I85PREP
⌘ K
FCP FortiAnalyzer 7.4 study materials
FCP FortiAnalyzer 7.4 study resources

FCP FortiAnalyzer 7.4 practice questions

One question at a time. Build your FCP FortiAnalyzer 7.4 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Deployment and System Configuration

Which FortiAnalyzer deployment mode is required when the appliance must store logs for FortiGate devices and also provide reports to a FortiManager that manages those devices?

  1. Standalone mode with the FortiManager integration disabled
  2. Collector mode joined to a FortiManager
  3. Analyzer mode registered to a FortiManager Correct answer.
  4. Standalone mode using only the local log store

Explanation

In Analyzer mode, FortiAnalyzer is registered to a FortiManager, which pushes device log settings and receives reports back. Collector mode only forwards logs and does not generate its own reports for managed devices. Standalone mode works without a FortiManager at all.

Question 2Deployment and System Configuration

Which default administrative account is created on a freshly initialized FortiAnalyzer unit?

  1. admin Correct answer.
  2. fortianalyzer
  3. superuser
  4. root

Explanation

FortiAnalyzer ships with a single default administrator account named admin, which is prompted for a new password during initial setup. Other account names must be created manually by an administrator with sufficient privileges.

Question 3Deployment and System Configuration

An administrator wants FortiAnalyzer to receive logs from a FortiGate without any manual device registration on the analyzer. Which setting on the FortiGate makes this possible?

  1. Add the FortiAnalyzer as an SNMP trap destination
  2. Enable remote logging with the FortiAnalyzer serial number only
  3. Configure the FortiAnalyzer as a syslog server on UDP 514
  4. Enable logging to FortiAnalyzer using the analyzer IP and a registration password Correct answer.

Explanation

When the FortiGate is configured with the FortiAnalyzer IP and the correct registration password, the analyzer can auto-detect and add the device. This avoids manual device creation in Device Manager. Plain syslog or SNMP does not perform FortiAnalyzer device registration.

Question 4Deployment and System Configuration

What is the purpose of the FortiAnalyzer RAID management page in the GUI?

  1. To set the retention policy for archived reports
  2. To monitor and manage the disk array status of the log storage Correct answer.
  3. To define administrative profiles for log access
  4. To configure log forwarding to a remote collector

Explanation

RAID management shows the status of the disk array used for log storage and allows operations such as rebuilding or replacing failed disks. Log forwarding, retention, and admin profiles are configured elsewhere.

Question 5Deployment and System Configuration

Which FortiAnalyzer feature must be enabled before an administrator can use the Log View to search raw logs received from registered devices?

  1. Report scheduling
  2. Content archiving
  3. Log reception from the device Correct answer.
  4. FortiView

Explanation

Raw log search requires that the analyzer actually receive logs from the device, which depends on log reception being enabled and the device being registered. FortiView and reports consume logs but do not enable reception.

Question 6Deployment and System Configuration

An administrator needs to restrict GUI and API access to FortiAnalyzer so that only the management subnet 10.10.10.0/24 can connect. Which configuration accomplishes this?

  1. Create an administrative domain limited to that subnet
  2. Add a trusted host entry for 10.10.10.0/24 on the administrator account Correct answer.
  3. Configure a local-in policy on the FortiAnalyzer interface
  4. Enable two-factor authentication for all administrators

Explanation

Trusted hosts on the administrator account limit which source addresses may authenticate to the GUI and API. Administrative domains partition managed devices and logs, not network access. Local-in policies are a FortiGate feature, not FortiAnalyzer.

Question 7Deployment and System Configuration

Which protocol and port does FortiAnalyzer use by default to receive logs from FortiGate devices when OFTP is selected?

  1. UDP 514 Correct answer.
  2. TCP 443
  3. TCP 514 over TLS
  4. TCP 514

Explanation

FortiAnalyzer receives FortiGate logs over OFTP on UDP port 514 by default. Syslog can also use UDP 514, but OFTP is the Fortinet logging protocol used for reliable log delivery. TCP 443 is used for HTTPS management.

