NSE4 High Availability and Diagnostics Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure a syslog server under Log Setting

  Why it's wrong here

  Syslog is a generic, unstructured logging protocol that lacks the advanced indexing, compression, and analytics capabilities of FortiAnalyzer's native protocol (FAS). While FortiAnalyzer can ingest syslog messages, the FortiGate's syslog configuration under Log Setting is intended for third-party syslog servers, not for establishing the authenticated, managed FortiAnalyzer connection. To forward logs to FortiAnalyzer, you must configure the FortiAnalyzer under System > FortiAnalyzer, which enables bi-directional communication, proper log format, and reporting; a syslog server entry will not register the FortiGate for FortiAnalyzer management or reporting.

• ✗

  Add a firewall policy allowing traffic from FortiGate to FortiAnalyzer

  Why it's wrong here

  A firewall policy merely permits traffic between the FortiGate and FortiAnalyzer IP addresses over the required ports (e.g., TCP/514); it does not instruct the FortiGate to generate or forward any logs. Even if the policy allows connectivity, the FortiGate has no awareness of the FortiAnalyzer as a log collector unless you explicitly configure it via System > FortiAnalyzer or the 'config log fortianalyzer setting' CLI command. Additionally, FortiAnalyzer requires an authenticated registration (serial number or access token) before it will accept logs, so a security policy alone cannot enable log forwarding.

• ✓

  Configure the FortiAnalyzer in System > FortiAnalyzer

  Why this is correct

  This is the correct method because it establishes the native, authenticated FortiAnalyzer connection. Under System > FortiAnalyzer, you specify the FortiAnalyzer IP address, set an access token or serial number, and enable logging; this configures the FortiGate to use FortiAnalyzer's proprietary logging protocol (FAS) with features like log buffering, encryption, and compression. The CLI equivalent, 'config log fortianalyzer setting', offers the same options and is often used in automated deployments. Once configured, the FortiGate begins forwarding all configured log types to FortiAnalyzer for centralized logging, analytics, and reporting.

• ✗

  Enable logging to FortiCloud instead

  Why it's wrong here

  FortiCloud is a cloud-based service for FortiGate logging and management, but it is a distinct destination from FortiAnalyzer. The question specifically asks to forward logs to a FortiAnalyzer, so configuring FortiCloud logging would send logs to a different platform, not to the intended FortiAnalyzer. Additionally, FortiAnalyzer can be an on-premises appliance or a VM, with its own licensing and storage, whereas FortiCloud uses a different subscription model. Using FortiCloud would not satisfy the requirement, and the FortiGate would not be managed by or report to the FortiAnalyzer.

Go deeper

Related to this question

Same concept, more angles

1 more way this is tested on NSE4

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.