How to Send Logs from All VDOMs to FortiAnalyzer
A FortiGate is deployed in multi-VDOM mode. The administrator wants to use FortiAnalyzer to centralize logging from all VDOMs. Which THREE steps must be performed? (Choose three.)
Quick Answer
The answer is to configure FortiAnalyzer settings in each VDOM to point to the FortiAnalyzer IP, as this ensures that every virtual domain independently establishes its logging channel to the central collector. This is required because in multi-VDOM mode, each VDOM operates as a separate logical firewall with its own logging configuration, and FortiAnalyzer must receive logs from each VDOM individually rather than through a single global setting. On the Fortinet NSE 7 Advanced Security NSE7 exam, this question tests your understanding of how multi-VDOM architectures impact centralized logging, often trapping candidates who assume a single global FortiAnalyzer configuration applies across all VDOMs. A common mistake is forgetting that the management VDOM handles all FortiAnalyzer communication, so the FortiAnalyzer must be reachable to the management VDOM’s IP for the connection to succeed. Memory tip: think of each VDOM as a separate tenant that needs its own “mailing address” to the FortiAnalyzer—configure per VDOM, not globally.
⚠ Common exam trap
Many exam-takers assume a single global setting like 'log-all-vdoms' exists, when in reality FortiOS requires per-VDOM configuration or the use of the 'central-log' feature to aggregate logs from all VDOMs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the FortiAnalyzer can reach the FortiGate's management IP
The FortiAnalyzer must be able to reach the FortiGate's management IP to establish the logging connection. In multi-VDOM mode, the management VDOM handles all management traffic, including FortiAnalyzer communication, so reachability to that specific IP is essential for centralized logging.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable log forwarding on the management VDOM only
Why it's wrong here
Each VDOM must be configured individually.
- ✓
Ensure that the FortiAnalyzer can reach the FortiGate's management IP
Why this is correct
Correct.
- ✓
Add the FortiGate as a device in FortiAnalyzer
Why this is correct
Correct.
- ✓
Configure FortiAnalyzer settings in each VDOM to point to the FortiAnalyzer IP
Why this is correct
Correct.
- ✗
Enable 'log-all-vdoms' feature on the FortiGate
Why it's wrong here
No such feature exists.
Go deeper
Related to this question
About these practice questions
One of 940 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator is troubleshooting why a FortiAnalyzer report is not showing expected data. Which TWO potential causes should the administrator investigate?
easy- ✓ A.The log data is in a different datastore than the one configured for the report
- B.The report schedule is not set
- C.The FortiAnalyzer is in a different ADOM
- ✓ D.The FortiGate is not configured to send logs to FortiAnalyzer
- E.The FortiAnalyzer license has expired
Why A: FortiAnalyzer organizes logs into datastores based on device groups or ADOMs. If the report is configured to query a datastore that does not contain the relevant logs, the report will not display the expected data, even if the logs exist elsewhere on the same FortiAnalyzer.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.