Question 8Deployment and System Configuration

What does the FortiAnalyzer operation mode 'Collector' do with logs received from devices?

  1. Registers with FortiManager to receive device configurations
  2. Forwards logs to another FortiAnalyzer and does not generate reports Correct answer.
  3. Provides only FortiView dashboards without storing raw logs
  4. Stores logs locally and generates reports for those devices

Explanation

A collector FortiAnalyzer receives logs and forwards them to an upstream analyzer or analyzer-mode FortiAnalyzer. It does not perform reporting on the forwarded logs. Reporting is the role of the analyzer that receives the forwarded stream.

Question 9Deployment and System Configuration

Which command-line action on FortiAnalyzer resets the administrative password when the admin account is locked out?

  1. config system admin followed by set password Correct answer.
  2. execute factoryreset
  3. diagnose sys admin password-reset
  4. execute restore config

Explanation

Editing the admin account under config system admin and setting a new password restores access without wiping the configuration. Factory reset destroys all data, and restore config replaces the whole configuration. There is no diagnose command for password reset.

Question 10Deployment and System Configuration

An administrator wants to allocate separate log storage quotas to different departments using administrative domains. Which statement describes the correct approach?

  1. Enable multi-tenancy in the FortiGate configuration
  2. Create an ADOM per department and assign devices and administrators to each ADOM Correct answer.
  3. Create a separate administrator account per department without ADOMs
  4. Create a VDOM per department on the FortiAnalyzer

Explanation

Administrative domains partition devices, logs, and administrators so each department sees only its own data. FortiAnalyzer does not use VDOMs for this purpose, and separate admin accounts alone do not isolate log data.

Question 11Deployment and System Configuration

Which FortiAnalyzer setting controls how long raw logs are kept before being purged from the local disk?

  1. Log retention policy under the analytics settings Correct answer.
  2. The FortiGate log setting 'maximum log age'
  3. The RAID rebuild schedule
  4. Report archive retention

Explanation

FortiAnalyzer applies a log retention policy to determine when raw logs are deleted from local storage. Report archive retention applies to generated reports, and FortiGate settings govern the device's own buffer, not analyzer storage.

Question 12Deployment and System Configuration

An administrator must ensure FortiAnalyzer can resolve device hostnames when generating reports. Which configuration item should be set?

  1. A syslog server for external forwarding
  2. A static route to 0.0.0.0/0
  3. An NTP server for time synchronization
  4. A DNS server under system network settings Correct answer.

Explanation

Configuring DNS servers on FortiAnalyzer allows hostname resolution used in reports and device identification. Static routes affect reachability, NTP affects timestamps, and syslog forwarding affects log export, not name resolution.

Question 13Deployment and System Configuration

Which FortiAnalyzer feature allows an administrator to define which log fields are indexed to improve search performance?

  1. Report templates
  2. Event handlers
  3. FortiView drill-down filters
  4. Log field indexing under log settings Correct answer.

Explanation

FortiAnalyzer lets administrators configure indexed log fields so that frequent searches run faster. FortiView filters and report templates consume indexed data but do not define which fields are indexed. Event handlers trigger actions based on log events.

Question 14Deployment and System Configuration

An administrator configures a FortiAnalyzer HA cluster. Which statement about HA in FortiAnalyzer is correct?

  1. HA is only supported in Collector mode
  2. HA provides redundancy where the primary synchronizes logs and configuration to the secondary Correct answer.
  3. HA requires both nodes to share the same IP address on all interfaces
  4. HA requires a FortiManager to coordinate failover

Explanation

FortiAnalyzer HA pairs a primary and secondary node, with the primary synchronizing configuration and logs to the secondary for failover. Separate management addresses are used, and FortiManager is not required to coordinate failover. HA is supported in analyzer and collector roles.

Question 15Deployment and System Configuration

Which action must be performed on FortiAnalyzer before a FortiGate running a newer firmware version can be added successfully?

