NSE 8 – Network Security Expert (811) — Question 37

An organization has one central site and three remote sites. A FortiSIEM has been installed on the central site and now all devices across the remote sites must be centrally monitored by the FortiSIEM at the central site.
Which action will reduce the WAN usage by the monitoring system?

Answer options

• A. Enable SD-WAN FEC (Forward Error Correction) on the FortiGate at the remote site.
• B. Install both Supervisor and Collector on each remote site.
• C. Install local Collectors on each remote site.
• D. Disable real-time log upload on the remote sites.

Correct answer: C

Explanation

Installing local Collectors at each remote site (option C) allows for data collection to occur closer to the devices, thus reducing the amount of data that needs to be sent over the WAN to the central FortiSIEM. The other options either do not address WAN traffic or potentially increase it, such as enabling SD-WAN FEC or using both Supervisor and Collector, which may increase the network load.