ExamGecko
Question list
Search
Search

List of questions

Search

Related questions











Question 10 - FCSS_SASE_AD-23 discussion

Report
Export

When viewing the daily summary report generated by FortiSASE. the administrator notices that the report contains very little data. What is a possible explanation for this almost empty report?

A.
Digital experience monitoring is not configured.
Answers
A.
Digital experience monitoring is not configured.
B.
Log allowed traffic is set to Security Events for all policies.
Answers
B.
Log allowed traffic is set to Security Events for all policies.
C.
The web filter security profile is not set to Monitor
Answers
C.
The web filter security profile is not set to Monitor
D.
There are no security profile group applied to all policies.
Answers
D.
There are no security profile group applied to all policies.
Suggested answer: B

Explanation:

If the daily summary report generated by FortiSASE contains very little data, one possible explanation is that the 'Log allowed traffic' setting is configured to log only 'Security Events' for all policies. This configuration limits the amount of data logged, as it only includes security events and excludes normal allowed traffic.

Log Allowed Traffic Setting:

The 'Log allowed traffic' setting determines which types of traffic are logged.

When set to 'Security Events,' only traffic that triggers a security event (such as a threat detection or policy violation) is logged.

Impact on Report Data:

If the log setting excludes regular allowed traffic, the amount of data captured and reported is significantly reduced.

This results in reports with minimal data, as only security-related events are included.

FortiOS 7.2 Administration Guide: Provides details on configuring logging settings for traffic policies.

FortiSASE 23.2 Documentation: Explains the impact of logging configurations on report generation and data visibility.

asked 18/09/2024
Oren Dahan
45 questions
User
Your answer:
0 comments
Sorted by

Leave a comment first