if a report is generated and appears empty?
• When can you move an unregistered device to a new ADOM if ADOMs are enabled?
• Is auto completion for log view enabled by default?
• Which of the following can be inserted as data in reports without using a chart?
• What can you view in Fortiview > system > admin logins?
• Which of the following is a requirement to enable SOAR features in FortiSOC?
• What is one reason for implementing fabric connectors in a system?
• True or False: The only way for Fortigate devices in HA to be discovered is through manual addition of cluster members.
• What command would you use to see CPU, memory, hard disk, and flash disk usage and availability?
• Which of the following panes is NOT part of the seven panes in FortiAnalyzer?
• What is a primary benefit of customizing charts and data sets?
• How does log fetching simplify report generation in FortiAnalyzer?
• What does monitoring the SQL insertion status help identify?
• In what formats can a report be viewed?
• What does the Device Manager in FortiAnalyzer display?
• How does log insert lag time differ from the log receive rate?
• What command is used to monitor the log rate coming from each device?
• When editing reports, what is the recommended action?
• What options does the admin have when authorizing a registration request for a device in Fortianalyzer?
• What is the default HA priority value for devices within a FortiAnalyzer cluster?
• Which tasks would you find when monitoring jobs in the playbook section?
• When should FortiAnalyzer backups specifically be performed to ensure maximum reliability?
• What types of logs does FortiCarrier utilize?
• After purging from the SQL database, what happens to analytic logs?
• Where can alerts be viewed in FortiAnalyzer?
• Which of the following best describes real-time log sync?
• What is one reason to clone and edit predefined reports?
• What information does the failed authentication section of Fortiview display?
• What is a function of the Identity Center in Fabric View?
• Where would you look to see both local event logs and application logs of the root ADOM?
• By default, how many charts does the chart library contain?
• What is a vital difference between templates and reports?
• What is the purpose of the command diagnose fmupdate dbcontract fds?
• What should you do after writing an SQL select query for a custom data set to ensure correctness?
• What command do you use to see the new disk after adding it to FAZ?
• What should be configured to monitor critical system events effectively?
• Which command provides log receive rate totals?
• Which clause is used to select the table in a SELECT query?
• What does the "RAID alarm logs" diagnose?
• What is the purpose of an SQL SELECT query in FortiAnalyzer?
• How can you change the behavior of log storage when the allowed disk space is full?
• During a backup restoration, what is crucial to maintain security and integrity?
• How does FortiGate handle logging during a firmware upgrade?
• Which of the following is a subtype of the system log type?
• What can impact the ability of FAZ to discover Fortigate devices in a HA setup?
• Which of the following is a log processing feature of Fortianalyzer?
• What does log insert lag time measure?
• A SQL SELECT query polls the _____ for specific information.
• Where can RAID failures be viewed in the system settings?
• What must you do to change an existing template?
• What is the purpose of the "add device" registration wizard in FortiAnalyzer?
• What is a key feature of RAID 5?
• Which of the following devices is not supported by FortiAnalyzer?
• Why might report generation be slow when running a report for the first time?
• When are various reports like Fortiauthenticator and Ddos enabled?
• Which component is primarily involved in the SQL insertion of logs?
• What is the default setting for securing log communication between FAZ and Fortigate?
• To determine the datasets associated with a chart, what is one method you can use?
• What does the command 'diagnose system print partitions' provide?
• Which log type is specifically associated with Fortimanager?
• How can you identify users that are currently logged in?
• What does two-factor authentication involve?
• What does Fortiview > system > failed authentication attempts primarily track?
• When is the FortiSOC module activated?
• To improve report generation time when running similar reports on various FortiGate devices, which feature can you utilize?
• What feature of FortiSOC helps in automating responses to detected events?
• What are two methods to attach a report to an incident?
• Which of the following is true regarding the number of charts in a report?
• What actions can you perform on the IOC FortiView?
• What is FortiAnalyzer primarily used for?
• What is the format of SAML when dealing with authentication requests?
• What is recommended to increase local event logging detail?
• What type of logs are restored in the SQL database?
• Which feature allows further exploration of data logged as interesting?
• If your ADOM data policy is set to keep logs for 365 days, but logs are being deleted too early, what is likely the issue?
• Which of the following is a subtype of the event log type?
• How might you troubleshoot log indexing issues in Fortianalyzer?
• What type of alert is generated when disk space on FortiAnalyzer is full?
• What is the purpose of ADOMs in relation to log collection?
• What feature is utilized to modify cover page settings in a report?
• What do output profiles specify in FortiAnalyzer?
• When is hcache automatically built?
• What is one advantage of using third-party platforms for logging compared to fabric connectors?
• How are registered devices characterized in relation to FortiAnalyzer?
• What type of log does Fortimail include?
• Which feature allows viewing log data for a group of devices as if they were one?
• Which command would you use to verify DNS settings on a FortiAnalyzer?
• What is the second method for registering a device with FortiAnalyzer?
• Which SQL statement is exclusively used to populate reports in FortiAnalyzer?
• What type of changes can be made to a cloned report?
• Which command retrieves the running SQL processes in Fortianalyzer?
• What method can be used to protect logs on FortiAnalyzer?
• FortiAnalyzer provides management for which of the following?
• What option does the layout editor of a cloned report provide for easier future report creation?
• What profile is allowed by default to enable ADOMs in FortiAnalyzer?
• How can you reduce load on FortiAnalyzer's FortiView module?
• Is it necessary to separate Devices in ADOMS by FortiOS version?
• By default, how many data sets does the data set library contain?
• In what formats can the summary views in Fortiview be displayed?
• Which dashboard option is NOT typically a part of Fortiview?
• What does the command 'diagnose system print loadavg' output?
• Where can you enable the upload logs to cloud storage feature after uploading the Storage connector service license?
• Where can you find the schema for a specific log type in Fortianalyzer?
• What command shows device log usage for all logging devices?
• What is a key indicator of report performance when troubleshooting?
• What is one of the five security recommendations for deploying FortiAnalyzer?
• What does the operator ">=“ represent in a text filter for a custom event handler?
• What should you do first after selecting 'all devices' in log view?
