FCP FortiAnalyzer & Log Management Flashcards

Which protocol does FortiAnalyzer primarily use to receive logs from FortiGate devices?

Answer: Fortinet proprietary encrypted protocol (oftp)

FortiGate sends logs to FortiAnalyzer using the Fortinet-proprietary oftp (object file transfer protocol) over an encrypted SSL channel.

What does the FortiAnalyzer 'Security Operations' dashboard provide?

Answer: A real-time consolidated view of threats, incidents, and top sources across managed devices

The Security Operations dashboard aggregates threat data, top attack sources, incident counts, and risk indicators in a single real-time view.

When configuring reliable log transmission from FortiGate to FortiAnalyzer, which setting ensures logs are not lost during network interruptions?

Answer: Enable reliable logging (TCP-based)

Enabling reliable logging on FortiGate switches log delivery to TCP-based transport, which retransmits logs if the connection to FortiAnalyzer is interrupted.

In FortiAnalyzer, which role has full read-write access including configuration of ADOMs and system settings?

Answer: Super administrator

The super administrator role in FortiAnalyzer has unrestricted access to all ADOMs, system settings, and configuration options.

What is the purpose of the FortiAnalyzer 'Indicators of Compromise' (IoC) feature?

Answer: Automatically flagging log events that match known threat intelligence patterns

The IoC feature correlates log data against threat intelligence feeds to automatically identify and alert on events matching known compromise indicators.

Which FortiAnalyzer feature helps administrators visualize the network topology of connected Security Fabric devices?

Answer: Security Fabric topology view

The Security Fabric topology view in FortiAnalyzer displays a graphical map of all connected Fortinet devices and their relationships within the fabric.