  1. Disable log reception on the FortiGate
  2. Ensure the FortiAnalyzer firmware supports the device firmware version Correct answer.
  3. Downgrade the FortiGate to match the analyzer firmware
  4. Convert the FortiAnalyzer to Collector mode

Explanation

Device compatibility depends on the FortiAnalyzer firmware supporting the FortiGate firmware version. Downgrading the device or disabling logging would defeat the purpose, and collector mode does not resolve compatibility issues.

Question 16Deployment and System Configuration

What is the effect of enabling 'FortiAnalyzer Cloud' style remote log storage on a FortiGate?

  1. Logs are sent to a FortiAnalyzer or cloud logging service configured in the device settings Correct answer.
  2. Logs are converted to SNMP traps
  3. Logs are written to a USB drive attached to the FortiGate
  4. Logs are stored only in the FortiGate local buffer

Explanation

When remote logging to FortiAnalyzer is enabled, the FortiGate sends logs to the configured analyzer or cloud service rather than only storing them locally. SNMP traps and USB storage are separate features.

Question 17Deployment and System Configuration

An administrator wants to back up the FortiAnalyzer configuration without including logs. Which backup option should be selected?

  1. Backup reports only
  2. Backup logs only
  3. Backup configuration only Correct answer.
  4. Backup all settings including logs

Explanation

A configuration-only backup captures system settings and device registrations without the large log store. Including logs creates a much larger file, and logs-only or reports-only backups do not preserve configuration.

Question 18Deployment and System Configuration

Which FortiAnalyzer interface is used by default for initial GUI access after the unit is powered on and connected to a management network?

  1. The console port only
  2. port1 with the default management IP Correct answer.
  3. port2 configured as a DHCP client
  4. The FortiGate's internal interface

Explanation

FortiAnalyzer uses port1 with a default management IP for initial GUI access. Console access is available but the GUI is reached through port1. FortiGate interfaces are unrelated to FortiAnalyzer management.

Question 19Deployment and System Configuration

An administrator needs to forward logs from FortiAnalyzer to an external SIEM using syslog. Which configuration is required?

  1. Configure a report schedule with PDF output
  2. Create an event handler with an email action
  3. Configure a syslog server under log forwarding settings Correct answer.
  4. Enable FortiView aggregation

Explanation

Forwarding logs to an external SIEM requires configuring a syslog server in the log forwarding settings. FortiView aggregation, event handlers, and report schedules serve different purposes and do not export raw logs to syslog.

Question 20Deployment and System Configuration

Which statement best describes the role of an administrative domain (ADOM) in FortiAnalyzer?

  1. It defines the RAID level used for log storage
  2. It controls the firmware version of managed FortiGates
  3. It isolates devices, logs, and administrators into separate management partitions Correct answer.
  4. It sets the retention period for archived reports

Explanation

ADOMs partition the FortiAnalyzer management space so that devices, logs, and administrators in one domain are isolated from another. RAID levels, firmware management, and report retention are handled by other settings.

Question 21Deployment and System Configuration

An administrator observes that logs from a newly registered FortiGate are not appearing in Log View. Which troubleshooting step is most appropriate first?

  1. Reinstall the FortiAnalyzer firmware
  2. Rebuild the RAID array
  3. Verify the FortiGate is sending logs to the FortiAnalyzer IP and that log reception is enabled Correct answer.
  4. Delete and recreate all ADOMs

Explanation

The most likely cause is that the device is not sending logs or the analyzer is not accepting them, so verifying the FortiGate log destination and log reception status is the first step. RAID rebuilds, firmware reinstallation, and ADOM recreation are disruptive and unrelated to log delivery.

Question 22Deployment and System Configuration

Which FortiAnalyzer setting determines the maximum disk usage percentage before old logs are purged?

  1. FortiGate log buffer size
  2. Log storage quota and retention thresholds Correct answer.
  3. NTP synchronization interval
  4. Administrator session timeout

Explanation

FortiAnalyzer monitors disk usage and applies storage quotas and retention thresholds to purge old logs when usage approaches the limit. NTP, session timeout, and FortiGate buffer size do not control analyzer disk usage.