• True or False: Each ADOM has its own data analysis on Fortiview.
• How can you check the SQL insertion status on FortiAnalyzer?
• What is required for registering a non-FortiGate device on FortiAnalyzer?
• What is a key benefit of fine-tuning a predefined report?
• What functionality does the chart builder tool provide?
• Which two-factor authentication solutions are recommended for Fortinet systems?
• What capability does log fetching provide in FortiAnalyzer?
• What is the main function of log group reports?
• What is the main advantage of using macros in reporting?
• What is the primary goal of RAID 0?
• How is the Fabric View Assets pane used in incident response?
• What should not be a characteristic of trusted hosts in FortiAnalyzer?
• Which command is used to control which reports will be contained in the report group function?
• How is used space determined?
• What can be customized in a report to enhance its usability?
• What is indicated by the "Inoperable" RAID status?
• Which command configuration enables auto-discovery for FortiAnalyzer on FortiGate?
• What type of logs are displayed in Fortiview?
• Why should you consider increasing the ADOM log quota if logs are high in volume?
• What function does the report calendar serve?
• Which command would you use to synchronize configuration in a malfunctioning HA setup?
• What must be enabled in order to collect logs from non-Fortigate devices?
• What are the steps to fetch logs on a FortiAnalyzer?
• What is the function of trusted hosts in administrative access?
• In what situation would the device with a lower IP address value be selected as the primary during the election?
• Which of the following is NOT a subsummaries option for the threat summary in Fortiview?
• How are the SQL database tables distributed?
• What protocol must be used for FortiAnalyzer HA to function?
• Templates do not contain what essential component?
• Which FortiAnalyzer feature allows you to group devices that administrators can monitor and manage?
• Which of the following is NOT one of the threat monitor widgets known as the "5Ts"?
• What log forwarding mode stores logs and uploads them to another FortiAnalyzer at scheduled times?
• What is a wildcard admin account used for in FortiAnalyzer?
• What feature allows you to efficiently reapply settings in the log view?
• How does log fetch functionality primarily assist in log analysis?
• What happens if you do not manage the report settings effectively?
• Which daemon is responsible for monitoring the insert rate?
• What does the FortiSOC events dashboard display?
• What is required to automatically attach a report to an incident?
• True or False: A playbook task can only use default inputs and those from the trigger.
• What is indicated by the SMART health status in system disk health diagnostics?
• How can you see more details on an event under the all event monitor in FortiSOC?
• What command would you use to debug communication issues between FortiAnalyzer and FortiGate?
• What type of logs might an unregistered device request from FortiAnalyzer?
• How can administrators customize log retention on fetched logs?
• In which section would you configure the load balancing aspect of HA devices?
• What is a recommended strategy for breaking up ADOMS in relation to disk quota?
• What is the first step to creating a data set in Fortianalyzer?
• What is a custom view in FortiAnalyzer log view?
• What does 'diagnose ha debug-sync on' do?
• What type of data does a dataset consist of in a FortiAnalyzer report?
• How can one check if RAID is supported on a system?
• For minor or moderate changes to existing templates, which option is available?
• What are some benefits of the security fabric ADOM?
• What does the IOC engine do in FortiAnalyzer?
• Which of the following is NOT part of the three FortiSOC dashboards?
• What is the key function of the event logging enabled setting in Fortigate?
• Which command provides insights into disk usage on FortiAnalyzer?
• What is the primary benefit of RAID 60 over RAID 50?
• Which of the following is true about the template associated with a report?
• What should you do after completing the initial configuration of FortiAnalyzer as a best practice?
• Which of the following are fabric connector options for FortiAnalyzer?
• Why is it important to keep track of log file activities such as rolled or deleted files?
• Macros in FortiAnalyzer are supported in which of the following ADOMs?
• What is a required element to send reports via email in FortiAnalyzer?
• Which option allows multiple authentication methods in FortiAnalyzer?
• What do HA priority settings determine?
• What feature allows sending or permitting access based on IP address in FortiAnalyzer?
• What type of information is not available for endpoints if FortiClient is not installed?
• What command allows you to view platform details such as platform, version, and serial number on FortiAnalyzer?
• Why might advanced SQL knowledge be necessary when using Fortianalyzer?
• How can you view details about application logs?
• What is one of the best practices regarding time synchronization for log devices?
• What is a risk of directly editing predefined reports?
• When does hcache not need to be rebuilt?
• How can you view more information about a specific log in log view?
• If the disk quota (raw + SQL) is estimated to be above 95%, what action does FAZ take?
• What is a quick method for building a custom data set and chart?
• What formats can data be displayed in FortiAnalyzer reports?
• What is necessary to change the filters in a report's chart?
• In Forticlient, which type of log is primarily used for network activity?
• What is one way to fine-tune a data set in FortiAnalyzer?
• How many trusted hosts can be configured at maximum?
• Besides enabling auto cache, what else can enhance report generation time?
• How can log integrity be ensured and tampering prevented when storing logs?
• When managing multiple ADOMs, which device type must include firmware version upon assignment?
• What are the benefits provided by High Availability (HA)?
• What does RAID 6 offer over RAID 5?
• What is the command to check the configuration status of all configured reports?
• What two elements primarily make up the charts in FAZ reports?
• What information is displayed by the command 'get system status'?
• When troubleshooting report generation, which command is used to diagnose SQL status for log querying?
• What is the primary function of Fortianalyzer?
• What is the primary function of the contact information in the meta fields?
• What does the standard_user profile restrict for an administrative user?
• How might fabric connectors impact performance degradation?
• What can you do to troubleshoot long report generation times?
• What is the first step to set up log forwarding in FortiAnalyzer?
• Which feature is utilized to perform analysis on archived logs?
• What is a common use for log messages in network security?
• Which dashboard is designed for use in a NOC or SOC environment?
• What command is used to retrieve performance statistics on FortiAnalyzer?
• If your FortiAnalyzer is a virtual machine, what additional method can you use for configuration backup?
• What is the purpose of the diagnose log device?
• What should you do if a predefined report does not meet your requirements?
• Which type of logs are considered online and provide immediate support?
• Does FortiAnalyzer support hot swapping if it has software RAID?
