The set log-checksum md5-auth command configures the FortiAnalyzer to secure log files by generating a checksum. This specific option uses the MD5 algorithm combined with a pre-shared authentication code (key). The purpose is to ensure log file integrity and authenticity. When logs are rolled, FortiAnalyzer calculates a hash value using both the log data and the secret authentication code. This makes it computationally infeasible for an unauthorized party to alter the log file and forge a new, valid checksum without knowing the code, thus providing stronger integrity verification than a simple MD5 hash.

A: This option is incomplete. While an MD5 hash is used, the md5-auth setting specifically adds an authentication code to the process, which this answer omits.

B: This command relates to log file integrity, not the encryption of passwords that might be contained within the log messages themselves.

C: This command ensures the integrity of the stored log file after it has been received and archived. It does not encrypt the real-time log transport channel.

1. FortiAnalyzer 7.4.1 CLI Reference

Page 111

config system global.

log-checksum {none | md5 | md5-auth}: The entry explicitly defines the md5-auth option as: "Use MD5 with an authentication code to create a checksum." This directly supports the correct answer.

2. FortiAnalyzer 7.4 Administration Guide

Page 160

"System Settings > Advanced > Log File Settings".

The guide explains the purpose of the log checksum feature is to "verify that the log files have not been altered." It details that selecting MD5-Auth requires an Authentication Code

confirming that both elements are part of the configuration.