Which statement correctly describes the management extensions available on FortiAnalyzer?

Management extensions, such as FortiSOAR, run directly on the FortiAnalyzer platform and consume its system resources. To ensure stability and performance, Fortinet specifies minimum hardware requirements for the host FortiAnalyzer before these extensions can be enabled. For example, enabling the FortiSOAR management extension requires the FortiAnalyzer appliance or VM to have a minimum number of CPU cores (e.g., 8 cores) and a minimum amount of RAM (e.g., 16 GB). This ensures the FortiAnalyzer has sufficient processing power to handle both its core logging/analysis functions and the additional workload from the extension.

A: This is incorrect. Specific management extensions, such as FortiSOAR, require a separate, dedicated license to be activated and used on the FortiAnalyzer.

B: This is incorrect. FortiAnalyzer and FortiSIEM are distinct products. Management extensions add capabilities like SOAR, but do not transform FortiAnalyzer into a FortiSIEM supervisor.

C: This is incorrect. Management extensions are designed to run on the FortiAnalyzer appliance or VM itself, not on a separate, dedicated VM.

1. FortiSOAR 7.4.2 on FortiAnalyzer Deployment Guide

Page 5

"System Requirements": "To enable FortiSOAR on FortiAnalyzer

the FortiAnalyzer must have a minimum of 8 CPU cores and 16 GB of RAM." (This directly supports option D).

2. FortiSOAR 7.4.2 on FortiAnalyzer Deployment Guide

Page 6

"Licensing": "FortiSOAR on FortiAnalyzer requires a FortiSOAR license. The FortiSOAR license is a separate purchase from the FortiAnalyzer license." (This refutes option A).

3. FortiAnalyzer 7.4.0 Administration Guide

Page 681

"Management Extensions": "FortiAnalyzer can be used as a platform to run management extensions

such as FortiSOAR... When a management extension is enabled

you can access it from the FortiAnalyzer GUI." (This supports the explanation that extensions run on FortiAnalyzer

refuting option C

and lists FortiSOAR as an example

refuting the FortiSIEM claim in option B).