View all questions & answers for the NSE 5 - FortiAnalyzer 7.6 Analyst Exam Materials exam

NSE 5 - FortiAnalyzer 7.6 Analyst Exam Materials - Question #34 Discussion

Comment Image Comment Image Comment Image

Which two actions should you take to view compromised hosts on FortiAnalyzer? (Choose two answers)

  • A. Subscribe to the Outbreak Detection Service so that the FortiAnalyzer has the latest event handlers.
  • B. Subscribe FortiAnalyzer to FortiGuard to keep its local threat database up to date.
  • C. Enable web filtering in firewall policies on FortiGate devices, and make sure the FortiGate logs are sent to FortiAnalyzer.
  • D. Enable device detection on FortiGate devices that are sending logs to FortiAnalyze
Correct Answer: B,C

Brave-Dump Community Votes

Answer: B, C (2 votes) 66.67%
Answer: A, B (1 vote) 33.33%

Community Explanations & Comments (3)

Anonymous User 7 months ago
Selected: B, C
FortiAnayzer 7.6 Study Guide P130
B. Requires a FortiGuard subscription
FortiAnalyzer receives updates to its threat database from FortiGuard
IOC signatures... are based on a FortiGuard subscription
c. FortiAnalyzer found matches... in the web logs
Anonymous User 5 months ago
Selected: B, C
Opción B — Suscribir FortiAnalyzer a FortiGuard
La guía indica que el motor IOC (el que detecta hosts comprometidos) funciona verificando los logs contra las IOC signatures, las cuales están basadas en una suscripción a FortiGuard. Además, el servicio IOC usa la base de datos de FortiGuard para analizar web filtering, DNS y logs de tráfico, y se actualiza diariamente. Sin esta suscripción, la base de datos de amenazas no estaría disponible ni actualizada.
Opción C — Habilitar web filtering en FortiGate y asegurarse de que los logs lleguen a FortiAnalyzer
La guía especifica que el servicio IOC analiza web filtering, DNS y traffic logs provenientes de FortiGate. Para que FortiAnalyzer pueda detectar hosts comprometidos, esos logs deben existir y llegar al FortiAnalyzer. Si web filtering no está habilitado en los FortiGates, esos logs simplemente no se generan y el motor IOC no tiene datos con qué trabajar.
Anonymous User 4 months ago
Selected: A, B
AB