• Which of the following statements about reports is true?
• What roles can be assigned to devices in HA?
• What can be diagnosed using the 'test application logfiled 2' command?
• How can you monitor and view admin tasks in FortiAnalyzer?
• What does the normal mode of ADOMs imply regarding FortiGate VDOMs?
• What does the CLI command # diagnose fortilogd lograte provide?
• What does customizing a chart allow users to do?
• In order to populate a chart with data, what does FortiAnalyzer rely on?
• How can you specify a log group to run reports on?
• If data uploads hit the limit before the license expires, what must you do?
• Which of the following is NOT a way to troubleshoot communication issues with FortiAnalyzer?
• What is the purpose of SAML in authentication?
• Where can you find the macro library to see pre-defined macros or create custom macros?
• What tool is used to create custom datasets in FortiAnalyzer?
• What function does the admin type allow in FortiAnalyzer?
• Which of the following is NOT a preinstalled default admin profile?
• Which setting determines if a report is a single or multiple report?
• What feature must be activated on the FortiGate device for logging to begin?
• Which RAID level is used for both redundancy and improved performance through mirroring and striping?
• Which of the following must be configured for the initial setup of FortiAnalyzer?
• How can you edit a predefined template?
• Which feature allows you to manage widget placement on FortiView dashboards?
• What does the command 'diagnose system print df' show?
• True or False: Backups should always be encrypted when working with Fortinet support.
• What is the purpose of setting filters before using the chart builder tool?
• To restore an encrypted backup, what requirement must be met regarding the FortiAnalyzer?
• What does RAID stand for in the context of Fortinet systems?
• How many drives are typically required for RAID 10?
• What type of logs does FortiAnalyzer application logs include?
• Which authentication servers can be grouped using Fortinet's system?
• When creating a report in FortiAnalyzer, what format can it be generated in?
• Which protocol is used for secure management access in FortiAnalyzer?
• What does the variable format "${variable}" signify in custom notifications?
• Why is understanding device log usage important in a network security context?
• What is the purpose of using ADOMs in FortiAnalyzer?
• What command is used to disable Fortiview for performance tuning?
• Where can you monitor Fortigate administrator logins, system activity, and failed authentications?
• What does disk quota include?
• Where is the configuration done for external authentication servers in FortiAnalyzer?
• What type of information is included in the meta fields within system settings?
• What is the effect of applying both LIMIT and OFFSET in a query?
• When filters are applied to a report chart, which charts do they affect?
• What is indicated by unauthorized status when testing connections in Fortigate to Fortianalyzer?
• What information does the event monitor display in FortiSOC?
• When using 'diagnose system print cpuinfo', what type of information is printed?
• What is the default data retention for archive and analytical logs?
• What is a defining property of RAID 6?
• Which system settings are synchronized between all members of a cluster?
• Which mode acts as a central log aggregator for multiple log collectors?
• Are output profiles in FortiAnalyzer a global or ADOM-specific setting?
• What is required for admin accounts when configured to authenticate with remote servers?
• Which of the following is one of the monitors available in the Fortiview dashboard?
• What prerequisite must be met when assigning devices to an ADOM?
• What does an ORDER BY clause do in a SELECT query?
• If you find a log with interesting data, what can you do to locate other similar logs?
• Which statement about macros is true?
• Which file server upload protocol can use log checksums to prevent MITM attacks?
• What is the primary reason for rebuilding the database when moving a device from one ADOM to another?
• What does the RAID disk status "Rebuilding" indicate?
• What is the main purpose of log fetching in FortiAnalyzer?
• What should be included as part of the report's format consideration?
• Where can you create or clone a data set in Fortianalyzer?
• In simple terms, what is a FortiAnalyzer report?
• What happens if there is a mismatch in encryption levels between FortiGate and FAZ?
• Under what condition is HA not supported by FortiAnalyzer?
• What information is displayed when monitoring admin tasks?
• How can logs be protected when being rolled and archived in FortiAnalyzer?
• Which command retrieves the status of SQL query connections and hcache in Fortianalyzer?
• For security reasons, what is one of the first tasks you should do after logging into FortiAnalyzer?
• How does log forwarding work for devices in an HA cluster?
• What information does the CLI command # diagnose sql show hcache-size provide?
• What are logs in the indexed phase referred to as?
• If you have one FortiAnalyzer, can you log fetch?
• How many drives are required for RAID 50 to maintain fault tolerance against two drive failures?
• What is a primary function of scheduling within FortiAnalyzer that requires correct system time?
• What is the purpose of testing an incident response plan related to log management?
• In which two modes can ADOMs operate?
• What is the retention rule for logs in an archive?
• How does FAZ identify different devices based on log messages?
• What are the management ports used for in FortiAnalyzer?
• What two factors determine the features available in FortiAnalyzer?
• Which of the following best describes the process of cloning a chart?
• What is the maximum number of ADOMs that can be configured?
• What does the ADOM disk quota refer to?
• Where can you create a log group?
• What must be done when starting with a blank report?
• How many sub summaries are available for the traffic summary on Fortimanager?
• How can you indirectly copy a template or dataset from one ADOM to another?
• How can log communication between devices be protected?
• When deciding whether to customize a template or a report, what factor should be considered?
• In which part of Fortigate can logs be sent to Fortianalyzer?
• What is the additional info box used for when creating a new event handler filter?
• Which device can execute tasks based on a configured playbook in FortiSOC?
• What does the command 'diagnose ha status' show?
• What is the first method for registering a device with FortiAnalyzer?
• What benefit does customizing log retention provide in FortiAnalyzers?
• Which logging best practice involves remote server communication?
• When deploying multiple FortiAnalyzer units on a network, what must be configured differently on each unit?
• When you create a new chart, what is the first element to define?
• Which feature allows FortiAnalyzer to handle log messages more efficiently?
• Where can you view the activity of administrators, and which user profile is able to access this information?
• Which three panes are available in Fabric View?
• What should you monitor regarding the FAZ disk quota?
• Which command is used to diagnose the hcache size on the file system?
• What features require the system time to be set correctly on FortiAnalyzer?
• What is the purpose of the web service admin access protocol in FortiAnalyzer?
