NSE 5 – FortiAnalyzer 5.4 — Question 3

Logs are being deleted from one of your ADOMs earlier than the configured setting for archiving in your data policy. What is the most likely problem?

Answer options

• A. Logs in that ADOM are being forwarded in real-time to another FortiAnalyzer device
• B. CPU resources are too high
• C. The ADOM disk quota is set too low based on log rates
• D. The total disk space is insufficient and you need to add other disk

Correct answer: C

Explanation

The correct answer is C because if the ADOM disk quota is too low, it will lead to earlier log deletions to make space for new logs. Option A is incorrect as real-time forwarding does not affect local log retention. Option B might impact performance but does not directly cause early deletion, and option D, while related to disk space, is not the direct cause if the quota is already set too low.