Question 23Deployment and System Configuration

What is required for FortiAnalyzer HA to function correctly between two nodes?

  1. The primary must be in Collector mode
  2. The secondary node must have more disk space than the primary
  3. The nodes must be in different ADOMs
  4. Both nodes must run the same firmware version and have matching HA configuration Correct answer.

Explanation

HA requires both nodes to run the same firmware and share matching HA settings so that synchronization and failover work. Disk size differences, collector mode, and ADOM placement are not requirements for HA operation.

Question 24Deployment and System Configuration

An administrator wants to automate the creation of a ticket when a specific log event occurs on FortiAnalyzer. Which feature should be used?

  1. Event handlers Correct answer.
  2. FortiView playbooks
  3. Report schedules
  4. Log forwarding profiles

Explanation

Event handlers monitor logs for defined conditions and trigger actions such as sending alerts or creating tickets. Report schedules generate documents, FortiView is for visualization, and forwarding profiles export logs.

Question 25Deployment and System Configuration

Which FortiAnalyzer CLI command displays the current firmware version and build number?

  1. get system status Correct answer.
  2. show full-configuration
  3. execute log filter
  4. diagnose sys top

Explanation

The get system status command reports the firmware version, build number, and serial number. The other commands display process activity, log filters, or the full configuration, not the firmware version.

Question 26Deployment and System Configuration

A FortiAnalyzer appliance is being prepared for production and the administrator must confirm which factory-default IPv4 address the management interface uses before connecting a laptop directly. What is that default address?

  1. 192.168.1.99 Correct answer.
  2. 172.16.0.1
  3. 192.168.100.100
  4. 10.0.0.1

Explanation

FortiAnalyzer units ship with the management port preconfigured at 192.168.1.99/24, so an administrator can reach the GUI by placing a laptop in the same subnet. The other addresses are common conventions on other platforms but are not the FortiAnalyzer factory default.

Question 27Deployment and System Configuration

Which deployment mode on FortiAnalyzer lets the unit receive logs from FortiGate devices and store them locally while also providing reports, dashboards, and event handling?

  1. Sniffer mode
  2. Analyzer mode Correct answer.
  3. Forwarder mode
  4. Collector mode

Explanation

Analyzer mode is the full-function operating mode in which FortiAnalyzer stores logs locally and provides reporting, dashboards, and event management. Collector mode only receives and stores logs, while Forwarder mode relays logs to another collector or syslog server.

Question 28Deployment and System Configuration

An administrator wants to divide a single FortiAnalyzer into independent virtual instances, each with its own administrators, devices, and log storage, without deploying separate hardware. Which feature provides this?

  1. Administrative domains (ADOMs)
  2. Multi-tenancy via FortiAnalyzer Fabric Correct answer.
  3. Virtual domains (VDOMs)
  4. High availability clustering

Explanation

FortiAnalyzer multi-tenancy creates isolated virtual instances, each behaving like a separate FortiAnalyzer with its own configuration and storage. ADOMs partition logs and devices within one instance but do not provide fully isolated virtual appliances.

Question 29Deployment and System Configuration

Which FortiAnalyzer configuration object must be created or confirmed before a FortiGate can register with the unit and begin forwarding logs?

  1. An LDAP server object for device authentication
  2. A device entry authorized by serial number or pre-shared key Correct answer.
  3. A report schedule bound to the FortiGate
  4. A syslog server entry pointing at the FortiGate

Explanation

FortiAnalyzer identifies managed devices by serial number, and registration is authorized either automatically or by adding the device and confirming its serial number or pre-shared key. Syslog, LDAP, and report objects are unrelated to the registration handshake.

Question 30Deployment and System Configuration

An administrator needs FortiAnalyzer to send an email notification whenever a high-severity event is detected. Which configuration is required to make this work?

  1. A syslog server object plus a log filter
  2. A report schedule with PDF output
  3. An SNMP community plus a trap destination
  4. A mail server setting plus an event handler with an email notification action Correct answer.

