NSE 5 – FortiAnalyzer 6.2 — Question 29

Logs are being deleted from one of the ADOMs earlier than the configured setting for archiving in the data policy.
What is the most likely problem?

Answer options

• A. CPU resources are too high
• B. Logs in that ADOM are being forwarded, in real-time, to another FortiAnalyzer device
• C. The total disk space is insufficient and you need to add other disk
• D. The ADOM disk quota is set too low, based on log rates

Correct answer: D

Explanation

The correct answer is D because if the ADOM's disk quota is too low, it can lead to premature log deletions to free up space. Options A and C do not directly relate to log deletion timing and B is incorrect because real-time forwarding wouldn't cause earlier deletions in the local ADOM.