Free NSE5-FAZ-7-2 sample questions
Real questions from the Fortinet NSE 5 - FortiAnalyzer 7.2 Analyst practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
True or False: When a playbook is triggered by an event handler, it can only use log fields from the single log that initiated the event.
A SOC analyst has created a playbook to automatically create a ServiceNow ticket when a 'Compromised Host' event is generated. After deploying the playbook, new 'Compromised Host' events are visible in FortiAnalyzer, but no tickets are being created in ServiceNow. The Playbook Monitor shows the playbook is not being triggered. What is the most likely cause of this issue?
When creating a new ADOM in FortiAnalyzer 7.2, an administrator notices the 'ADOM Mode' option. What is the primary purpose of setting the ADOM Mode to 'Advanced'?
An analyst is reviewing the 'Compromised Hosts' list in the FortiView dashboard. They notice a host with a high threat score and several Indicators of Compromise (IOCs) listed. What is the primary source of the IOC data used by FortiAnalyzer to identify these compromised hosts?
A new SOC analyst is tasked with creating a playbook that performs the following actions upon detecting a high-severity IPS event: 1. Retrieve the source IP address from the event log. 2. Query a third-party threat intelligence service (via API) to check the IP's reputation. 3. If the reputation is 'malicious', add the IP to a specific address group on the edge FortiGate to block it. Which two playbook components are essential for this workflow? (Choose two.)
An administrator is configuring log fetching for a remote FortiGate. They want to ensure that if the connection between the FortiGate and FortiAnalyzer is interrupted, logs are buffered on the FortiGate and sent later when the connection is restored. Which FortiGate setting is required to enable this behavior?
A SOC analyst is debugging a playbook that is failing at a specific task. The task is supposed to extract a username from a log field and use it in a subsequent API call. The Playbook Monitor shows an error at the API call task. How can the analyst verify the value of the username variable as it was extracted in the preceding task?
A junior analyst has created an incident for a potential malware infection. The incident has been assigned to a senior analyst for investigation. The senior analyst reviews the incident, confirms it was a false positive, and adds a comment explaining their findings. What is the correct next step in the incident lifecycle for the senior analyst to perform?
A scheduled report on FortiAnalyzer fails to generate. When troubleshooting, the analyst finds the following error in the report's diagnostic logs: `hcache data is not ready`. What is the most likely cause of this error?
10 more free samples are waiting
Create a free account to unlock the whole NSE5-FAZ-7-2 sample bank, or get full access to all 217 practice questions in the simulator.