Describe FortiSASE Logs to Identify Potential Security Threats NSE5-SD-WAN-CORE-ADMINISTRATOR Practice Questions (Page 5)

Questions 21–22

1. 21foundation · easy

   Which pattern in a FortiSASE security log is most likely to indicate a potential brute-force attack?

   • AA high number of failed login attempts from the same source in a short time
   • BA large file transfer from a trusted internal host
   • CAn increase in successful logins from various users during business hours
   • DA single successful login from a known IP address
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A FortiSASE administrator is investigating a potential data exfiltration incident. Reviewing the traffic logs, they see a user uploading a large file to a personal cloud storage service. The threat logs show no blocked events for this user. The event logs show a successful login from the user's usual IP address. What additional log source should the administrator correlate to determine if this is a security incident?

   • ATraffic logs from other users to see if similar uploads are occurring.
   • BAudit logs to check for changes to the user's permissions or group memberships.
   • CApplication control logs to see if the cloud storage service is sanctioned or if this is the first time it has been used.
   • DThe user's authentication logs to verify the login was not from a different device or session.
   Reveal Solution Discussion Select an answer first