Refer to the exhibit. You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology. Which…

The correct answer is B. The analytics-to-archive ratio is misconfigured. FortiAnalyzer best practices call for about 70 % of disk space dedicated to analytics and 30 % to archive. In this screenshot it's flipped (30 % analytics / 70 % archive), which will starve analytics processing of space and impact reporting and searches.

FortiAnalyzer for SOC

Question

Refer to the exhibit. You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology. Which potential problem do you observe?

Exhibit

Options

AThe disk space allocated is insufficient.
BThe analytics-to-archive ratio is misconfigured.
CThe analytics retention period is too long.
DThe archive retention period is too long.

How the community answered

(33 responses)

A
6% (2)
B
61% (20)
C
12% (4)
D
21% (7)

Explanation

FortiAnalyzer best practices call for about 70 % of disk space dedicated to analytics and 30 % to archive. In this screenshot it's flipped (30 % analytics / 70 % archive), which will starve analytics processing of space and impact reporting and searches.

Topics

#analytics-archive ratio#data policy#FortiAnalyzer deployment#storage configuration

Community Discussion

No community discussion yet for this question.

Full NSE7_SOC_AR-7.6 Practice