NSE5-FAZ-7-2 Sample Questions & Answers

The 'Advanced' ADOM mode is specifically designed to support devices running different major firmware versions within a single ADOM. This is useful in environments with a mix of FortiOS versions, although it may limit the visibility of certain version-specific features. The 'Normal' mode restricts the ADOM to devices of the same major firmware version.

The 'Compromised Hosts' feature primarily relies on the FortiGuard Outbreak Detection Service (previously known as the IOC service). FortiAnalyzer downloads a package of IOCs from FortiGuard and scans incoming logs for matches. When a log entry matches a known indicator of compromise, the source IP is flagged and added to the Compromised Hosts list.

This workflow requires two key integrations: 1) An HTTP connector is needed to make an API call to the external threat intelligence service. 2) A FortiGate connector is required to interact with the FortiGate device and add the malicious IP to the specified address group for blocking.

On the FortiGate, under the config log fortianalyzer setting, the upload-option must be set to store-and-upload. This enables the reliable logging feature, where logs are stored locally on the FortiGate's disk if the FortiAnalyzer is unreachable. Once the connection is re-established, the buffered logs are uploaded.

The Playbook Monitor provides detailed execution logs for each playbook run. To debug variable values, an analyst can navigate to the specific failed run, find the task that was supposed to extract the username, and expand its details. The 'Output' section for that task will show the exact values that were produced and passed on as variables to subsequent tasks, allowing the analyst to confirm if the extraction was successful or if the value was malformed.

Proper incident lifecycle management requires that all incidents are tracked to completion. After an investigation is complete, the correct procedure is to close the incident and set an appropriate resolution status, such as 'Resolved', 'False Positive', or 'Remediated'. This provides an audit trail and metrics for SOC performance. Deleting the incident would erase this valuable record.

The hcache (historical cache) is used by FortiAnalyzer's auto-cache feature to pre-process data for faster report generation. The error hcache data is not ready indicates that the scheduled report attempted to run before the underlying auto-cache job for its datasets was finished. This can happen if the cache generation takes longer than the interval between report runs.

The log-insert-lag-time is a key performance indicator for the FortiAnalyzer's logging daemon. It represents the time difference between a log's arrival at the FortiAnalyzer and its successful insertion into the analytics SQL database. A consistently high lag time indicates that the FortiAnalyzer is struggling to keep up with the log rate, potentially due to high I/O wait or CPU load.

This statement is false. The Threat Hunting feature in FortiAnalyzer 7.2 provides pre-defined queries that analysts can run against their log data. These queries are categorized and mapped to both Indicators of Compromise (IOCs) and specific MITRE ATT&CK techniques, allowing analysts to hunt for threats based on known adversary tactics and behaviors.

FortiAnalyzer provides a native, direct way to automate incident creation from events without needing a playbook for this simple action. By editing the event handler itself, you can configure it to automatically create an incident whenever the event is triggered. This is the most direct and efficient method. While a playbook could achieve this, it adds unnecessary complexity for a simple 'event-to-incident' workflow that is built directly into the event handler's notification options.