A. Incidents dashboards

B. Threat hunting

C. Outbreak alert services

D. FortiView Monitor

A. Log correlation

B. Real-time forwarding

C. Log collection

D. Host name resolution

A. By editing the settings of the desired report

B. From the properties of an existing incident

C. Saving it in JSON format, and then importing it

D. By attaching it to an event handler alert

A. One or more drives are missing from the FortiAnalyzer unit. The drive is no longer available to the operating system.

B. The FortiAnalyzer device is writing to all the hard drives on the device in order to make the array fault tolerant.

C. The hard driveiIs no longer being used by the RAID controller

D. The FortiAnalyzer device is writing data to a newly added hard drive in order to restore the hard drive to an optimal state.

A. By default, Log Data Sync is disabled on all backup devise.

B. When Logs Data Sync is turned on, the backup device will reboot and then rebuilt the log database with the synchronized logs.

C. Log Data Sync provides real-time log synchronization to all backup devices.

D. With initial Logs Sync, when you add a unit to an HA cluster, the primary device synchronizes its logs with the backup device.

A. You can add charts to generated reports using this feature.

B. In Log View, this feature allows you to build a chart and chart automatically, on the top 100 log entries.

C. In Log View, this feature allows you to build a dataset and chart automatically, based on the filtered search results.

D. This feature allows you to build a chart under FortiView.

A. This password is used if the authentication server becomes unreachable.

B. This password is required because this is a restricted user.

C. This password authenticates FortiAnalyzer aqainst the LDAP server.

D. This password is set to comply with FortiAnalvzer password policy

A. It creates a wildcard administrator using an LDAP server.

B. User Remote-Admin from the LDAP server will be able to log in to FortiAnalyzer at any time.

C. It allows user accounts in the LDAP server to use two-factor authentication.

D. Administrators can log in to FortiAnalyzer using their credentials on the remote LDAP server.

A. To properly correlate logs

B. To resolve host names

C. To improve DNS response times

D. To use real-time forwarding

A. Option D

B. Option C

C. Option A

D. Option B

A. Any logs collected from offline devices after they boot up

B. Real-time logs that are not yet indexed

C. Compressed logs, also known as archive logs

D. Logs that are indexed and stored in the SQL database

A. FortiGate must be registered with FortiAnalyzer

B. ADOMs must be enabled

C. Log encryption must be enabled

D. Remote logging must be enabled on FortiGate

A. Cloud-Out connections allow you to send real-time logs to pubic cloud accounts like Amazon S3, Azure Blob , and Google Cloud.

B. Fabric connectors allow to save storage costs and improve redundancy.

C. Configuring fabric connectors to send notification to ITSM platform upon incident creation Is more efficient than third-party information from the FortiAnalyzer API.

D. Storage connector service does not require a separate license to send logs to cloud platform.

A. SELECT devid WHERE 'u3er'='USERl' FROM $ log GROUP BY devid

B. SELECT devid FROM Slog GROOP BY devid WHERE * user' =* USERl'

C. FROM Slog WHERE 'user* =' USERl' SELECT devid GROUP BY devid

D. SELECT devid FROM Slog- WHERE *user' =' USERl' GROUP BY devid