• What are the two modes of High Availability (HA) configured in FortiAnalyzer?
• Which feature in FortiAnalyzer allows automatic data set and chart creation?
• What icon should be clicked to view raw or formatted logs?
• How do fabric connectors enhance the FortiSOC SOAR playbook feature?
• What does checking log rates help determine in the context of report generation?
• What types of external authentication servers are supported by FortiAnalyzer?
• Which clause is used for grouping data in SQL queries?
• What feature of Fabric View enhances incident response capabilities?
• Why might you think you do not need to buy an IOC license?
• What must you do after configuring report grouping using the CLI command?
• How can you ensure proper log correlation between FortiAnalyzer and all connected devices?
• In report configuration, what does 'group-by' refer to?
• Which command configures the encryption level for FAZ log transfer from Fortigate?
• What is indicated when a report still needs to create hcache after running?
• Which command is used to rebuild the SQL database for an ADOM?
• Which toolbar option allows for quick validation of custom datasets?
• Which statement is true regarding the Restricted_user profile?
• What permission level is required to configure ADOMs?
• Where can the status of playbook jobs be monitored within FortiSOC?
• What is the structure of the compromised hosts monitor widget?
• What is an essential step before upgrading the HA cluster firmware?
• How can you change the ADOM mode in FortiAnalyzer using the GUI?
• What functionality does collector mode lack that is present in analyzer mode?
• When is it appropriate to use cloning for reports and templates?
• What log behavior occurs if the memory log buffer is full on a FortiGate with an SDD disk?
• Which of the following is NOT a default report in FortiAnalyzer?
• What must be enabled on FortiGate to begin sending log data to FortiAnalyzer automatically?
• How can users refine the data included in a report?
• Which command retrieves the log receiver rate for all ADOMs?
• What are logs known as during the compressed phase?
• Which RAID level provides striping with double parity?
• Which of the following is NOT considered a best practice for managing logs?
• Which daemon handles the receive rate of logs to FortiAnalyzer?
• In distributed parity, what is necessary for data storage?
• True or False: You can import and export reports and charts into a different ADOM, but the ADOM types must match.
• How do fabric connectors improve system efficiency?
• What is the purpose of the "Verifying" RAID status?
• What is the outcome of a failed report import between different ADOM types?
• What functionality does the toolbar in a blank template offer?
• What are the requirements for devices to be in a HA cluster together?
• What type of log is generated by Forticache?
• Which options does FortiAnalyzer provide for interacting with SAML?
• What are some benefits of fabric connectors?
• What types of traffic can the DLP engine examine?
• What command is used to turn off FortiAnalyzer?
• Which command is used in the CLI to enable ADOMs?
• What type of information is included in configuration backups for FortiAnalyzer?
• Why is it important to examine log chains instead of individual logs?
• What is required in order to configure IOC?
• What value is used to select a new primary device during a FortiAnalyzer HA failure?
• Why is it important for logging functions on FortiAnalyzer?
• What is a benefit of using filters in log view?
• What is a FortiSOC playbook?
• How can you add historical data to an incident?
• What level of encryption is used by default for OFTP between FortiGate and FortiAnalyzer?
• In the context of reports, where can users apply filters?
• What does the "Ready" status signify in a RAID setup?
• Which of the following is considered a component of the analytics quota?
• What is the purpose of a log group in FortiAnalyzer?
• What do macros enable you to do with data in FortiAnalyzer reports?
• Which of the following best describes the role of SMART in disk diagnostics?
• What is a predefined report?
• What is disabled by default when FortiAnalyzer is in collector mode, which may cause logs to not be available?
• What component does not typically get included in FortiAnalyzer backups?
• What summary does the Fortiview provide about applications and websites?
• A macro in FortiAnalyzer primarily defines what?
• What occurs immediately after enabling ADOMs on FortiAnalyzer?
• True or False: Log groups in FortiAnalyzer have separate SQL databases.
• What does the command 'execute lvm info' provide?
• How do you configure FortiAnalyzer to email generated reports?
• Where do you enable remote logging to Fortianalyzer in Fortigate?
• Which command is executed on the master to restart HA initial sync?
• What is the first step in upgrading the firmware for an HA cluster?
• What is the default username for logging into FortiAnalyzer?
• What should you do if you want to discard analytic logs in the old ADOM?
• What is the main function of the Fabric View module?
• What is the primary function of security orchestration in FortiSOC?
• What does a check icon next to a scheduled report in the report calendar signify?
• In which scenario should 'execute format disk' be used?
• What is one consideration before creating a report?
• What information is required about a device when using the "add device" registration wizard in FortiAnalyzer?
• What modules’ configurations does FortiAnalyzer synchronize across cluster devices?
• To monitor Fortigate administrative activity, which section of Fortiview should be accessed?
• Which two CLI options can be used to access FortiAnalyzer?
• What action should be taken if the SQL query associated with a dataset is not retrieving the desired information?
• Where can you create, clone, and modify existing charts?
• What is the default ADOM type set to for the root ADOM and new ADOMs?
• How do you configure the report display color on the report calendar page?
• Which of the following is included in the log view's filtering capabilities?
• Where do you analyze SIEM logs in FortiAnalyzer?
• How does the primary device react if it fails during log synchronization?
• In which scenario is a user required to select an ADOM when logging in?
• Which log type includes data on Network breaches and intrusion attempts?
• What does Fortiview help to monitor?
• What must be done to ensure the security of log files during transmission?
• If ADOMs are disabled, which device type can still be registered on Fortianalyzer?
• What are the two cluster modes available in FortiAnalyzer HA?
• What information does the cluster status pane display?
• What specific information does a DLP archive log track?
• What command checks the log rate for each type of log?
• What feature is enabled to prevent a single point of failure in a network using FortiAnalyzer HA?
• When does FortiAnalyzer enter the real-time log sync state?
• In which component of FortiAnalyzer can users implement triggers for automation?
• What does the log forwarder configuration specify?
• What is the main benefit of enabling hcache?
• How are raw and archive logs distributed?
• What is one of the benefits of using the A-A HA mode?
• What is the role of the fabric ADOM?
