Describe FortiSASE Logs to Identify Potential Security Threats NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–15

1. 11application · easy

   A FortiSASE administrator needs to review a record of administrative changes made to the SD-WAN configuration, such as who modified a policy and when. Which type of log should the administrator consult?

   • AThreat logs.
   • BTraffic logs.
   • CAudit logs.
   • DEvent logs.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A FortiSASE administrator is investigating a potential data breach. The threat logs show a single blocked event for a user attempting to access a known malicious URL. The traffic logs show the user has been uploading large amounts of data to a file-sharing site over the past week. The event logs show the user's account has been locked out multiple times due to failed password attempts. What is the MOST likely conclusion?

   • AThe user is a victim of a brute-force attack, and the malicious URL was a phishing attempt.
   • BThe user's account is compromised, and the attacker is using it to exfiltrate data.
   • CThe user is conducting personal business on the corporate network, and the data uploads are unrelated to the security events.
   • DThe FortiSASE policy is incorrectly blocking the user's legitimate activity.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary purpose of configuring an external log server in FortiSASE?

   • ATo increase the processing speed of security inspections
   • BTo replace the need for FortiSASE dashboards
   • CTo export logs for centralized monitoring and analysis
   • DTo automatically block malicious IP addresses
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company's SOC team uses a SIEM platform that only supports receiving logs via Syslog. The FortiSASE administrator needs to configure log export to the SIEM. The administrator is concerned about the security of the log data in transit. What should the administrator do?

   • AUse a VPN tunnel to the SIEM server.
   • BUse Syslog over UDP to minimize latency.
   • CUse Syslog over TCP to ensure reliable delivery.
   • DUse Syslog over TLS to encrypt the log data in transit.
   Reveal Solution Discussion Select an answer first
6. 15application · easy

   A company's security team uses a SIEM platform that only supports receiving logs via Syslog. The FortiSASE administrator needs to configure log export to the SIEM. What information is REQUIRED to complete the configuration?

   • AThe API key for the SIEM platform.
   • BThe FortiSASE tenant ID.
   • CThe username and password for the SIEM server.
   • DThe IP address and port of the SIEM server.
   Reveal Solution Discussion Select an answer first