Fortinet Certified Professional - FortiAnalyzer 7.4 Administrator Free Sample Questions

RAID 10 (a stripe of mirrors) provides the best write performance among the redundant RAID levels because it does not require parity calculations for writes. It also offers redundancy for a single disk failure within each mirrored pair. RAID 5 has a write penalty due to parity calculations. RAID 6 has an even higher write penalty. RAID 1 offers redundancy but not the performance benefits of striping found in RAID 10.

The diagnose test application oftps 1 command specifically tests the connection and log upload status to the FortiAnalyzer. It provides detailed output about the OFTPS (Over Fortinet Transfer Protocol Secure) connection state, including connection status, encryption settings, and log upload statistics, which is ideal for this troubleshooting scenario. Other commands are less specific to the FortiAnalyzer logging process.

Standard report charts have limited filtering capabilities. To achieve complex filtering, such as by specific LDAP user groups, the correct method is to first create a custom dataset. This involves writing a SQL query that selects the required log data and uses a WHERE clause to filter on the usergroup field. Once this dataset is created and tested, it can be used as the source for a custom chart within a new report.

When using a wildcard RADIUS administrator, FortiAnalyzer can dynamically assign ADOM access based on vendor-specific attributes (VSAs) returned by the RADIUS server during authentication. By configuring the RADIUS server to send the Fortinet-ADOM-Name VSA containing the specific ADOM(s) an engineer is authorized to access, the MSP can enforce granular, per-user ADOM restrictions without creating multiple accounts on the FortiAnalyzer itself.

A key distinction is how VDOMs are handled. In Normal mode, the FortiGate device is the unit of assignment, so all of its VDOMs must belong to one ADOM. Advanced mode provides more flexibility, allowing an administrator to assign individual VDOMs from a single physical FortiGate to multiple different ADOMs, which is essential for complex multi-tenant environments.

An ADOM's disk quota can be both increased and decreased after it has been set. This can be done through the GUI or CLI, provided there is available disk space. However, you cannot decrease the quota to a value less than the current amount of data stored in that ADOM.

When a FortiAnalyzer configuration backup is encrypted, the password used for that encryption is mandatory for the restore process. Without the correct password, the FortiAnalyzer cannot decrypt the file and the restore operation will fail.

HA preemption is the feature that allows a device with a higher priority (the original primary) to automatically take over the primary role when it becomes available. By disabling preemption, the original primary unit will remain in a passive state after it reboots, allowing the current primary (the original secondary) to continue its role without interruption. This prevents the unwanted second failover.

FortiAnalyzer maintains a specific SQL database schema for each FortiOS major version within an ADOM. If logs from a device with a different major FortiOS version (e.g., FortiOS 7.2 logs being sent to an ADOM configured for 7.4) are received, FortiAnalyzer will trigger a database rebuild to accommodate the different log format. This is a resource-intensive process and a common cause of performance issues.

Log forwarding allows FortiAnalyzer to act as a central aggregator and then forward received logs to other systems. This is commonly used to integrate with a central corporate SIEM (like Splunk or QRadar) or to create a tiered logging architecture with multiple FortiAnalyzers (e.g., regional collectors forwarding to a central analyzer).