FCP FCP FortiAnalyzer & Log Management 2 — Questions and Answers
Question 1: What is the purpose of log forwarding in FortiAnalyzer?
- To send logs to a third-party SIEM or another FortiAnalyzer (Correct answer)
- To block malicious log entries
- To compress logs for local storage
- To generate PDF reports automatically
Correct answer: To send logs to a third-party SIEM or another FortiAnalyzer
Log forwarding allows FortiAnalyzer to send log data to external systems such as third-party SIEMs, syslog servers, or another FortiAnalyzer for redundancy.
Question 2: Which FortiAnalyzer feature provides a pre-built library of reports designed for compliance frameworks like PCI-DSS?
- Compliance report templates (Correct answer)
- Event handler playbooks
- FortiSoar integration
- ADOM policy packages
Correct answer: Compliance report templates
FortiAnalyzer includes compliance report templates mapped to standards like PCI-DSS, HIPAA, and ISO 27001 to simplify audit reporting.
Question 3: In FortiAnalyzer, what does the 'Fabric Analytics' feature enable?
- Correlating data across multiple Fortinet devices in the Security Fabric (Correct answer)
- Managing FortiGate firmware updates
- Pushing firewall policies to managed devices
- Resetting administrator passwords remotely
Correct answer: Correlating data across multiple Fortinet devices in the Security Fabric
Fabric Analytics enables FortiAnalyzer to correlate telemetry from multiple Fortinet Security Fabric members for holistic threat visibility.
Question 4: What is the recommended approach to maintain FortiAnalyzer high availability in a production environment?
- Deploy a FortiAnalyzer HA cluster with active-passive failover (Correct answer)
- Use a single FortiAnalyzer with frequent manual backups
- Forward all logs to FortiGate flash storage
- Enable ADOM replication to FortiManager
Correct answer: Deploy a FortiAnalyzer HA cluster with active-passive failover
FortiAnalyzer supports active-passive HA clustering, which ensures log collection and analysis continues uninterrupted if the primary unit fails.
Question 5: Which disk quota setting in FortiAnalyzer controls how much storage each ADOM can use?
- ADOM disk quota (Correct answer)
- Log retention policy
- Archive threshold
- Dataset cache limit
Correct answer: ADOM disk quota
The ADOM disk quota setting limits how much total disk space each Administrative Domain can consume for logs and archives.
Question 6: In FortiAnalyzer, what is the function of a 'report schedule'?
- Automatically generating and distributing reports at defined times (Correct answer)
- Scheduling firmware upgrades on managed devices
- Rotating log archive files weekly
- Refreshing ADOM membership lists
Correct answer: Automatically generating and distributing reports at defined times
Report schedules automate the generation and email distribution of reports at configured intervals, reducing manual administrative effort.
FCP FCP FortiAnalyzer & Log Management 2
What is the purpose of log forwarding in FortiAnalyzer?