Which is recommended when you are managing a high volume of logs in your network?

For environments with a high volume of logs, the recommended Fortinet architecture is to use a dedicated FortiAnalyzer appliance. FortiAnalyzer is specifically designed for high-speed log collection, storage, analysis, and reporting, making it the optimal solution for scalability. By adding the FortiAnalyzer to FortiManager, you can centralize both device management (FortiManager) and log analysis (FortiAnalyzer) under a single pane of glass. This integration allows administrators to manage the FortiAnalyzer and access its reporting capabilities directly from the FortiManager GUI, creating a powerful and efficient security management and analytics platform.

A. FortiManager has limited built-in logging and reporting capabilities suitable for smaller deployments, but it is not designed to handle a high volume of logs.

C. Enabling ADOMs (Administrative Domains) is a feature for segmenting and delegating the administration of managed devices; it does not address log storage or processing capacity.

D. The correct and efficient log flow is from managed devices (like FortiGate) to FortiAnalyzer. Forwarding logs from FortiAnalyzer back to FortiManager is illogical and inefficient.

1. FortiManager Administration Guide (7.4.1)

Chapter: "Log View and FortiView"

Section: "Log View".

Page 431 states

"FortiManager can be configured to be the central logging and reporting device for a small number of devices and a low volume of logs. For more extensive logging

a FortiAnalyzer unit is required." This directly supports the need for FortiAnalyzer in high-volume scenarios and refutes option A.

2. FortiManager Administration Guide (7.4.1)

Chapter: "FortiAnalyzer"

Section: "Adding FortiAnalyzer to FortiManager".

Page 451 details the procedure for integrating a FortiAnalyzer. It states

"FortiManager can be used to manage a FortiAnalyzer unit. When FortiManager is managing a FortiAnalyzer unit

you can view FortiAnalyzer device information from the FortiManager GUI." This confirms that adding and managing FortiAnalyzer from FortiManager (Option B) is the intended operational model.

3. Fortinet Certified Professional - Security Operations Study Guide for FortiOS 7.2

Chapter 1: "Introduction to FortiSOAR"

Section: "Fortinet Security Fabric".

This guide consistently depicts the architectural relationship where FortiGate devices send logs to FortiAnalyzer for analysis and reporting

while FortiManager provides centralized management. This reinforces the distinct roles of each product and the correct log flow

invalidating option D.