You are configuring a new ADOM for a department that requires strict data segregation. Which setting must be enabled to ensure that log data from different device groups within this ADOM cannot be accessed by other administrators?
Trap 1: Enable ADOM-level disk quotas
Disk quotas cap how much log storage each ADOM consumes; they govern capacity, not administrator visibility across device groups. It tempts because quotas appear in the same ADOM settings, and would be correct when limiting storage per ADOM, but segregation of log access requires the ADOM in advanced mode with per-device-group administrative domains.
Trap 2: Use individual management VDOMs for every device
Management VDOMs separate device administration, not FortiAnalyzer log visibility, which is governed by ADOM mode and administrator scope. It tempts because VDOMs genuinely isolate traffic on FortiGate, and would be correct for multi-tenant firewall segmentation, but the question concerns log data segregation within one ADOM.
Trap 3: Enable log encryption per device
Encrypting logs protects data at rest or in transit; it does not restrict which administrators can query device-group logs. It tempts because encryption sounds like a segregation control, and would be correct where regulatory confidentiality of stored logs is required, but access separation depends on ADOM mode and administrator permissions.
- A
Enable ADOM-level disk quotas
Why it fails: Disk quotas cap how much log storage each ADOM consumes; they govern capacity, not administrator visibility across device groups. It tempts because quotas appear in the same ADOM settings, and would be correct when limiting storage per ADOM, but segregation of log access requires the ADOM in advanced mode with per-device-group administrative domains.
- B
Use individual management VDOMs for every device
Why it fails: Management VDOMs separate device administration, not FortiAnalyzer log visibility, which is governed by ADOM mode and administrator scope. It tempts because VDOMs genuinely isolate traffic on FortiGate, and would be correct for multi-tenant firewall segmentation, but the question concerns log data segregation within one ADOM.
- C
Enable log encryption per device
Why it fails: Encrypting logs protects data at rest or in transit; it does not restrict which administrators can query device-group logs. It tempts because encryption sounds like a segregation control, and would be correct where regulatory confidentiality of stored logs is required, but access separation depends on ADOM mode and administrator permissions.
- D
Assign device-based administrative profiles
Device-based administrative profiles restrict administrator access according to the devices or device groups an administrator manages, enforcing the segregation the department demands. Within the new ADOM, this scoping prevents other administrators from reaching log data belonging to device groups outside their assigned devices, satisfying the strict data-segregation constraint.