NSE4 System and Network Administration Practice Question
An administrator needs to configure a FortiGate to send logs to a FortiAnalyzer. Which two configurations are required? (Choose two.)
⚠ Common exam trap
The trap here is that candidates mistakenly think a firewall policy is required to allow log traffic out, but FortiGate's log transmission to FortiAnalyzer uses the management VDOM and bypasses regular firewall policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure FortiAnalyzer IP under config system central-management
The FortiGate must be configured to know the FortiAnalyzer's IP address under `config system central-management` to establish the logging connection. Option B is correct because the `set log-fortianalyzer enable` command under `config log setting` activates the log transmission to the configured FortiAnalyzer. Without both, the FortiGate will not send logs to the FortiAnalyzer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure FortiAnalyzer IP under config system central-management
Why this is correct
The FortiAnalyzer IP address is specified under config system central-management, in the fortianalyzer sub-table. This is the mandatory server address that the FortiGate uses to register and connect to the FortiAnalyzer unit. Without this IP, the FortiGate cannot establish the log upload session, even if log settings are enabled.
- ✓
Set log-fortianalyzer to enable under config log setting
Why this is correct
After setting the FortiAnalyzer IP, the administrator must enable the log-fortianalyzer option under config log setting. This global toggle tells the FortiGate's log daemon to include FortiAnalyzer as a log destination. Until this is set to enable, the FortiGate will not forward any logs to the configured analyzer.
- ✗
Enable log transfer under config log fortianalyzer setting
Why it's wrong here
The 'log-transfer' option under config log fortianalyzer setting controls whether logs are uploaded to the configured FortiAnalyzer at all. In FortiOS this setting is already enabled by default after you specify a FortiAnalyzer IP, so explicitly enabling it is unnecessary. If you were to disable it, logs would remain in local storage only, defeating the purpose of sending logs.
- ✗
Configure a firewall policy to allow logs to leave
Why it's wrong here
A firewall policy is not required for logs to leave the FortiGate because FortiGate-generated traffic, including syslog to FortiAnalyzer, is sourced by the device itself and is not subject to policy lookup. Firewall policies only govern traffic that traverses the FortiGate from one interface to another. As long as the FortiGate has a valid route to the FortiAnalyzer, the logs will be sent without an explicit allow policy.
- ✗
Create a log filter to send all logs
Why it's wrong here
A log filter is used to selectively reduce the amount of log data sent to FortiAnalyzer, not to enable log transfer. By default, the FortiGate sends all logs (including traffic, event, and security logs) to the configured FortiAnalyzer, so there is no need to create a filter to 'send all logs.' Adding such a filter would be redundant and could inadvertently exclude categories if misconfigured.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.