A. Logs compressed and saved in files with the .gz extension
B. Logs previously collected from devices that are offline
C. Logs a FortiAnalyzer administrator can access in FortiView
D. Logs that are indexed and stored in the SQL database
正解：A
解説：
Archive logs on FortiAnalyzer are logs that have been stored in files and, once a log file reaches its size limit, it is "rolled" and compressed, becoming offline logs. These compressed archive logs are saved as files, typically with the .gz extension, and are not immediately viewable or reportable in FortiView, Log View, or Reports panes. https://docs.fortinet.com/docume ... 1825/analytics-and- archive-logs
質問 # 42
What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?
A. The detection engine classifies those logs as Suspicious.
B. A new infected entry is added for the corresponding endpoint under Compromised Hosts.
C. The endpoint is marked as Compromised and, optionally, can be put in quarantine.
D. FortiAnalyzer flags the associated host for further analysis.
正解：B
質問 # 43
Which log will generate an event with the status Unhandled?
A. An AppControl log with action=blocked.
B. A WebFilter log will action=dropped.
C. An IPS log with action=pass.
D. An AV log with action=quarantine.
正解：C
解説：
In FortiOS 7.4.1 and FortiAnalyzer 7.4.1, the "Unhandled" status in logs typically signifies that the FortiGate encountered a security event but did not take any specific action to block or alter it. This usually occurs in the context of Intrusion Prevention System (IPS) logs.
* IPS logs with action=pass: When the IPS engine inspects traffic and determines that it does not match any known attack signatures or violate any configured policies, it assigns the action "pass". Since no action is taken to block or modify this traffic, the status is logged as "Unhandled." Let's look at why the other options are incorrect:
* An AV log with action=quarantine: Antivirus (AV) logs with the action "quarantine" indicate that a file was detected as malicious and moved to quarantine. This is a definitive action, so the status wouldn't be "Unhandled."
* A WebFilter log will action=dropped: WebFilter logs with the action "dropped" indicate that web traffic was blocked according to the configured web filtering policies. Again, this is a specific action taken, not an "Unhandled" event.
* An AppControl log with action=blocked: Application Control logs with the action "blocked" mean that an application was denied access based on the defined application control rules. This is also a clear action, not "Unhandled."
質問 # 44
Which two statements about local logs on FortiAnalyzer are true? (Choose two.)
A. They are not supported in FortiView.
B. Event logs are available only in the root ADOM.
C. You can view playbook logs for all ADOMs in the root ADOM.
D. Event logs show system-wide information, whereas application logs are ADOM specific.
正解：C、D
解説：
Playbook logs, which relate to automated incident response actions, can be viewed centrally in the root ADOM, allowing visibility across all ADOMs.
Event logs on FortiAnalyzer typically provide system-wide information applicable to the entire FortiAnalyzer unit, while application logs are specific to each ADOM, reflecting the logs related to devices and activities managed within that ADOM. https://docs.fortinet.com/docume ... 08717/enabling-and- disabling-the-adom-feature
質問 # 45
It is a best practice to upload FortiAnalyzer local logs to a remote server. Which three remote servers are supported for the upload? (Choose three.)
Author: eliblac649 Time: 1/15/2026 20:41
PassTIP는 몇년간 최고급 덤프품질로 IT인증덤프제공사이트중에서 손꼽히는 자리에 오게 되었습니다. CompTIA CS0-003 덤프는 많은 덤프들중에서 구매하는 분이 많은 인기덤프입니다. CompTIA CS0-003시험준비중이신 분이시라면CompTIA CS0-003한번 믿고 시험에 도전해보세요. 좋은 성적으로 시험패스하여 자격증 취득할것입니다.Author: evannel582 Time: 2/3/2026 11:53
I’m stunned by how wonderful your article is, thank you for sharing it! Free CIPM latest test simulator resources—good luck with your exam!
Welcome Firefly Open Source Community (https://bbs.t-firefly.com/)