NSE4 High Availability and Diagnostics Practice Question
An organization wants to send FortiGate logs to a central log management system for long-term storage and compliance. Which FortiGate feature is specifically designed for collecting and analyzing logs from multiple FortiGate devices?
⚠ Common exam trap
NSE4 often tests the distinction between local logging (disk logging) and centralized logging (FortiAnalyzer), and candidates may confuse FortiCloud with FortiAnalyzer because both offer cloud-based log storage; however, FortiAnalyzer is the dedicated on-prem or virtual appliance for multi-device log collection and analysis.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
FortiAnalyzer
FortiAnalyzer is Fortinet's dedicated centralized logging, analysis, and reporting appliance (physical or virtual) designed to collect logs from multiple FortiGate devices, FortiSwitches, FortiAPs, and other Fortinet products. It provides long-term storage, compliance reporting, and advanced analytics such as event correlation and security fabric rating. Unlike local disk logging, FortiAnalyzer aggregates logs from many devices into a single repository, making it the correct choice for centralized log management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Disk logging
Why it's wrong here
Disk logging writes logs to the FortiGate's own local hard drive or flash storage, so the data never leaves the device. This makes it useful for standalone troubleshooting with limited retention, but it provides no central aggregation, search, or correlation across multiple gateways. The organization's requirement is a single central repository, so disk logging is inherently insufficient.
- ✗
FortiGuard
Why it's wrong here
FortiGuard is a threat intelligence service that supplies real-time updates for FortiGate features like IPS signatures, anti-malware, web filtering, and botnet IP blocking. It is a security subscription feed, not a log collection or storage platform, and it does not receive or parse syslog messages. Thus, it cannot serve as the destination for centralized FortiGate logs.
- ✗
FortiCloud
Why it's wrong here
FortiCloud is a cloud-based management and logging service that also offers Security Fabric dashboards, but its logging capabilities are primarily tied to cloud-managed FortiGate deployments and limited by subscription tier. It is not designed as a dedicated on-premises central log collector for enterprise deployments, lacking the deep forensic search, long-term storage, and reporting of a purpose-built analyzer. Therefore, while it has some logging, it does not match the specific role of a central log collector for an on-premises FortiGate environment.
- ✓
FortiAnalyzer
Why this is correct
FortiAnalyzer is Fortinet's dedicated log management and analysis appliance, purpose-built to aggregate logs from FortiGate and other Fortinet devices to a central location. It provides high-capacity storage, real-time search, reporting, and event correlation, making it the standard for enterprise centralized logging. Configuring FortiGate to send logs to FortiAnalyzer via the FortiGate's log settings or Security Fabric fully meets the organization's central log collection need.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.