StudyByteLearn
← Fortinet NSE 4 - FortiOS 7.6 Administrator
NSE 4 · Firewall policies

Practice question 119 of 440 · medium

Which two facts should be established before correlating a security event with a forward traffic log? Select two answers.

Select all that apply. Every correct option and no extras are required for credit in the app.

  1. A.Match only the displayed policy name across all managed devices
  2. B.Check the session ID and timestamps together
  3. C.Confirm the same device and VDOM context
  4. D.Match only the destination IP and ignore client/session fields
Show the answer and explanation

✓ Correct answers

  • Check the session ID and timestamps together
  • Confirm the same device and VDOM context

Session/time plus device/VDOM context supports correlation. Names can be reused and many different sessions can reach the same destination, so those fields alone are insufficient.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.