Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The evidence inventory distinguishes hash and event record from any separately acquired file sample. This is a different failure mechanism from the current case, which concerns affected host counts reflect unique verified endpoints rather than the number of individual log messages.

This option instead describes the final event list includes pre- and post-midnight records from the same investigative interval. Testing that independent mechanism would not show whether the reported fault has been resolved.

The report distinguishes elapsed session lifetime from measured application response time. The stem describes a malicious domain appears in both DNS and web-filter records, but the analyst incorrectly counts every record as a distinct infected host, so this explanation does not account for the observations.

Log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation. “Update the approved log group or device selection and recompute the regional analysis for the affected period” would remedy that alternative situation, but it would not correct the present issue: an alert dependent on parsed fields can stop matching when the parser schema or producer keys change.

“Check the feature's enablement, deployment mode and required indexed logs separately from raw ingestion” is the supported response when a disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. Here the decisive response is “Compare the current raw payload, parsed fields and alert query and repair the supported mapping or condition”, so that different intervention does not meet the stated requirement.

Product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. “Check current Fortinet release documentation and supported upgrade paths, then test critical analytics and connectors” applies to that other condition. The reported evidence is an alert rule compares normalized destination names, but after a parser update that field becomes empty for one incoming log subtype; this alternative would address the wrong dependency.

A test empty lookup does not change the firewall and the incident records why automatic response was skipped. This is a different failure mechanism from the current case, which concerns a post-upgrade known test event triggers its expected playbook with task-level success.

This option instead describes a representative single detection generates the intended notification with consistent severity and ownership. Testing that independent mechanism would not show whether the reported fault has been resolved.

A simulated timeout is resolved without duplicated blocks and the job records its eventual confirmed state. The stem describes a planned FortiAnalyzer upgrade disables an event-triggered workflow, but SOC coverage is assumed intact because log receipt continues, so this explanation does not account for the observations.

A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. “Maintain a report-to-chart-to-dataset dependency inventory for shared analytics objects” would remedy that alternative situation, but it would not correct the present issue: report output cannot contain detections from log categories the originating devices did not generate or forward.

“Use explicit time standards and boundary tests in geographically distributed reporting” is the supported response when scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. Here the decisive response is “Monitor upstream log-category coverage as part of reporting SLA checks”, so that different intervention does not meet the stated requirement.

Grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute. “Track identity field completeness as a quality measure for user-based analytics reports” applies to that other condition. The reported evidence is a weekly antivirus report generates successfully but is empty because endpoint security log generation was disabled upstream during maintenance; this alternative would address the wrong dependency.

IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof. “Use geolocation anomalies as one factor in a privileged access review rather than a standalone compromise verdict” would remedy that alternative situation, but it would not correct the present issue: a tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted.

“Build account-centric authentication alerts with success-after-failures logic and contextual enrichment” is the supported response when a high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. Here the decisive response is “Validate tunnel uptime and business traffic reachability as separate acceptance measures”, so that different intervention does not meet the stated requirement.

DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP. “Correlate DNS filter results with traffic and endpoint evidence before concluding beacon success” applies to that other condition. The reported evidence is an administrator sees a successful site-to-site VPN tunnel event and assumes application traffic crossed it successfully; this alternative would address the wrong dependency.

A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. “Avoid overstating data loss without action and destination evidence in DLP incident summaries” would remedy that alternative situation, but it would not correct the present issue: file filtering can block an object by its type without an antivirus malware verdict.

“Enable appropriate privileged login alerting and restrict management network access to authorized sources” is the supported response when a pattern of failed authentications can indicate brute-force activity even when no login has succeeded. Here the decisive response is “Separate file-policy and malware investigations when designing alert explanations”, so that different intervention does not meet the stated requirement.

An application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions. “Review application classification changes with business owners after signature and policy updates” applies to that other condition. The reported evidence is a PDF attachment is rejected by a gateway and analysts search only malware signatures even though the object triggered a file-type rule; this alternative would address the wrong dependency.

A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. “Correlate VPN authentication logs by user, source address, outcome, time and any second-factor events” would remedy that alternative situation, but it would not correct the present issue: DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP.

“Correlate administrative logs with known VPN gateways, MFA records, source reputation and recent account activity” is the supported response when IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof. Here the decisive response is “Inspect query name, DNS action and subsequent sessions to distinguish attempted lookup from successful command-channel access”, so that different intervention does not meet the stated requirement.

A tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted. “Join tunnel events with related traffic logs and check the intended application session and routing behavior” applies to that other condition. The reported evidence is a workstation repeatedly resolves a suspected command-and-control domain and FortiAnalyzer receives DNS filter detections with replacement responses; this alternative would address the wrong dependency.

The timeline establishes whether a policy deployment coincides with the observed change in blocked traffic. This is a different failure mechanism from the current case, which concerns the investigator can distinguish an abnormal scripted pattern from legitimate resolver or update activity.

This option instead describes the reconstructed transfer shows consistent sent and received measures for the relevant vantage point. Testing that independent mechanism would not show whether the reported fault has been resolved.

A single observed attempt retains both supporting detections without being counted as two independent compromises. The stem describes a FortiView DNS summary reveals thousands of unusual subdomain lookups from one host during the same interval, so this explanation does not account for the observations.

That intervention addresses predefined report scope wrong adom, where A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. Here, the relevant failure is instead: Dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields.

That intervention addresses report requires analytics rather than raw archives, where Report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. In this question the necessary remedy is “Edit or clone the dataset for the appropriate security log type and test the query against known IPS events”, which this alternative does not provide.

That intervention addresses report chart missing its dataset, where Charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records. The observed condition is a custom FortiAnalyzer report chart shows no IPS detections because the underlying dataset queries traffic rather than security event logs; this mechanism addresses another problem.

Editing a shared baseline template can alter multiple reports or remove a known-good rollback point. “Clone the appropriate report or template and change the cloned layout for the specific audience” would remedy that alternative situation, but it would not correct the present issue: expensive broad SQL queries and report concurrency can exceed the available analytics processing resources.

“Review auto-cache behavior and regenerate the report or refresh data appropriately for the new dataset definition” is the supported response when report caching can reuse prepared results rather than recomputing every query immediately under all conditions. Here the decisive response is “Inspect report diagnostic and task logs, then narrow or optimize dataset queries and schedule supported workloads”, so that different intervention does not meet the stated requirement.

Generation success does not prove the dataset query returned the expected source records or that the content is substantively correct. “Check the generated report, dataset tests, source device filter and Analytics log coverage” applies to that other condition. The reported evidence is a large monthly dataset repeatedly times out during generation while smaller reports still complete normally; this alternative would address the wrong dependency.

That intervention addresses confidential information in report columns, where A technically valid report can expose sensitive log attributes when output fields and recipients exceed authorized need. Here, the relevant failure is instead: A presentation-oriented report layout is not equivalent to a record-level export needed for data reconciliation.

That intervention addresses report cover page displays old dates, where Static layout text and dynamically computed report period fields are different sources of metadata. In this question the necessary remedy is “Provide a supported structured dataset or filtered log export alongside the report with approved source and field scope”, which this alternative does not provide.

That intervention addresses macro references missing field alias, where A macro expects a defined dataset field, and alias changes can break the reference even when the SQL returns data. The observed condition is an audit team needs a searchable table of raw selected fields, but the monthly report sends only a graphical PDF summary; this mechanism addresses another problem.