Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The restored messages match source hashes or expected records and can be examined in the supported tools. This is a different failure mechanism from the current case, which concerns the available search range still covers the policy's required investigation interval and storage utilization stays controlled.

This option instead describes a test failover timeline shows events from the correct active member before and after the transition. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analyst can search the authorized ADOM without gaining access to unrelated tenant data. The stem describes the SOC is about to shorten analytics retention for an emergency disk cleanup while relying on threat hunting to investigate older campaigns, so this explanation does not account for the observations.

An independent rerun under the archived definitions yields consistent figures where the underlying data remains available. This is a different failure mechanism from the current case, which concerns the underlying query is confirmed to return records before layout is changed and the chart displays them.

This option instead describes the required daily reports finish successfully without interfering with time-sensitive incident searches. Testing that independent mechanism would not show whether the reported fault has been resolved.

A test fixture demonstrates the correct distinct host count and higher number of related messages. The stem describes a security report's threat chart displays no rows, and the analyst starts redesigning the template before checking query execution, so this explanation does not account for the observations.

Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. “Forecast ingestion rates and set escalating disk utilization alerts before critical thresholds” would remedy that alternative situation, but it would not correct the present issue: local collection may continue while the forwarding link is down, and upstream analysis has a freshness gap until forwarding resumes.

“Recalculate EPS capacity with every large source expansion and include burst headroom in sizing” is the supported response when the sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works. Here the decisive response is “Monitor local spool capacity and forwarding queue health in remote collector architectures”, so that different intervention does not meet the stated requirement.

The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. “Include log source migration and historical identity continuity in the device replacement runbook” applies to that other condition. The reported evidence is a regional Collector records events locally but central investigations stop receiving the region's new events during a WAN outage; this alternative would address the wrong dependency.

That intervention addresses saved search filter wrong boolean logic, where Combining mutually exclusive predicates with AND can eliminate matches that would satisfy a properly grouped OR condition. Here, the relevant failure is instead: The selected Log View column layout can hide fields that are present in underlying record details.

That intervention addresses traffic log action versus security profile action, where Firewall session policy acceptance and downstream security profile enforcement refer to different decisions in the traffic path. In this question the necessary remedy is “Inspect message details and configure the appropriate displayed field or custom view column”, which this alternative does not provide.

That intervention addresses fortiview top threat time spike, where Changes in log collection or security profile configuration can alter observed detection counts independently of real attack frequency. The observed condition is an investigator receives a log containing an important application field, but the standard visible columns do not show it in the message list; this mechanism addresses another problem.

Removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis. “Preserve required source records and use the supported case status and targeted suppression workflow as appropriate” would remedy that alternative situation, but it would not correct the present issue: stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead.

“Remove exposed credential material from the case, rotate the affected secret and replace it with redacted diagnostic context” is the supported response when incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store. Here the decisive response is “Check the current FortiGuard IOC update age and corroborate with recent observations before authorizing response”, so that different intervention does not meet the stated requirement.

An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. “Link the relevant observed log field, time and source to the indicator record and case narrative” applies to that other condition. The reported evidence is an investigator uses a threat indicator that was last refreshed months ago to justify a broad firewall block across the enterprise; this alternative would address the wrong dependency.

A tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted. “Join tunnel events with related traffic logs and check the intended application session and routing behavior” would remedy that alternative situation, but it would not correct the present issue: a category-based web-filter policy can block a site even without an identified malware signature.

“Inspect query name, DNS action and subsequent sessions to distinguish attempted lookup from successful command-channel access” is the supported response when DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP. Here the decisive response is “Inspect the web-filter category, action, matching policy and exact requested hostname before proposing an exception”, so that different intervention does not meet the stated requirement.

A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. “Correlate VPN authentication logs by user, source address, outcome, time and any second-factor events” applies to that other condition. The reported evidence is a user reports that a legitimate research website is inaccessible and FortiAnalyzer shows several blocked web filter messages for that domain; this alternative would address the wrong dependency.