• Which command would you use to check the HA status in a FortiAnalyzer?
• What is the significance of the ‘device manage’ pane in FortiAnalyzer?
• Are local credentials necessary when a remote server is being used for authentication?
• Which status indicates that a hard drive is no longer being used by the RAID controller?
• Which clause is mandatory in a SELECT statement?
• In what format can logs be viewed on FortiAnalyzer?
• Is it recommended to move devices between ADOMS if necessary?
• Which details should you check to assess log collection performance?
• Which RAID level uses block-level striping with distributed parity?
• Which feature would you use in analyzer mode that is not available in collector mode?
• What happens during the initial HA sync process?
• Which automation can be used to attach reports to incidents?
• What essential factor should be configured alongside FortiAnalyzer to ensure accurate time stamps in logs?
• In the context of SOC analysis, what does the Fabric View Assets pane help identify?
• What kind of alerts does FortiAnalyzer generate?
• Which of the following is not a type of log associated with Forticlient?
• What is the purpose of using a custom view in log view?
• How is RAID 1 different from RAID 0?
• What two verdicts can be given to an end device in the compromised hosts FortiView?
• Where can you view the status of each disk in the RAID array?
• What two ways can you log into FortiAnalyzer for the first time?
• In FortiAnalyzer, what does the command 'Diagnose fortilogd lograte-type' do?
• Which of the following best defines what event handlers are?
• What is an alternate method of log resolution if not using FortiAnalyzer?
• Which type of data is included in the Fortiview summary views?
• What is one of the key features of FortiAnalyzer?
• How does HA provide real-time synchronization of logs?
• In a cloned report, which two tabs are editable?
• How can log view be customized regarding devices?
• Which of the following describes the Super_user administrative profile?
• What command is used to enable or disable auto completion for log view?
• What is the purpose of the FortiGate miglogd process?
• If hcache is not built before running a report, what must happen?
• What information is shown when using the 'show system route' command?
• What is the primary purpose of generating reports in FortiAnalyzer?
• Which devices can Fortiview display log data for?
• Which of the following should you avoid when setting up administration accounts on FortiAnalyzer?
• Why are logs from AV/IPS not used for the FortiAnalyzer IOC feature?
• What are archived logs considered in terms of their analytical support?
• What command is used to view and manage global configuration settings in FortiAnalyzer?
• How many reports can exist within a report set?
• What information is included in the FortiSOC playbook dashboard?
• When would you turn off log sync on FortiAnalyzer?
• What is the initial step to export and import reports?
• True or False: Clauses in a SQL query can be coded in any sequence.
• If a new disk is added to FAZ, what must you do after executing lvm extend?
• In FortiAnalyzer, accessing devices in which assignment is restricted for admins without proper rights?
• Which of the following is NOT a function of FortiAnalyzer reports?
• If a hard disk on a FortiAnalyzer that supports software RAID fails, what is the recommended action?
• What log types are found in Fortisandbox?
• When is data added to a report?
• What functionality does the command 'Diagnose debug enable' serve in log analysis?
• What command is used to check the log receive rate for each second?
• What is a key advantage of using cloned reports?
• What is a wildcard administrator?
• What information is needed to create a fetch profile for the fetch server on the fetch client?
• What does the command 'execute reset all-settings' do?
• On which device are local administrator login credentials validated?
• What is the FortiClient EMS connector used for?
• In the log forwarding architecture, which component acts as the client?
• Which approach combines both mirroring and striping in RAID configuration?
• Where can you move devices after registration?
• What is the purpose of using a macro when generating reports?
• Which operating mode in FortiAnalyzer is used to collect logs from multiple devices and then forward those logs to another device?
• True or False: The IOC works independently of the FortiGuard subscription.
• True or False: FortiAnalyzer HA can be configured with different licenses.
• How far back can you view history for IOC?
• What action can you take if Fortianalyzer includes an existing data set that is similar to your needs?
• What does the command 'Diagnose test application sqlrptcached <level>' typically check?
• How does Fortianalyzer enhance security operations?
• Which of the following features is NOT supported in collector mode?
• What is required to enable a custom OFTP certificate?
• What can be used alongside a password in PKI for authentication?
• What do the keywords “~” and "!~" signify in a filter condition?
• What must a user do upon logging in if ADOMs are enabled?
• True or False: Once devices in HA are registered, you can no longer manually add cluster members.
• What does SAML stand for?
• What command can be used to view report grouping information?
• What is NOT included in the SD-WAN high and critical events monitoring?
• What is the default setting for log data synchronization within HA?
• What should you compare to verify that you have the appropriate log file for a report in question?
• By default, templates are associated with what kind of reports?
• True or false: A FortiAnalyzer (FAZ) can operate as both a fetch server and a fetch client.
• What should you do if you forget your FortiAnalyzer password?
• What is the role of the Event Manager in Fortianalyzer?
• Where can you manually attach a report within FortiSOC?
• For reports only, what can you do if you want to tailor it to fit your needs?
• How many wildcard accounts are permitted when using two-factor authentication in Fortinet?
• What is synchronized between HA members in a cluster?
• What key feature distinguishes playbooks from regular tasks in FortiSOC?
• Which RAID configuration allows the failure of two disks in each RAID 6 array?
• What is the first step to manually configure a device as an HA cluster?
• What does the query 'SELECT * FROM $log' return?
• Which method is recommended to store passwords securely for FortiAnalyzer?
• Which of the following is a common practice for minimizing power-related issues with FortiAnalyzer?
• What does content archiving in FortiAnalyzer provide?
• What functionality do cloud out connectors provide?
• What configuration is required to view Fortigate event logs on Fortianalyzer?
• What action is taken if a device with higher priority joins the FortiAnalyzer cluster while the primary is still active?
• What must be enabled on FortiAnalyzer to access the incidents and events pane?
• Which types of logs are collected by FortiAnalyzer?
• What must be configured to use any external storage method for reports?
• What does the chart builder tool do when using filtered search results?
• When configuring HA, what indicates a higher priority for a device?
• Which command provides the log volume for all ADOMs?
• What does swap memory refer to in the context of system memory?
• What two panes does FortiView include?