Explanation

Event handlers evaluate incoming logs against filters and trigger actions, and email actions require a configured mail server under the system settings. Syslog, SNMP, and report schedules deliver different kinds of output and do not send event-driven email alerts.

Question 31Deployment and System Configuration

Which FortiAnalyzer administrative access protocol should be disabled on a hardened deployment because it transmits credentials in cleartext?

  1. FortiAnalyzer Fabric over TLS
  2. SSH
  3. HTTP Correct answer.
  4. HTTPS

Explanation

Plain HTTP sends administrator credentials and session data unencrypted, so hardening guidance is to disable it and rely on HTTPS. SSH and HTTPS are encrypted, and Fabric traffic is protected by TLS.

Question 32Deployment and System Configuration

An administrator must add a second FortiAnalyzer node so that log data remains available if the primary fails. Which requirement applies to the two nodes?

  1. They must share the same management IP address
  2. They must use different operation modes
  3. They must run the same firmware build and have comparable disk capacity Correct answer.
  4. They must be in different ADOMs

Explanation

FortiAnalyzer HA requires matching firmware and adequate, comparable storage on both nodes so log data can be synchronized and failed-over cleanly. Each node keeps its own management address, and HA is independent of ADOM layout.

Question 33Deployment and System Configuration

In a FortiAnalyzer HA cluster, which node accepts log connections from FortiGate devices at any given time?

  1. The node with the lowest serial number
  2. Whichever node has the most free disk space
  3. Every node simultaneously
  4. The primary node only Correct answer.

Explanation

Only the primary node in a FortiAnalyzer HA cluster receives and processes logs; the secondary stays synchronized and takes over if the primary fails. Devices are not load-balanced across all nodes.

Question 34Deployment and System Configuration

Which interface type on FortiAnalyzer is intended for management traffic such as GUI, SSH, and FortiGuard communication, and is separated from log-receiving interfaces?

  1. A fabric interface
  2. A log interface
  3. A management interface Correct answer.
  4. A heartbeat interface

Explanation

FortiAnalyzer separates management traffic onto a dedicated management interface so administrative access is not affected by heavy log ingestion. Log interfaces carry device log traffic, and heartbeat interfaces are used for HA synchronization.

Question 35Deployment and System Configuration

An administrator wants FortiAnalyzer to authenticate GUI users against the corporate directory and assign them different read/write privileges. Which two elements must be configured?

  1. A local admin account and a report schedule
  2. An SNMP community and a trap receiver
  3. A remote authentication server and admin profiles mapped to groups Correct answer.
  4. A syslog server and a log filter

Explanation

Directory-based administrator logins require a remote authentication server object plus admin group mappings that bind directory groups to admin profiles. The profile determines what each authenticated user can view or change.

Question 36Deployment and System Configuration

An administrator wants to receive a daily summary email of FortiAnalyzer health and log statistics. Which configuration delivers this?

  1. An SNMP trap destination
  2. A scheduled report with email delivery Correct answer.
  3. An event handler with a syslog action
  4. A log forwarding filter

Explanation

Scheduled reports can be generated on a timetable and emailed to recipients, making them suitable for periodic summaries. Event handlers, SNMP traps, and log forwarding are event- or log-driven and do not produce scheduled summary documents.

Question 37Deployment and System Configuration

Which FortiAnalyzer command-line action resets the administrative password when the admin account is locked out?

  1. Running the password reset option from the console during boot Correct answer.
  2. Deleting the ADOM from the CLI
  3. Restarting the unit with the reset button held
  4. Re-registering the device from FortiGate

Explanation

When administrator access is lost, FortiAnalyzer provides a console-based password reset procedure during the boot sequence. Deleting ADOMs, holding a reset button, or re-registering devices does not restore administrator credentials.

Question 38Deployment and System Configuration

Which CLI command displays the current firmware version and build number on FortiAnalyzer?

  1. get system status Correct answer.
  2. show log settings
  3. get system interface
  4. diagnose debug application

Explanation

The 'get system status' command reports firmware version, build number, and related platform details. The other commands display log settings, debug output, or interface configuration instead.

