Which two methods can you use to restrict administrative access on FortiAnalyzer? (Choose two.)

FortiAnalyzer provides multiple layers to restrict administrative access. The two most direct and fundamental methods are configuring trusted hosts and using administrator profiles.

1. Trusted Hosts (A): This feature provides network-level access control by restricting which source IP addresses or subnets are permitted to log in to the FortiAnalyzer management interface. This is a critical security measure to limit the attack surface.

2. Administrator Profiles (D): This feature provides permission-level access control (Role-Based Access Control - RBAC). Profiles define granular permissions for what an administrator can view and modify within the FortiAnalyzer GUI and CLI, ensuring adherence to the principle of least privilege.

These two methods represent distinct and essential layers of security: restricting where access is allowed from and what a user can do after authentication.

B. Limit access to specific virtual domains: While assigning an administrator to a specific VDOM does restrict their scope, it is primarily a feature for segmentation and multi-tenancy. Trusted hosts and profiles are more fundamental security controls applicable in all deployment scenarios.

C. Fabric connectors to external LDAP servers: Fabric connectors are used for integration, and an LDAP server is used for authentication, not authorization or access restriction. The restriction policies (profiles, trusted hosts) are applied to the administrator account, which may use LDAP for authentication.

1. FortiAnalyzer Administration Guide 7.4.1

Page 102

"Creating administrators": The guide details the configuration for a new administrator

explicitly listing "Administrator Profile" and "Trusted Hosts" as key settings.

Under "Trusted Hosts"

it states: "Configure the IP addresses and netmasks of the hosts that the administrator can use to log in to FortiAnalyzer."

Under "Administrator Profile"

it states: "Select a profile for the administrator."

2. FortiAnalyzer Administration Guide 7.4.1

Page 104

"Admin profiles": This section explicitly states

"Administrator profiles are used to grant permissions to administrators. You can create different administrator profiles for different administrators." This confirms the role of profiles in restricting access based on function.

3. FortiAnalyzer Administration Guide 7.4.1

Page 101

"Administrators": The introductory paragraph mentions the key methods: "You can configure administrators with different levels of permissions by using administrator profiles

trusted hosts

and virtual domains (VDOMs)." This shows that while VDOMs are a method of restriction

profiles and trusted hosts are the primary tools for defining permissions and network access control

respectively.