According to the FortiAnalyzer Administration Guide, there are specific prerequisites for deleting an Administrative Domain (ADOM). Firstly, an ADOM cannot be deleted if it has any devices assigned to it. The devices must first be moved to a different ADOM. Secondly, the default root ADOM is a fundamental part of the FortiAnalyzer system and is protected from deletion to ensure the system remains operational. These two conditions are primary restrictions that must be met before an ADOM can be successfully removed from the system.

A. Logs must be purged or migrated before you can delete an ADOM.

This is incorrect. When an ADOM is deleted, the associated logs for that ADOM are automatically deleted along with it.

D. The status of the ADOMs must be unlocked.

While you cannot delete a locked ADOM, this is a temporary administrative state, not a fundamental prerequisite like the others. The primary rules concern device assignment and the ADOM's system role.

1. FortiAnalyzer Administration Guide 7.4

Page 101

"Deleting ADOMs".

"You cannot delete an ADOM that has devices assigned to it. You must move the devices to another ADOM before you can delete the ADOM." (Supports answer B).

"You cannot delete the root ADOM." (Supports answer C).

"When you delete an ADOM

the logs for the ADOM are also deleted." (Refutes option A).

2. FortiAnalyzer Administration Guide 7.4

Page 100

"Locking and unlocking an ADOM".

This section explains that locking an ADOM prevents configuration changes. Deleting an ADOM is a configuration change

so it would be blocked

but the explicit prerequisites for deletion are listed separately. (Context for refuting option D as a primary rule).