Question 39Deployment and System Configuration

An administrator wants to allocate separate log storage quotas to different departments using administrative domains. Which configuration enforces the per-ADOM disk limit?

  1. Setting the ADOM disk quota Correct answer.
  2. Setting the global retention policy
  3. Enabling log indexing
  4. Configuring a syslog server

Explanation

Each ADOM can be assigned a disk quota that caps how much storage its logs may consume, preventing one department from filling the volume. Global retention, indexing, and syslog settings do not enforce per-ADOM storage limits.

Question 40Deployment and System Configuration

An administrator must ensure FortiAnalyzer can resolve device hostnames when generating reports. Which configuration item is relevant?

  1. The DNS server settings under system network configuration Correct answer.
  2. The admin profile
  3. The syslog server object
  4. The ADOM quota

Explanation

Hostname resolution depends on the DNS servers configured in the system network settings, so reports that display device names rely on correct DNS configuration. Syslog objects, admin profiles, and ADOM quotas do not affect name resolution.

Question 41Deployment and System Configuration

Which FortiAnalyzer interface is used by default for initial GUI access after the unit is powered on and connected to a network?

  1. The log interface
  2. The fabric interface
  3. The management interface Correct answer.
  4. The heartbeat interface

Explanation

The management interface is preconfigured with the factory IP address so an administrator can reach the GUI on first boot. Log, fabric, and heartbeat interfaces serve log ingestion, Fabric peering, and HA traffic respectively.

Question 42Deployment and System Configuration

An administrator must restrict GUI and API access to FortiAnalyzer so that only the management subnet 10.10.10.0/24 can connect. Which configuration accomplishes this?

  1. A report schedule bound to the management subnet
  2. A trusted host entry on the administrator account limited to 10.10.10.0/24 Correct answer.
  3. A syslog filter matching 10.10.10.0/24
  4. An ADOM quota of 24 for the management domain

Explanation

Trusted hosts on an administrator account restrict where that account may log in from, so setting 10.10.10.0/24 limits GUI and API access to the management subnet. ADOM quotas, syslog filters, and report schedules do not control source-address access.

Question 43Deployment and System Configuration

A FortiAnalyzer administrator needs to store logs on a remote Linux server that exposes an NFS export, so that log volume is not limited by the appliance's internal disks. Which configuration is required on FortiAnalyzer to use that export as a log storage location?

  1. Register the Linux server as a fabric device so it can receive log forwarding.
  2. Define a remote log server of type NFS under the log storage settings and provide the server address and export path. Correct answer.
  3. Create an SMB/CIFS share entry and supply domain credentials for the Linux server.
  4. Enable RAID on the appliance and point the log repository to the NFS mount.

Explanation

FortiAnalyzer supports remote log storage over NFS, configured through the log storage settings where the administrator specifies the remote server address and the exported path. The NFS mount is then used as the log repository instead of local disk. SMB/CIFS is a separate supported protocol aimed at Windows file servers, not the typical Linux export scenario.

Question 44Deployment and System Configuration

Which FortiAnalyzer setting determines how long archived logs are retained before the oldest data is purged from the log repository?

  1. The log retention period configured in the log settings, expressed in days. Correct answer.
  2. The administrative timeout configured under the admin profile.
  3. The report schedule interval defined in the report settings.
  4. The session timeout configured on the management interface.

Explanation

Log retention on FortiAnalyzer is governed by a retention period specified in days within the log settings; when the period elapses, the oldest logs are removed automatically. This value directly controls how far back analysts can search and report. Admin timeouts, report schedules, and interface session timeouts control access or reporting cadence, not data lifecycle.

Question 45Deployment and System Configuration

An administrator is planning a FortiAnalyzer deployment in which the unit must forward logs to a syslog server while also storing them locally for reports. Which statement describes the correct configuration approach?

