Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses fortiview device filter hides new branch, where A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. Here, the relevant failure is instead: Broad internal management-port scanning can suggest lateral movement, but accepted sessions need distinct identity and server context.

That intervention addresses threat campaign report count reclassification, where A change in grouping, deduplication or severity filters can alter incident counts without altering the raw set of attempts. In this question the necessary remedy is “Group traffic by source, destination ports, actions and server login events to reconstruct actual successful access”, which this alternative does not provide.

That intervention addresses email attachment lure and web pivot, where Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. The observed condition is a workstation initiates RDP connections to many internal servers, with most attempts denied and a few accepted within minutes; this mechanism addresses another problem.

A security policy change can create many deny logs that reflect changed enforcement rather than increased attacker attempts. “Overlay change windows on security event trends and retain configuration audit records” would remedy that alternative situation, but it would not correct the present issue: high-frequency or high-entropy DNS patterns can indicate tunneling or automated discovery but can also reflect legitimate software.

“Build combined source- and account-centric authentication detections to avoid missing distributed guessing” is the supported response when a source-ranked failure total does not reveal the identities targeted or whether any session later succeeded. Here the decisive response is “Monitor anomalous DNS volume and label findings as hypotheses until corroborated”, so that different intervention does not meet the stated requirement.

Sent and received byte counters describe different traffic directions and can be interpreted from the chosen device perspective. “Publish a directional field legend with recurring high-volume traffic dashboards” applies to that other condition. The reported evidence is a FortiView DNS summary reveals thousands of unusual subdomain lookups from one host during the same interval; this alternative would address the wrong dependency.

An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. “Run the dataset test against representative source devices and verify counts and filters before using Chart Builder” would remedy that alternative situation, but it would not correct the present issue: a report cannot reconstruct events outside available indexed data solely by extending its date selector.

“Update the output profile to the approved distribution group and retest authorized recipient delivery” is the supported response when report output profile recipients can remain stale even when generated content and filters are correct. Here the decisive response is “Verify the actual Analytics range and use a separately maintained compliant archive or supported import path when possible”, so that different intervention does not meet the stated requirement.

Device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included. “Restrict report source selection to the authorized region and rerun with the same time window” applies to that other condition. The reported evidence is a quarterly report request spans ninety days but the indexed Analytics retention policy retains only the latest month; this alternative would address the wrong dependency.

That intervention addresses domain indicator expiration after cleanup, where Historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. Here, the relevant failure is instead: The same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous.

That intervention addresses user and endpoint correlation after dhcp lease, where Endpoint addresses can change while host and user identities remain consistent, so an IP-only pivot can truncate a case timeline. In this question the necessary remedy is “Restrict events by tenant ADOM, device and VDOM before pivoting on the private source address”, which this alternative does not provide.

That intervention addresses fortiguard ioc ip match shared infrastructure, where An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. The observed condition is a centralized SOC sees traffic from 10.0.1.25 across several tenants and mistakenly groups all events as one infected workstation; this mechanism addresses another problem.

A saved report definition does not automatically run periodically unless its schedule and output settings are enabled. “Set the intended report schedule and verified output profile, then test the next planned generation” would remedy that alternative situation, but it would not correct the present issue: an extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records.

“Modify the supported SQL dataset to group by the relevant host identifier and apply the appropriate distinct-count logic” is the supported response when counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host. Here the decisive response is “Align the dataset's time constraints with the report period variables and test boundary timestamps”, so that different intervention does not meet the stated requirement.

Successful report generation and successful email delivery are separate stages with independent transport dependencies. “Inspect report output profile and mail server configuration and resolve delivery authentication or routing errors” applies to that other condition. The reported evidence is a weekly report omits Sunday night events because a customized SQL condition uses a different date window than the scheduled report; this alternative would address the wrong dependency.

That intervention addresses antivirus blocked object investigation, where An antivirus detection identifies a suspicious object, but the configured security action determines whether delivery was blocked or allowed. Here, the relevant failure is instead: Many short low-volume sessions can outnumber fewer high-volume sessions, so count and byte volume are distinct metrics.

That intervention addresses ips detection repeated across many sources, where A shared signature ID is not proof that every alert targets the same asset or represents the same attacker session. In this question the necessary remedy is “Compare session counts, sent and received bytes, applications and time range for each candidate host”, which this alternative does not provide.

That intervention addresses ips signature versus exploitation evidence, where An IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target. The observed condition is a dashboard ranks a host highest by session count, and a team assumes it also transferred the most data in the interval; this mechanism addresses another problem.

