Describe FortiSASE Logs to Identify Potential Security Threats NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A network administrator is troubleshooting a user's inability to reach a specific SaaS application. The user's traffic logs show the connection was allowed, but the user reports the application is timing out. The administrator wants to see real-time information about the current state of the FortiSASE secure web gateway (SWG) to check for any issues. Which FortiSASE feature should the administrator use?

   • AThe 'Feature Monitors' section, specifically the SWG monitor.
   • BThe 'External Log Server' configuration page.
   • CThe 'Security Events' dashboard.
   • DThe 'Logs' section, filtering for the user's traffic.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's compliance team requires that all FortiSASE logs be retained for at least one year for regulatory purposes. The FortiSASE cloud service only retains logs for 30 days by default. What should the administrator do to meet this requirement?

   • AConfigure an external log server to receive and store the logs.
   • BIncrease the log retention period in the FortiSASE settings.
   • CUse the 'Feature Monitors' to capture and store the logs.
   • DDownload the logs manually on a daily basis.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An administrator needs to review a record of who changed a security policy and when. Which FortiSASE log type should they examine?

   • ATraffic log
   • BEvent log
   • CThreat log
   • DAudit log
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An administrator wants to see a live view of currently active VPN tunnels and their status. Which FortiSASE feature monitor should they use?

   • AVPN monitor
   • BThreat monitor
   • CTraffic monitor
   • DEvent monitor
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   A FortiSASE administrator wants to get a high-level overview of the security posture of the organization. They want to see the total number of blocked threats, the top threat types, and the number of active users. Which dashboard should the administrator use?

   • AThe 'Audit Logs' section.
   • BThe 'Feature Monitors' section.
   • CThe 'Traffic' dashboard.
   • DThe 'Security Events' dashboard.
   Reveal Solution Discussion Select an answer first