FCP FortiAnalyzer & Log Management Flashcards

What is the purpose of log forwarding in FortiAnalyzer?

Answer: To send logs to a third-party SIEM or another FortiAnalyzer

Log forwarding allows FortiAnalyzer to send log data to external systems such as third-party SIEMs, syslog servers, or another FortiAnalyzer for redundancy.

Which FortiAnalyzer feature provides a pre-built library of reports designed for compliance frameworks like PCI-DSS?

Answer: Compliance report templates

FortiAnalyzer includes compliance report templates mapped to standards like PCI-DSS, HIPAA, and ISO 27001 to simplify audit reporting.

In FortiAnalyzer, what does the 'Fabric Analytics' feature enable?

Answer: Correlating data across multiple Fortinet devices in the Security Fabric

Fabric Analytics enables FortiAnalyzer to correlate telemetry from multiple Fortinet Security Fabric members for holistic threat visibility.

What is the recommended approach to maintain FortiAnalyzer high availability in a production environment?

Answer: Deploy a FortiAnalyzer HA cluster with active-passive failover

FortiAnalyzer supports active-passive HA clustering, which ensures log collection and analysis continues uninterrupted if the primary unit fails.

Which disk quota setting in FortiAnalyzer controls how much storage each ADOM can use?

Answer: ADOM disk quota

The ADOM disk quota setting limits how much total disk space each Administrative Domain can consume for logs and archives.

In FortiAnalyzer, what is the function of a 'report schedule'?

Answer: Automatically generating and distributing reports at defined times

Report schedules automate the generation and email distribution of reports at configured intervals, reducing manual administrative effort.