Overlapping rules and notification routing can produce duplicated escalation for one underlying source event. “Audit rule overlap, notification profiles and explicit escalation ownership to select the correct route” would remedy that alternative situation, but it would not correct the present issue: the current incident status alone does not provide the full chronology of analyst actions and changes.

“Review dependencies and tests, then enable the approved playbook and confirm its runtime status” is the supported response when a defined workflow and configured trigger do not execute automatically when the playbook is disabled. Here the decisive response is “Review the supported incident audit history and relevant administrative event records for each change”, so that different intervention does not meet the stated requirement.

A predefined handler can contain several rules, and disabling the full handler removes detection coverage beyond one unwanted rule. “Review the handler's component rules and tune or selectively disable only the problematic rule when supported” applies to that other condition. The reported evidence is after an investigation, the compliance officer asks who suppressed an event and who changed the incident's priority; this alternative would address the wrong dependency.

Destination concentration can result from legitimate DNS or routing changes, not necessarily a newly targeted malicious server. “Maintain a planned change calendar when baselining network and application flow anomalies” would remedy that alternative situation, but it would not correct the present issue: different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies.

“Use multi-stage timeline correlation to investigate unusual authentication followed by data movement” is the supported response when a suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. Here the decisive response is “Maintain accurate asset classification and use it when interpreting user and entity analytics”, so that different intervention does not meet the stated requirement.

Periodic connections may indicate command-and-control polling but also appear in legitimate update checks or monitoring agents. “Correlate periodicity alerts with endpoint and threat intelligence context before escalation” applies to that other condition. The reported evidence is a SOC investigation includes employees and kiosk devices but applies the same risk expectation to both device categories; this alternative would address the wrong dependency.

Report caching can reuse prepared results rather than recomputing every query immediately under all conditions. “Document cache-refresh steps in report testing and track dataset revision timestamps” would remedy that alternative situation, but it would not correct the present issue: editing a shared baseline template can alter multiple reports or remove a known-good rollback point.

“Profile expensive datasets and monitor scheduled report concurrency before monthly deadlines” is the supported response when expensive broad SQL queries and report concurrency can exceed the available analytics processing resources. Here the decisive response is “Use versioned report templates and explicit ownership for customer-specific variants”, so that different intervention does not meet the stated requirement.

Generation success does not prove the dataset query returned the expected source records or that the content is substantively correct. “Pair report delivery monitoring with substantive output quality checks for important reports” applies to that other condition. The reported evidence is a risk analyst must change the text and visual order of one customer-facing report without modifying a corporate baseline used by other teams; this alternative would address the wrong dependency.

A shared administrative identity prevents dependable change attribution and cannot enforce individual access privileges. “Prohibit shared privileged accounts and review administrative changes in routine SOC governance” would remedy that alternative situation, but it would not correct the present issue: formatted log presentation can show selected parsed fields while raw messages preserve the full original key-value content.

“Retain protected administrative audit logs and validate their collection alongside ordinary device events” is the supported response when firewall session telemetry is not the same evidence as administrative changes made directly on the analyzer appliance. Here the decisive response is “Consult raw messages before declaring a source field missing and document parser limitations”, so that different intervention does not meet the stated requirement.

Stored searches and parsers built for an older subtype schema may exclude the new message values. “Version control schema-sensitive searches and rerun sample data tests on product upgrades” applies to that other condition. The reported evidence is an analyst cannot find an unfamiliar field in the formatted log display and concludes it never arrived from the device; this alternative would address the wrong dependency.

Hostname changes do not necessarily change underlying device serial identity but can make name-only searches incomplete. “Keep a device rename history and favor immutable identifiers in incident correlation and evidence export” would remedy that alternative situation, but it would not correct the present issue: log file rollover behavior is distinct from event loss and must be evaluated against retained sequence and archive coverage.

“Inspect transport security during branch onboarding and after certificates or firmware change” is the supported response when destination configuration alone does not prove negotiated transport security or trusted endpoint identity. Here the decisive response is “Check rotation policy and archival capacity under realistic peak logging loads”, so that different intervention does not meet the stated requirement.

ADOM separation restricts the inventory and data scope used by analytics and incident workflows by design. “Treat tenant isolation as a control, not a failure to fix by granting unrestricted global administrator access” applies to that other condition. The reported evidence is a branch log archive rotates rapidly during a traffic storm and analysts mistake the larger number of smaller files for missing events; this alternative would address the wrong dependency.