NSE 5 Network Security Analyst — FortiAnalyzer Exam Blueprint

Historical NSE 5 Network Security Analyst — FortiAnalyzer Scope

The NSE 5 Network Security Analyst — FortiAnalyzer examination, designated by code FCP_FAZ_AD-7.4 and certified by Fortinet, covered administrative tasks and management features for FortiAnalyzer deployments across multiple domains. Fortinet officially retired this examination on 2025-10-14. Candidates seeking certification paths now pursue the NSE 6 - FortiAnalyzer 7.6 Administrator instead.

Who NSE 5 Network Security Analyst — FortiAnalyzer Was For

Network security professionals, enterprise system administrators, and technical support engineers who are directly responsible for configuring, managing, and monitoring complex FortiAnalyzer deployments within enterprise production environments.

Skills You Should Be Ready to Demonstrate

• Deployment and Configuration
• Log Management and Storage
• FortiView and Event Management
• Reports and Analytics
• High Availability

How to Reuse Your Preparation

Carefully review official Fortinet training and study documentation covering deployment procedures, log storage policies, event handlers, and high availability settings in detail. Perform practical laboratory exercises focused on administrative domains, log routing, and system monitoring to master each exam domain before taking any official assessment.

Historical Domain Guide

Deployment and Configuration: Historical Scope

This domain covers fundamental deployment procedures and initial configuration tasks for FortiAnalyzer units, including setting up administrative access, managing licenses, and configuring system settings carefully for standard operational environments.

• Connecting to the GUI
• Initial setup procedures
• Licensing and registration

Log Management and Storage: Historical Scope

Focuses on advanced log management, storage allocation, and data retention policies, detailing how logs are safely received, parsed, stored, and managed on the disk effectively across various enterprise architectures.

• Log storage policies
• Disk utilization and automatic deletion
• Log receive monitoring

FortiView and Event Management: Historical Scope

Examines FortiView dashboards, custom event handlers, and threat monitoring tools designed specifically to analyze network traffic, security events, and indicators of compromise broadly within diverse organizational infrastructure implementations.

• FortiView dashboards
• Predefined and custom event handlers
• Indicators of Compromise

Reports and Analytics: Historical Scope

Covers report generation, custom chart creation, datasets, and analytics tools used to extract data from logs and produce scheduled administrative reports reliably for executive review and operational auditing.

• Generating and scheduling reports
• Custom datasets and SQL queries
• Report templates and charts

High Availability: Historical Scope

This detailed domain explicitly addresses high availability configurations, log synchronization, configuration synchronization, and failover management required for reliable and stable FortiAnalyzer deployments across standard corporate networking infrastructure and enterprise production environments.

• Configuring HA options
• Log and configuration synchronization
• Monitoring HA status