• What aspect of a registered device is NOT displayed in Device Manager?
• How can the design of a report be altered?
• What should be the minimum password length for FortiAnalyzer?
• What kind of traffic does the IPS packet log monitor?
• Which report would most likely help in assessing "cyberbullying indicators"?
• Can you delete a predefined report?
• Which command would you run to clear the entire configuration except for IP settings?
• What happens when the allowed disk space on FortiAnalyzer is full?
• Where can you view the details of the storage connector service license?
• What type of log is typically not subject to immediate analysis?
• What CLI command is used to enable ADOM?
• How many summary views does Fortiview offer?
• What does FortiAnalyzer SIEM do with logs?
• Which of the following is NOT a widget included in the SD-WAN performance monitor?
• How does Fortigate handle ADOM assignments for devices registered in Fortianalyzer?
• If analytic logs are needed in the new ADOM, what should be done?
• What option appears next to the custom view icon on the toolbar?
• What is a primary advantage of using Fabric View's user mapping feature?
• What type of ADOM can devices be registered with?
• If datasets are not retrieving correct information, what should be examined?
• In log forwarding, who is the responsible entity that accepts the logs?
• What happens if the master role is set for a device in the HA cluster?
• Are ADOMs enabled by default in FortiAnalyzer?
• Which logs are not transmitted in forwarding log mode?
• Which setting should be enabled to improve cache performance for reports?
• Can third-party RADIUS and RSA tokens be used in Fortinet systems?
• Where can auto-cache settings for reports be enabled?
• Which module within FortiAnalyzer HA cluster synchronizes during configuration synchronization?
• What is the primary purpose of ADOMs in FortiAnalyzer administration?
• What is a key distinction between normal and advanced ADOM modes?
• Which format allows for the easiest data manipulation post-report generation?
• What is required for using a blank template effectively?
• How does FortiAnalyzer create a report?
• To manage backups effectively, what feature is essential for a virtual FortiAnalyzer system?
• What does the command 'diagnose system print netstat' display?
• What kind of information can you find regarding the detection method in FortiView?
• Where can you clone a template in the reporting system?
• What does the command 'show system interface' provide?
• Which statement is true regarding multiple device types in a single ADOM?
• Can you delete a cloned report?
• Which command would you use to see detailed hardware information such as processor and swap memory?
• How can you validate all custom data sets quickly in Fortianalyzer?
• Is RAID supported on all FortiAnalyzer models?
• Which part of disk space is reserved for future updates and maintenance?
• What occurs when a log file on FortiAnalyzer reaches its specified size?
• What can be configured for better log management aside from log quotas?
• In order for a device to start collecting logs on FortiAnalyzer, what must it be?
• Logs in the compressed phase are referred to as what?
• What type of access is needed to use CLI for configuration changes?
• What is included in the task monitor for admin tasks?
• What are the two major types of intelligence that determine the verdict for a compromised host?
• When enabling auto-discovery on FortiGate, what does it send to locate a FortiAnalyzer?
• What is required when creating a new chart?
• What can you do if the analyzer includes an existing chart similar to your desired output?
• What does configuring report grouping help manage?
• How does the LIMIT clause affect the results of a query?
• Why would you disable case-sensitive search in log view?
• Which logs provide immediate analytical support?
• Which RAID level provides a balance between performance and redundancy?
• What command is used to enable IP to hostname resolving in FortiView?
• What command is used to determine the log receive rate for a specific ADOM?
• What are the four steps to increase disk space on a FAZ VM?
• What content cannot be exported from a report?
• Which profile grants access to all ADOMs in FortiAnalyzer?
• Where can ADOMs be enabled in the FortiAnalyzer interface?
• Where is the chart builder tool located in Fortianalyzer?
• Which of the following is NOT a type of content file included in FortiAnalyzer?
• What does OFTP stand for?
• What command do you use to find the device log rate?
• What does the storage connector service license include?
• Which command is used to set the ADOM mode in CLI?
• What is required to send logs to cloud platforms?
• What types of logs can be viewed in the log view of FortiAnalyzer?
• Which method can be used to configure FortiAnalyzer’s operational settings?
• What does hcache refer to in the context of report generation?
• Which RAID configuration allows the system to operate with two disk failures?
• What is the first step in searching for specific logs in the log view?
• How is allocated space determined?
• What is required to use the log fetcher on FortiAnalyzer?
• What does the top events by type display in the FortiSOC events dashboard?
• What is the default management access IP address for FortiAnalyzer?
• What is the purpose of the sqlplugind in FortiAnalyzer?
• What would typically trigger a playbook in FortiSOC?
• What type of log can you apply filters to in the log view?
• What is the primary function of FortiView in Fortianalyzer?
• If an administrative user's job description requires device management but not system settings, what is the most appropriate default admin profile to assign?
• Which of the following is NOT a logging best practice?
• What operating system does the FortiAnalyzer server run on?
• Which command is used for migrating when resetting the FortiAnalyzer?
• What governs the duration of log retention in the analytics SQL database?
• What happens to analytic logs after they exceed the retention timeframe set by the ADOM policy?
• Which of the following is NOT a type of log collected by FortiAnalyzer?
• What do SMART error logs provide information about?
• In a custom event handler filter, what does the example “Dstip==192.168.1.168 and hostname ~ 'Facebook'” illustrate?
• What is the characteristic of RAID 5 regarding fault tolerance?
• What type of information is displayed by using the command 'show system dns'?
• What is the function of the 'Get sys status' command?
• How can you set the mode in Fortianalyzer?
• What are two subtypes for FortiAnalyzer application logs?
• Which command is used to set MD5 as the log checksum?
• Which statement about ADOM advanced mode is accurate?
• What defines unregistered devices when connected to FortiAnalyzer?
• In SAML architecture, what role does the SP play?
• What happens if the disk quota reaches 100%?
• What is the first step to set up two-factor authentication with a remote server?
• What is created in HA using VRRP?
• In FortiAnalyzer, if ADOMs are enabled, which ADOM will a device be registered to when using the "add device" wizard?
• What is the primary function of the DVM ADOM list?
• What are the two operating modes of Fortianalyzer?
