NSE5_FAZ-7.2

Which statement about sending notifications with incident updates is true?

•  Notifications can be sent only when an incident is created or deleted.

• You must configure an output profile to send notifications by email.

• Each incident can send notifications to a single external platform.

• Each connector used can have different notification settings.

Why must you wait for several minutes before you run a playbook that you just created?

•  FortiAnalyzer needs that time to back up the current playbooks.

• FortiAnalyzer needs that time to parse the new playbook

• FortiAnalyzer needs that time to ensure there are no other playbooks running.

• FortiAnalyzer needs that time to debug the new playbook.

How can you attach a report to an incident?

• By attaching it to an event handler alert

• By editing the settings of the desired report

• From the properties of an existing incident

• Saving it in JSON format, and then importing it

Which statement is correct regarding the event displayed?

•  The security event risk is considered open.

• The security risk was blocked or dropped

• The risk source is isolated.

• An incident was created from this event.

What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

• FortiAnalyzer flags the associated host for further analysis.

• The endpoint is marked as Compromised and, optionally, can be put in quarantine.

• A new Infected entry is added for the corresponding endpoint.

• The detection engine classifies those logs as Suspicious.

Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)

• Send Alert through Fabric Connectors

• Send Alert through FortiSIEM MEA

• Send SNMP trap

• Send SMS notification

Why run the command diagnose sql status sqlplugind?

• To list the current SQL processes running

•  To check what is the database log insertion status 

• To display the SQL query connections and hcache status

• To view the current hcache size

What are two benefits of using fabric connectors? (Choose two.)

• They allow FortiAnalyzer to send logs in real-time to public cloud accounts.

• You do not need an additional license to send logs to the cloud platform.

• Fabric connectors allow you to improve redundancy.

• Using fabric connectors is more efficient than using third-party polling with API.

Which statement correctly describes the management extensions available on FortiAnalyzer?

• Management extensions do not require additional licenses.

• Management extensions may require a minimum number of CPU cores to run

• Management extensions allow FortiAnalyzer to act as a FortiSIEM supervisor.

• Management extensions require a dedicated VM for best performance.

Which statement describes a dataset in FortiAnalyzer?

• They determine what data is retrieved from the database.

• They provide the layout used for reports.

• They are used to set the data included in templates.

• They define the chart types to be used in reports.