An event trigger runs on matching individual events, which may precede incident creation and analyst classification. “Document whether each automation listens for event creation or incident creation in its design review” would remedy that alternative situation, but it would not correct the present issue: a generic EVENT_TRIGGER without scope conditions can launch on unrelated events and create unsafe automated response.

“Name and document manual versus automatic playbooks so responders know when actions will execute” is the supported response when an ON_DEMAND trigger requires deliberate execution and does not behave like an event-triggered workflow. Here the decisive response is “Use least-privilege trigger criteria and test negative controls before automating disruptive actions”, so that different intervention does not meet the stated requirement.

Notification delivery depends on its configured mail transport and credentials separately from event detection. “Monitor mail delivery errors and update notification credentials in the secret rotation plan” applies to that other condition. The reported evidence is a newly enabled playbook runs containment tasks for every event, including routine system alerts, because no event-trigger filter was set; this alternative would address the wrong dependency.

A denied traffic action records a blocked attempt rather than confirmation of successful permitted access or compromise. “Separate deny from accept actions and correlate with subsequent allowed sessions and endpoint or server evidence” would remedy that alternative situation, but it would not correct the present issue: a change in grouping, deduplication or severity filters can alter incident counts without altering the raw set of attempts.

“Group traffic by source, destination ports, actions and server login events to reconstruct actual successful access” is the supported response when broad internal management-port scanning can suggest lateral movement, but accepted sessions need distinct identity and server context. Here the decisive response is “Compare query definitions, distinct event keys and the same source time range before explaining the trend”, so that different intervention does not meet the stated requirement.

A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. “Inspect the widget's ADOM, device and group filters and include the new source if authorized” applies to that other condition. The reported evidence is a monthly threat chart shows fewer incidents than the previous week, but the underlying unique attempted connections have not fallen; this alternative would address the wrong dependency.

Receiving external alert logs may require a suitable enabled event-collector handler to transform the ingested alert into an event. “Review the external event source and enable or tune the supported ingested-event handler and its scope” would remedy that alternative situation, but it would not correct the present issue: connector actions require correctly typed parameters; URL, domain and IP indicators are not interchangeable inputs.

“Configure a supported task or case action to record relevant enrichment and its source in the incident” is the supported response when transient task output is not equivalent to documented incident evidence that can be reviewed later. Here the decisive response is “Validate indicator type and map the appropriate field to a supported connector action before executing”, so that different intervention does not meet the stated requirement.

Local automation privileges do not grant the remote connector account permission for the intended FortiOS API action. “Inspect remote API role permissions and grant only the minimal supported operation within approved change controls” applies to that other condition. The reported evidence is a playbook passes a URL string into a connector task expecting an IP address and produces an error instead of containment; this alternative would address the wrong dependency.

Device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included. “Restrict report source selection to the authorized region and rerun with the same time window” would remedy that alternative situation, but it would not correct the present issue: a proportion chart obscures chronological order, even when the dataset contains valid time-bucketed results.

“Verify the actual Analytics range and use a separately maintained compliant archive or supported import path when possible” is the supported response when a report cannot reconstruct events outside available indexed data solely by extending its date selector. Here the decisive response is “Use a suitable line or bar visualization with a time-series dataset for daily trend reporting”, so that different intervention does not meet the stated requirement.

An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. “Run the dataset test against representative source devices and verify counts and filters before using Chart Builder” applies to that other condition. The reported evidence is an analyst uses a pie chart for daily blocked-event counts and cannot communicate the sharp rise during one specific day; this alternative would address the wrong dependency.

That intervention addresses fortiview device filter hides new branch, where A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. Here, the relevant failure is instead: Broad internal management-port scanning can suggest lateral movement, but accepted sessions need distinct identity and server context.

That intervention addresses threat campaign report count reclassification, where A change in grouping, deduplication or severity filters can alter incident counts without altering the raw set of attempts. In this question the necessary remedy is “Group traffic by source, destination ports, actions and server login events to reconstruct actual successful access”, which this alternative does not provide.

That intervention addresses email attachment lure and web pivot, where Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. The observed condition is a workstation initiates RDP connections to many internal servers, with most attempts denied and a few accepted within minutes; this mechanism addresses another problem.