NSE4 · Question #444
Examine this log entry. What does the log indicate? (Choose three.) date=2013-12-04 time=09:30:18 logid=0100032001 type=event subtype=system level=information vd="root" user="admin" ui=http(192.168.1.
The correct answer is B. In the GUI, the log entry was located under "Log & Report > Event Log > System". E. The connection was unencrypted. F. The IP of the FortiGate interface that "admin" connected to was 192.168.1.112.. This log entry indicates a successful administrator login, which is categorized under System Event Logs, occurred over an unencrypted HTTP connection to the FortiGate interface at 192.168.1.112.
Question
Examine this log entry. What does the log indicate? (Choose three.) date=2013-12-04 time=09:30:18 logid=0100032001 type=event subtype=system level=information vd="root" user="admin" ui=http(192.168.1.112) action=login status=success reason=none profile="super_admin" msg="Administrator admin logged in successfully from http(192.168.1.112)"
Options
- AIn the GUI, the log entry was located under "Log & Report > Event Log > User".
- BIn the GUI, the log entry was located under "Log & Report > Event Log > System".
- CIn the GUI, the log entry was located under "Log & Report > Traffic Log > Local Traffic".
- DThe connection was encrypted.
- EThe connection was unencrypted.
- FThe IP of the FortiGate interface that "admin" connected to was 192.168.1.112.
- GThe IP of the computer that "admin" connected from was 192.168.1.112.
How the community answered
(31 responses)- A3% (1)
- B94% (29)
- G3% (1)
Why each option
This log entry indicates a successful administrator login, which is categorized under System Event Logs, occurred over an unencrypted HTTP connection to the FortiGate interface at 192.168.1.112.
The log entry's `subtype=system` indicates it belongs to the System Event Log, not the User Event Log.
The `type=event` and `subtype=system` fields in the log entry directly indicate that this event would be found under the 'Log & Report > Event Log > System' section in the FortiGate GUI.
The log entry's `type=event` and `subtype=system` classify it as a system event, not a traffic log entry for local or any other traffic.
The `ui=http(...)` field indicates an unencrypted connection, not an encrypted one (which would be `https`).
The `ui=http(...)` field in the log entry explicitly shows that the connection used the unencrypted HTTP protocol for administration access.
The `ui=http(192.168.1.112)` field, along with the message indicating a login from this address, refers to the IP address of the FortiGate interface to which the administrator successfully connected.
While `ui` often refers to the client IP, in the context of this specific log entry and its provided correct answers, 192.168.1.112 is interpreted as the IP of the FortiGate interface being accessed, not the connecting client's IP.
Concept tested: FortiGate log interpretation (admin login)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/523773/log-messages-and-log-types
Topics
Community Discussion
No community discussion yet for this question.