Fortinet Exam NSE5_FAZ-7.2 Topic 1 Question 13 Discussion

Actual exam question for Fortinet's NSE5_FAZ-7.2 exam

Question #: 13
Topic #: 1

Refer to the exhibit.

Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin" and coming from Laptop1:

Which filter will achieve the desired result?

Aoperation-login & performed_on=='GUI(10.1.1.100)' & user!=admin

Boperation-login & srcip==10.1.1.100 & dstip==10.1.1.210 & user==admin

Coperation-login & dstip==10.1.1.210 & userl-admin

Doperation-login & performed_on=='GUI(10.1.1.210)' & user!=admin

Show Suggested Answer

Suggested Answer: A

On there the task was to create a filter for failed logins from any other location but the local computer: 'Add the text performed_on!~10.0.1.10. This includes any attempts coming from devices with an IP address that is not the one configured on the Local-Client computer.'

by Elke at Feb 07, 2024, 07:04 PM

Limited Time Offer

25%

Off

Get Premium NSE5_FAZ-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Ruthann

8 days ago

I was leaning towards option A, but now I'm not so sure. Let me re-read the question and the options again.

upvoted 0 times

...

Von

9 days ago

Hmm, I think the answer is option D. The 'performed_on' field specifies the source IP address, which in this case is Laptop1 (10.1.1.100), and the 'user!=admin' condition ensures we exclude the 'admin' user.

upvoted 0 times

...

Ines

10 days ago

Exactly. That's my understanding too. The key here is to use the right combination of filter fields to achieve the desired result.

upvoted 0 times

...

Annamaria

11 days ago

This question seems pretty straightforward, but I want to make sure I understand the requirements correctly. We need to configure a filter that matches all login attempts to the web interface, excluding the 'admin' user, and coming from Laptop1 with the IP address 10.1.1.100, right?

upvoted 0 times

...