Pass the Fortinet NSE 5 Network Security Analyst NSE5_FAZ-7.2 Questions and answers with ValidTests

To prevent logs from being tampered with while in storage, you can add a log checksum using the config

system global command. You can configure FortiAnalyzer to record a log file hash value, timestamp, and

authentication code when the log is rolled and archived and when the log is uploaded (if that feature is

enabled). This can also help against man-in-the-middle only for the transmission from FortiAnalyzer to an

SSH File Transfer Protocol (SFTP) server during log upload.

FortiAnalyzer_7.0_Study_Guide-Online page 149

In the case of a primary device failure, FortiAnalyzer HA uses the following rules to select a new primary:

• All cluster devices are assigned a priority from 80 to 120. The default priority is 100. If the primary device

becomes unavailable, the device with the highest priority is selected as the new primary device. For

example, a device with a priority of 110 is selected over a device with a priority of 100.

• If multiple devices have the same priority, the device whose primary IP address has the greatest value is

selected as the new primary device. For example, 123.45.67.124 is selected over 123.45.67.123.

• If a new device with a higher priority or a greater value IP address joins the cluster, the new device does

not replace (or pre-empt) the current primary device automatically.

FortiAnalyzer_7.0_Study_Guide-Online page 62

https://docs.fortinet.com/document/fortianalyzer/6.2.5/administration-guide/717578/assigning-administrators-to-an-adom

FortiAnalyzer_7.0_Study_Guide-Online.pdf page 93: The fourth method uses the Fortinet Security Fabric authorization process. This method requires that both FortiGate and FortiAnalyzer are running version 7.0.1 or higher. It is also required that the FortiGate administrator has valid credentials to log in on FortiAnalyzer and complete the registration.

https://docs.fortinet.com/document/fortianalyzer/7.2.1/administration-guide/13897/adding-a-fortigate-using-security-fabric-authorization

https://kb.fortinet.com/kb /documentLink.do?externalID=FD46446#:~:text=On%20FortiAnalyzer%2FFortiManager%20devices%20that,to%20exchanging%20the%20hard%20disk.

If a hard disk on a FortiAnalyzer unit fails, it must be replaced. On FortiAnalyzer devices that support hardware RAID, the hard disk can be replaced while the unit is still running – known as hot swapping. On FortiAnalyzer units with software RAID, the device must be shutdown prior to exchanging the hard disk.