Finance users authenticated by DC1 appear in both the collector database and FortiGate. Finance users authenticated by DC2 are absent even from the collector database. What is the strongest first investigation?

Choose the single best answer.

A.Whether the shared Finance policy requires the right group
B.Whether the working FortiGate-to-collector link is globally down
C.Whether DC2 logons are monitored and reported
D.Whether a FortiGate group-name change can create the missing collector records

Show the answer and explanation

✓ Correct answer

Whether DC2 logons are monitored and reported

The collector is missing DC2 logons before policy authorization occurs. Check collection coverage and reporting. A working DC1 delivery path contradicts a globally failed shared connector; policy membership and group names cannot create absent collector events.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently created and unaffiliated with Fortinet. Questions are original practice items, not recalled exam content. Published-topic coverage does not guarantee examination success. FortiOS baseline is 7.6.0; independently versioned FortiSASE and CNF references are qualified where relevant.