• By default, which type of admin can see the complete administrator list?
• How is the total quota value determined?
• What does RAID 0 utilize for data management?
• Why is high CPU resource usage a concern when managing ADOMs?
• How can you restrict an administrator's access to certain ADOMs?
• What is a potential consequence of not renewing the storage connector service license?
• What statement is used to specify criteria for data extraction from an SQL database?
• What distinguishes log rate from message rate commands during troubleshooting?
• What is a unique feature of RAID 10?
• Where can you create a new template in the system?
• What happens to the backup device after the initial HA sync is completed?
• Why is performance an important consideration when generating reports?
• How do you turn on ADOMs in FortiAnalyzer?
• What step is required after setting log forwarding mode for proper configuration?
• What options can you access by right-clicking a report name in the report calendar?
• What type of metrics are monitored by the local system performance dashboard in FortiAnalyzer?
• What component settings are critical to establish when logging is enabled to Fortianalyzer?
• Where in the Fortinet system would you go to create a new event handler?
• What are the possible job statuses displayed in the playbook monitor?
• In a centered management environment, how does setup on the upstream Fortigate affect downstream devices?
• How many log fetching sessions can be established at once on FortiAnalyzer?
• What command retrieves the log volume for a specific ADOM?
• What happens if two devices have the same priority and one goes down?
• Which of the following is NOT a type of fabric connector created in Fabric View?
• What could be the reason for an "unauthorized" message when testing connection on Fortigate for Fortianalyzer IP?
• What aspect does the insert rate graph focus on in comparison to the receive rate graph?
• What language does Fortianalyzer use for logging and reporting?
• Which command is primarily used to check overall system performance on FortiAnalyzer?
• Which type of users may not have full access privileges in FortiAnalyzer?
• What is the maximum number of HA members that can exist in a cluster?
• In what formats can reports be reviewed?
• What is the purpose of the OFFSET clause in a query?
• What aspect of data analysis do FortiAnalyzer reports primarily enhance?
• Can default ADOMs be deleted in Fortinet systems?
• What command can be used to show the HA load balance status?
• Aside from increasing disk log quota, what is another method to manage logs on disk?
• Which panes are available in FortiSOC?
• What does striping in RAID operation involve?
• What does the term “threat type” refer to in the context of compromised hosts?
• Which of the following is an authentication option when using PKI?
• What is the primary function of the Exec sql-report hcache-build command?
• What is the function of the command 'diagnose ha stats'?
• What would most likely be a reason for configuring a FortiAnalyzer in HA mode?
• Unregistered devices will appear in which section until registered and assigned?
• Which of the following is NOT typically a detail shown for compromised hosts?
• What action does 'diagnose ha force-cfg-resync' perform?
• Where can you export a chart from a custom view in FortiAnalyzer?
• How often does logfiled check the other process to estimate space used by the SQL database?
• What command is used to set a custom OFTP certificate?
• What is the admin type group used for in FortiAnalyzer?
• What role does the cluster status pane play in HA monitoring?
• What protocol is used for optimized fabric transfer between FortiAnalyzer and FortiGate?
• What is required to access certain logs that depend on the SQL database in FortiAnalyzer?
• If you select the report time period as last 7 days, what is the last day included in the report?
• What command is used to set the encryption level for FortiAnalyzer?
• What should you select to enable email notifications for generated reports?
• Which logs are likely subject to an automatic deletion policy?
• Why might the license information widget show a value lower than the disk quota?
• How can you drill down details on a compromised host?
• What is the access level of the Standard_user profile?
• What does the 'SELECT' statement in SQL do in the context of FortiAnalyzer?
• How many triggers can a FortiSOC playbook include?
• Which is NOT a setting option for the FortiAnalyzer’s log file checksum?
• What can happen if insufficient quota is allocated to an ADOM?
• What command would you use to check the SQL insertion status in Fortianalyzer?
• Where can you view templates?
• What detection pattern indicates a real breach in compromised hosts?
• What is a key benefit of using security fabric to set up Fortianalyzer?
• Based on the query, a subset of information stored in the logs is extracted into a ____.
• What is the purpose of the virtual IP in a cluster configuration?
• How is a clone chart categorized in Fortianalyzer?
• What is the function of the command "diagnose test application oftpd 8"?
• What devices or VDOMS are indicated as currently registered and unregistered on FortiAnalyzer?
• After registering a device, what must be enabled on the FortiGate for FortiAnalyzer to collect logs?
• What action does FAZ take when the estimated disk quota is between 85% and 95%?
• What type of information do log messages contain?
• What happens if a disk fails in a RAID 0 configuration?
• Why is the GUI preferred over CLI during the upgrade process?
• What happens if the device registration details are incorrect in the FortiAnalyzer registration process?
• What types of content files are included in FortiAnalyzer?
• What is the purpose of the insert rate in Fortianalyzer?
• What does the command 'diagnose ha dump-datalog' accomplish?
• What does the command 'show system ntp' reveal?
• What command is used to configure the FAZ server for log forwarding?
• After enabling remote server authentication, where should the settings be applied?
• Where can you adjust your disk quota if ADOMS are not enabled?
• When is the OFTPS protocol used to secure log communication?
• Where does a registered device appear in its respective ADOM in FortiAnalyzer?
• What information is displayed when you hover over a scheduled report in the report calendar?
• What must be consistent across all devices in an HA cluster?
• Where can you set disk quotas when ADOMs are enabled?
• What is a secure option for external administrators in Fortinet systems?
• Which of the following is NOT a step in configuring High Availability (HA)?
• What type of logs are moved to the new ADOM when a device is transferred?
• What is the primary function of RAID 1?
• What can the monitors in the Fortiview pane display?
• What output can you expect from 'show system interface'?
• What does 'show system ntp' primarily help with?
• Which log type is NOT specifically mentioned for Fortimail?
• What is considered a best practice for powering FortiAnalyzer?
• What action can you take after double clicking an event in the all event monitor?
• How is disk space allocation typically set in Fortianalyzer?
• Which Fortinet device can generate logs aggregated by FortiAnalyzer?
• Where can you create a new report from a blank starting point?
• What information does the command diagnose test application uploadd 63 provide?
