Configure Log Settings and Diagnose Problems Using the Logs NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An administrator is investigating a security incident. The FortiGate's traffic logs show that a specific user's traffic was allowed, but the user claims they were blocked. The administrator suspects that the traffic was actually blocked by an application control profile. Which log field would confirm this?

   • AThe 'Application' field in the traffic log, which would show the application name that was blocked.
   • BThe 'Action' field in the traffic log, which would show 'deny' if the application control profile blocked the traffic.
   • CThe 'Source IP' field in the traffic log, which would show the user's IP address.
   • DThe 'Policy ID' field in the traffic log, which would show which policy allowed the traffic.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which FortiOS component is responsible for receiving log messages from various modules and processes before they are stored or forwarded?

   • AThe FortiAnalyzer device
   • BThe firewall kernel
   • CThe CLI shell
   • DThe log daemon (logd)
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In FortiOS, what is the correct sequence of steps in the log workflow after a log message is generated by a process?

   • ALog message is sent to the log daemon, which applies filters and formatting, then delivers it to configured storage and forwarding destinations.
   • BLog message is stored in a temporary buffer, and the administrator must manually flush it to the configured log destinations.
   • CLog message is written directly to the local disk, then forwarded to any configured remote destinations.
   • DLog message is immediately forwarded to FortiAnalyzer, which then decides whether to store it locally on the FortiGate.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A small business with a single FortiGate wants to store logs for 90 days for a compliance audit. They have no additional servers and a limited budget. The FortiGate has a 128 GB disk, and the expected log volume is about 1 GB per day. Which log storage option is the most appropriate?

   • AEnable log compression on the FortiGate and store logs locally with a 30-day retention policy.
   • BStore logs locally on the FortiGate's disk with a 90-day retention policy.
   • CConfigure the FortiGate to send logs to a free public syslog service on the internet.
   • DPurchase a FortiAnalyzer virtual appliance and configure the FortiGate to send logs to it.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   A FortiGate administrator wants to send logs to an existing third-party SIEM system. Which log storage option should be configured on the FortiGate?

   • AFortiAnalyzer
   • BLocal disk
   • CLocal memory
   • DSyslog
   Reveal Solution Discussion Select an answer first