Refer to Exhibit: You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology. Which potential problem do you observe?
Correct Answer: B
Understanding FortiAnalyzer Data Policy and Disk Utilization: FortiAnalyzer uses data policies to manage log storage, retention, and disk utilization. The Data Policy section indicates how long logs are kept for analytics and archive purposes. The Disk Utilization section specifies the allocated disk space and the proportions used for analytics and archive, as well as when alerts should be triggered based on disk usage. Analyzing the Provided Exhibit: Keep Logs for Analytics: 60 Days Keep Logs for Archive: 120 Days Disk Allocation: 300 GB (with a maximum of 441 GB available) Analytics: Archive Ratio: 30% : 70% Alert and Delete When Usage Reaches: 90% Potential Problems Identification: Disk Space Allocation: The allocated disk space is 300 GB out of a possible 441 GB, which might not be insufficient if the log volume is high, but it is not the primary concern based on the given data. Analytics-to-Archive Ratio: The ratio of 30% for analytics and 70% for archive is unconventional. Typically, a higher percentage is allocated for analytics since real-time or recent data analysis is often prioritized. A common configuration might be a 70% analytics and 30% archive ratio. The misconfigured ratio can lead to insufficient space for analytics, causing issues with real-time monitoring and analysis. Retention Periods: While the retention periods could be seen as lengthy, they are not necessarily indicative of a problem without knowing the specific log volume and compliance requirements. The length of these periods can vary based on organizational needs and legal requirements. Conclusion: Based on the analysis, the primary issue observed is the analytics-to-archive ratio being misconfigured. This misconfiguration can significantly impact the effectiveness of the FortiAnalyzer in real-time log analysis, potentially leading to delayed threat detection and response. Reference: Fortinet Documentation on FortiAnalyzer Data Policies and Disk Management. Best Practices for FortiAnalyzer Log Management and Disk Utilization.
Question 17
Your company is doing a security audit To pass the audit, you must take an inventory of all software and applications running on all Windows devices Which FortiAnalyzer connector must you use?
Correct Answer: A
* Requirement Analysis: * The objective is to inventory all software and applications running on all Windows devices within the organization. * This inventory must be comprehensive and accurate to pass the security audit. * Key Components: * FortiClient EMS (Endpoint Management Server): * FortiClient EMS provides centralized management of endpoint security, including software and application inventory on Windows devices. * It allows administrators to monitor, manage, and report on all endpoints protected by FortiClient. * Connector Options: * FortiClient EMS: * Best suited for managing and reporting on endpoint software and applications. * Provides detailed inventory reports for all managed endpoints. * Selected as it directly addresses the requirement of taking inventory of software and applications on Windows devices. * ServiceNow: * Primarily a service management platform. * While it can be used for asset management, it is not specifically tailored for endpoint software inventory. * Not selected as it does not provide direct endpoint inventory management. * FortiCASB: * Focuses on cloud access security and monitoring SaaS applications. * Not applicable for managing or inventorying endpoint software. * Not selected as it is not related to endpoint software inventory. * Local Host: * Refers to handling events and logs within FortiAnalyzer itself. * Not specific enough for detailed endpoint software inventory. * Not selected as it does not provide the required endpoint inventory capabilities. * Implementation Steps: * Step 1: Ensure all Windows devices are managed by FortiClient and connected to FortiClient EMS. * Step 2: Use FortiClient EMS to collect and report on the software and applications installed on these devices. * Step 3: Generate inventory reports from FortiClient EMS to meet the audit requirements. References: * Fortinet Documentation on FortiClient EMS FortiClient EMS Administration Guide By using the FortiClient EMS connector, you can effectively inventory all software and applications on Windows devices, ensuring compliance with the security audit requirements.
Question 18
Which role does a threat hunter play within a SOC?
Correct Answer: C
Question 19
Which two assets are available with the outbreak alert licensed feature on FortiAnalyzer? (Choose two.)
Correct Answer: C,D
Question 20
Which feature should be prioritized when configuring collectors in a high-traffic network environment?