• What is a feature of blank reports?
• Which method allows you to manually attach a report to an incident after its creation?
• Where can you find the option to clone a report?
• Can you dynamically add disk space with FAZ hardware?
• What type of custom queries can users create in Fortianalyzer?
• What is the significance of separating devices by type in ADOMS?
• What is included in the DLP archive log type?
• True or false: The FAZ encryption level must match that of FortiGate for OFTP only?
• Which two states does FortiAnalyzer use to synchronize logs?
• What describes a feature of a blank template?
• What does a greater log receive rate indicate about the device's performance?
• What is indicated by the status of the advanced settings in a report?
• Which of the following does the IOC system not perform?
• If major changes are required to existing templates or reports, what should you create?
• What minimum number of drives is required for a basic RAID configuration?
• What is the primary role of administrative access control?
• When resetting the configuration, what interface should be used?
• Which RAID level uses two drives to create a mirror image of data?
• When is Fabric SP used in SAML?
• Which action is generally recommended if you face issues with customizing templates?
• What best describes the process of creating a new report based on an existing template?
• Which setting is required to group all devices in the HA cluster?
• What is a subtype of the traffic log type?
• What practice helps maintain data integrity in log management?
• What are the three log types for Fortigate?
• What two options are available for running a report?
• True or False: FortiAnalyzer can store reports externally.
• Where can you view reporting and historical audit of detections on malware, botnets, and intrusions?
• What is the simple task that a chart performs?
• What does the receive rate measure in the context of Fortianalyzer?
• Which of the following is NOT a characteristic of a predefined report?
• What should be checked if a report is generating abnormal usernames?
• When does a playbook task begin execution?
• Why might a playbook job status be marked as failed?
• What does the Fortilogd daemon primarily handle?
• What basic report settings can be configured?
• How can you retrieve diagnostics on a specific report in Fortianalyzer?
• What feature can you enable to boost report performance and reduce generation time?
• Which of the following best describes a macro?
• What does the Fabric View Identity Center pane display?
• Which user profile specifically has access to administrator activity logs?
• When are logs moved to archive in Fortianalyzer?
• What does the WHERE clause do in a SELECT query?
• Which step should be taken to create a new fabric connector?
• Which command helps determine what devices and IP addresses are connecting to the FortiAnalyzer?
• What does the term "chart type" imply in Fortianalyzer?
• Why is a poorly formatted filter a common issue?
• Where is disk quota assigned in Fortinet systems?
• In Fortianalyzer, what does the term "Data bindings" refer to?
• What does log lag time indicate in Fortianalyzer?
• Which reporting tool feature allows focus on a specific subset of logs?
• What authentication option is available under the admin settings aside from local, remote, and 2FA?
• Which path allows you to view the graphical view of scheduled reports?
• How can the analytics quota impact system performance?
• What is FortiSOC and what does it enable?
• What is the FortiManager protocol used for regarding FortiAnalyzer?
• How often should log uploads for rolled logs be configured?
• What action should be taken if archived logs are needed from another FortiAnalyzer?
• What can you do to customize the log view besides adding filters?
• What types of events can be filtered in the event log?
• In the context of FortiAnalyzer, what does the term 'quarantine' refer to?
• How often does FortiAnalyzer download the TDS FortiGuard package?
• What could cause search filters not to return any results?
• What is a dataset in the context of Fortianalyzer?
• What is a key benefit of using public cloud accounts for log storage?
• What is the purpose of the auto-cache setting on reports?
• What is the primary feature of RAID 50?
• Which of the following is included in the monitoring of admin logins in Fortiview?
• What happens to analytic logs in the original ADOM once a device is moved?
• What is the procedure to move devices from one ADOM to another?
• What is the minimum recommended memory for FortiAnalyzer VMs?
• What type of information can you gather with the command 'Diagnose test application oftpd 3'?
• What is the overall purpose of the FortiSOC service?
• At what percentage of used disk quota will FAZ begin removing raw and archive logs?
• What process is completed to review what datasets are used in a report chart?
• Which method is NOT an option for uploading generated reports to a server?
• How can you customize a chart in FortiAnalyzer?
• Which of the following is NOT a capability of the chart builder tool?
• To view local logs such as configuration changes and logins by a specific user, what should you do?
• What kind of information can be included in the additional information variables of a handler filter?
• What is the final command to finalize the report-like setting in configuration?
• What does the command 'diagnose system print certificate' provide?
• What are the two methods to enable Fortianalyzer logging on Fortigate?
• To which tab can you go to add reports when manually attaching to an incident?
• Where can you change the admin password in FortiAnalyzer?
• Under what situation must ADOMS be enabled on FortiAnalyzer?
• What should you do if your custom chart is not appearing in the chart library?
• Which types of logs are not included in the license information logging?
• What is the result of executing 'reset all-except-ip'?
• Which log checksum algorithms are supported by FortiAnalyzer?
• Why is RAID used in the context of log management?
• What kind of information can the task monitor provide regarding admin activities?
• What is the primary purpose of the Optimized Fabric Transfer Protocol (OFTP) over SSL?
• What is the default port used by OFTP for TCP and UDP?
• Where can macros be inserted in FortiAnalyzer?
• What should you configure in the system settings to resolve IP addresses to host names in FortiView?
• Which FortiView feature allows users to apply different settings to the same widget?
• What details can be shown for compromised hosts?
• How can an administrator apply external server credentials for logging into FortiAnalyzer?
• What are the default primary and secondary DNS server addresses on a FortiAnalyzer?
• Where can you view reports?
• What is a benefit of FortiGates with an SDD disk when the connection to FAZ is lost?
• Which command can be used to find the status of the FAZ ADOM?
• What should you always do after erasing the configuration on flash?
• Do trusted hosts apply to both GUI and CLI access?
• What is the purpose of using "!" in text filter conditions?
• Where do you configure disk quotas when ADOMs are disabled?
• Which command is used to set the Active Domain/Organizational Model for report grouping?
• Under what condition is a new primary device elected if the current primary becomes unavailable?
• What information can be diagnosed using the command for system RAID status?
• What does the command 'get system ntp' display on the Fortianalyzer device?