Describe FortiSASE Logs to Identify Potential Security Threats NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst is reviewing the FortiSASE 'Security Events' dashboard and notices a high number of 'blocked' events for a specific user. The threat logs show the user is attempting to access a known malicious URL. The traffic logs show the user is also uploading large amounts of data to a file-sharing site. The event logs show the user's account has been locked out multiple times due to failed password attempts. What is the MOST likely conclusion?

   • AThe user's account is compromised, and the attacker is using it to exfiltrate data.
   • BThe user is a victim of a brute-force attack, and the malicious URL was a phishing attempt.
   • CThe FortiSASE policy is incorrectly blocking the user's legitimate activity.
   • DThe user is conducting personal business on the corporate network, and the data uploads are unrelated to the security events.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst is reviewing the FortiSASE dashboard and notices a high number of 'Threat Events' on the main dashboard. The analyst wants to quickly identify which specific users are generating the most threat events and what types of threats they are. Which dashboard widget or section should the analyst use?

   • AThe 'Threat Map' widget.
   • BThe 'Top Threats' and 'Top Users' widgets on the 'Security Events' dashboard.
   • CThe 'Top Users' widget on the 'Security Events' dashboard.
   • DThe 'Logs' section, filtering by 'Threat' and grouping by user.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A network administrator is monitoring the FortiSASE feature monitors and notices that the 'ZTNA Access Proxy' monitor shows a high number of 'failed' connections. The administrator wants to quickly determine if this is a widespread issue or isolated to a specific user. What should the administrator do?

   • AConfigure an external log server to export the logs for analysis.
   • BReview the 'Threat Logs' to see if the failed connections are due to security blocks.
   • CUse the 'Feature Monitor' to drill down into the failed connections and filter by user.
   • DCheck the 'Event Logs' for any system-wide errors.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which scenario best illustrates the value of correlating FortiSASE logs?

   • AAn event log shows a system reboot
   • BA single log shows a blocked malware download
   • CA traffic log shows a connection to a known malicious IP, and a threat log shows a matching intrusion prevention detection
   • DAn audit log shows a policy change
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which FortiSASE log type records the outcome of security inspection, such as whether a file was blocked by antivirus or a URL was denied by web filtering?

   • AThreat log
   • BAudit log
   • CEvent log
   • DTraffic log
   Reveal Solution Discussion Select an answer first