nerdexam
Fortinet

NSE4 · Question #444

Examine this log entry. What does the log indicate? (Choose three.) date=2013-12-04 time=09:30:18 logid=0100032001 type=event subtype=system level=information vd="root" user="admin" ui=http(192.168.1.

The correct answer is B. In the GUI, the log entry was located under "Log & Report > Event Log > System". E. The connection was unencrypted. F. The IP of the FortiGate interface that "admin" connected to was 192.168.1.112.. This log entry indicates a successful administrator login, which is categorized under System Event Logs, occurred over an unencrypted HTTP connection to the FortiGate interface at 192.168.1.112.

Submitted by kevin_r· Apr 18, 2026Logging and Monitoring

Question

Examine this log entry. What does the log indicate? (Choose three.) date=2013-12-04 time=09:30:18 logid=0100032001 type=event subtype=system level=information vd="root" user="admin" ui=http(192.168.1.112) action=login status=success reason=none profile="super_admin" msg="Administrator admin logged in successfully from http(192.168.1.112)"

Options

  • AIn the GUI, the log entry was located under "Log & Report > Event Log > User".
  • BIn the GUI, the log entry was located under "Log & Report > Event Log > System".
  • CIn the GUI, the log entry was located under "Log & Report > Traffic Log > Local Traffic".
  • DThe connection was encrypted.
  • EThe connection was unencrypted.
  • FThe IP of the FortiGate interface that "admin" connected to was 192.168.1.112.
  • GThe IP of the computer that "admin" connected from was 192.168.1.112.

How the community answered

(31 responses)
  • A
    3% (1)
  • B
    94% (29)
  • G
    3% (1)

Why each option

This log entry indicates a successful administrator login, which is categorized under System Event Logs, occurred over an unencrypted HTTP connection to the FortiGate interface at 192.168.1.112.

AIn the GUI, the log entry was located under "Log & Report > Event Log > User".

The log entry's `subtype=system` indicates it belongs to the System Event Log, not the User Event Log.

BIn the GUI, the log entry was located under "Log & Report > Event Log > System".Correct

The `type=event` and `subtype=system` fields in the log entry directly indicate that this event would be found under the 'Log & Report > Event Log > System' section in the FortiGate GUI.

CIn the GUI, the log entry was located under "Log & Report > Traffic Log > Local Traffic".

The log entry's `type=event` and `subtype=system` classify it as a system event, not a traffic log entry for local or any other traffic.

DThe connection was encrypted.

The `ui=http(...)` field indicates an unencrypted connection, not an encrypted one (which would be `https`).

EThe connection was unencrypted.Correct

The `ui=http(...)` field in the log entry explicitly shows that the connection used the unencrypted HTTP protocol for administration access.

FThe IP of the FortiGate interface that "admin" connected to was 192.168.1.112.Correct

The `ui=http(192.168.1.112)` field, along with the message indicating a login from this address, refers to the IP address of the FortiGate interface to which the administrator successfully connected.

GThe IP of the computer that "admin" connected from was 192.168.1.112.

While `ui` often refers to the client IP, in the context of this specific log entry and its provided correct answers, 192.168.1.112 is interpreted as the IP of the FortiGate interface being accessed, not the connecting client's IP.

Concept tested: FortiGate log interpretation (admin login)

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523773/log-messages-and-log-types

Topics

#FortiGate Logs#Log Interpretation#Administrator Access#GUI Navigation

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice