Question 31
Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?
A. You can perform the firmware upgrade using only a console connection.
B. First, upgrade the secondary device, and then upgrade the primary device.
C. You can enable uninterruptible-upgrade so that the normal FortiAnalyzer operations are not interrupted while the cluster firmware upgrades.
D. Both FortiAnalyzer devices will be upgraded at the same time.
Question 32
Which two statements are true regarding ADOM modes? (Choose two.)
A. You can change ADOM modes only through the CLI.
B. In normal mode, the disk quota of the ADOM is fixed and cannot be modified, but in advanced mode, the disk quota of the ADOM is flexible.
C. In an advanced mode ADOM, you can assign FortiGate VDOMs from a single FortiGate device to multiple FortiAnalyzer ADOMs.
D. Normal mode is the default ADOM mode.
Question 33
An administrator, fortinet, is able to view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mail server that can be used to send alert emails.
What can be the problem?
A. fortinet is assigned the Standard_User administrative profile.
B. A trusted host is configured.
C. ADOM mode is configured with Advanced mode.
D. fortinet is assigned the Restricted_User administrative profile.
Question 34
What are offline logs on FortiAnalyzer?
A. Logs that are collected from offline devices after they boot up
B. Compressed logs, also known as archive logs, are considered to be offline logs
C. Logs that are indexed and stored in the SQL database
D. When you restart FortiAnalyzer, all stored logs are considered to be offline logs
Question 35
Refer to the exhibit.
Laptop1 is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than “admin" and coming from Laptop1.
Which filter will achieve the desired result?
A. operation-login & performed_on=="GUI(10.1.1.100)" & user!=admin
B. operation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin
C. operation-login & dstip==10.1.1.210 & userl-admin
D. operation-login & performed_on=="GUI(10.1.1.210)/' & user!=admin