  1. Enable HA between the FortiAnalyzer and the syslog server so both receive identical logs.
  2. Configure a log forwarding destination and keep local storage enabled, since forwarding and local storage are independent settings. Correct answer.
  3. Convert the unit to analyzer-only mode, which is the only mode that supports syslog forwarding.
  4. Disable local log storage first, because FortiAnalyzer cannot forward and store the same log simultaneously.

Explanation

FortiAnalyzer can store logs locally and simultaneously forward them to external destinations such as a syslog server; these are separate configuration settings that do not exclude each other. The administrator simply defines the forwarding target and leaves local storage active for reporting and archival. HA is a redundancy mechanism between FortiAnalyzer nodes, not a log-forwarding method.

Question 46Deployment and System Configuration

Which FortiAnalyzer feature allows an administrator to define a reusable set of device connection parameters so that many FortiGate units can be added consistently without entering details one by one?

  1. Device group templates used when adding devices in bulk. Correct answer.
  2. Log forwarding filters applied to incoming logs.
  3. FortiGuard subscription profiles assigned to devices.
  4. Administrative domains applied to the device list.

Explanation

FortiAnalyzer supports grouping devices and using templates so that connection parameters can be applied consistently across many units, simplifying bulk onboarding. This reduces manual entry and keeps device definitions uniform. Administrative domains partition visibility and data access rather than defining connection parameters.

Question 47Deployment and System Configuration

After importing a new FortiAnalyzer firmware image, an administrator must confirm the unit will boot the new image. Which action completes the upgrade process?

  1. Reapply the log retention period from the previous configuration.
  2. Reboot the unit so the newly selected firmware becomes active. Correct answer.
  3. Recreate the administrative domains that existed before the upgrade.
  4. Re-register all managed devices with the unit.

Explanation

Selecting or importing a firmware image on FortiAnalyzer does not activate it immediately; the unit must be rebooted so the new image is loaded at startup. Configuration such as device registrations, administrative domains, and retention settings is preserved across a standard upgrade. Re-registering devices or rebuilding domains is therefore unnecessary.

Question 48Deployment and System Configuration

An administrator wants FortiAnalyzer to synchronize its clock with an internal time source so that log timestamps and report periods align across all managed devices. Which configuration should be applied?

  1. Configure NTP server entries and enable NTP synchronization on the unit. Correct answer.
  2. Enable FortiGuard DDNS so the unit resolves the time source name.
  3. Configure the syslog forwarding destination to supply timestamps.
  4. Set the device time zone to GMT and rely on manual clock entry.

Explanation

Accurate time on FortiAnalyzer depends on configuring NTP servers and enabling synchronization, which keeps log timestamps consistent with the rest of the security fabric. Manual clock entry drifts and cannot keep large log sets aligned. DDNS and syslog forwarding do not provide time synchronization.

Question 49Deployment and System Configuration

An administrator must verify that FortiAnalyzer is receiving logs from a newly registered FortiGate before building reports. Which approach most directly confirms log reception from that device?

  1. Inspect the FortiGuard license status page for the device serial number.
  2. Open the HA status page to confirm the device appears as a cluster member.
  3. Review the admin audit log for the registration event only.
  4. Check the device log statistics or log viewer for entries attributed to that device. Correct answer.

Explanation

Log reception is confirmed by examining log statistics or the log viewer filtered to the specific device, which shows whether entries are arriving and being indexed. The audit log records administrative actions rather than data-plane log flow. License and HA pages describe unrelated states.

Question 50Deployment and System Configuration

An administrator wants to limit how much disk space each administrative domain can consume for stored logs. Which FortiAnalyzer capability should be used?

  1. Enable log compression on the management interface.
  2. Create a separate administrative profile for each department.
  3. Set a global retention period that applies to every administrative domain equally.
  4. Assign a per-ADOM disk quota when the administrative domain is defined. Correct answer.

Explanation

FortiAnalyzer allows disk quotas to be assigned per administrative domain, so each domain is limited to a defined share of storage. This prevents one domain from consuming the entire log repository. A global retention period applies uniformly and does not allocate space per domain, and admin profiles control permissions rather than storage.