NSE6_FSR-7.3 Exam Questions & Answers

In FortiSOAR, system-level logs that can be purged include both 'Audit logs' and 'Executed Playbook logs.' These types of logs can be configured to be purged periodically to free up storage space and ensure that unnecessary logs do not impact system performance. The application configuration allows administrators to schedule automatic purges, which can be especially useful in high-activity environments where log data accumulates quickly. Purging these logs helps maintain a cleaner and more efficient system.

Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:

According to the FortiSOAR 7.3 Administration Guide under the 'Audit Logs' and 'Role-Based Access Control (RBAC)' sections, managing the lifecycle of system logs requires elevated administrative privileges.

To perform a manual purge of audit logs, the system validates permissions across two specific areas:

Audit Log Activities Module: The user must have Delete permissions on this specific module because it is the repository where the actual log records are stored. Without 'Delete' rights here, the application cannot remove the database entries.

Security Module: Because the purging of audit logs is a sensitive security operation that affects the system's accountability trail, FortiSOAR requires the Delete permission on the Security module. This acts as a secondary administrative guardrail to ensure only authorized security administrators can permanently remove audit trails.

Permissions on the People or Users modules (Options C and D) are used for managing user profiles and account attributes, but they do not grant the authority to manipulate system-level audit databases.