Refer to the exhibits.


How many events will be added to the incident created after running this playbook?

1. A. Ten events will be added.
2. B. No events will be added.
3. C. Five events will be added.
4. D. Thirteen events will be added.

Correct Answer: C

Which statement is true regarding Macros on FortiAnalyzer?

1. A. Macros are ADOM specific and each ADOM will have unique macros relevant to that ADOM.
2. B. Macros are supported only on the FortiGate ADOM.
3. C. Macros are useful in generating excel log files automatically based on the reports settings.
4. D. Macros are predefined templates for reports and cannot be customized.

Correct Answer: A

What is the purpose of a dataset query in FortiAnalyzer?

1. A. It sorts log data into tables
2. B. It extracts the database schema
3. C. It retrieves log data from the database
4. D. It injects log data into the database

Correct Answer: C

Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

1. A. Must configure the FortiAnalyzer end of the tunnel only--the FortiGate end is auto-negotiated.
2. B. Must establish an IPsec tunnel ID and pre-shared key.
3. C. IPsec cannot be enabled if SSL is enabled as well.
4. D. IPsec is only enabled through the CLI on FortiAnalyzer.

Correct Answer: C

You’ve moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?

1. A. FortiAnalyzer resets the disk quota of the new ADOM to default.
2. B. FortiAnalyzer migrates archive logs to the new ADOM.
3. C. FortiAnalyzer migrates analytics logs to the new ADOM.
4. D. FortiAnalyzer removes logs from the old ADOM.

Correct Answer: C
https://kb.fortinet.com/kb/documentLink.do?externalID=FD40383