Fortinet FCP_FAZ_AN-7.6 Questions & Answers

An excessive correlation window can connect unrelated events that happen to share a hostname or indicator. “Review correlation windows against both false-positive history and expected attack timing” would remedy that alternative situation, but it would not correct the present issue: a simple event count does not establish the order or relationship of multiple steps required for an attack pattern.

“Include tag and dashboard routing in event handler acceptance tests” is the supported response when event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. Here the decisive response is “Document sequence, grouping and expiration conditions when maintaining multi-stage detections”, so that different intervention does not meet the stated requirement.

Event generation does not itself prove a notification action is configured and connected to the correct handler. “Test notification profile recipients and transport after on-call roster and mail-server changes” applies to that other condition. The reported evidence is an SOC rule must detect a failed login burst followed by one successful login rather than simply any two authentication events; this alternative would address the wrong dependency.

A test detection appears in the intended endpoint category and retains its original linked log. This is a different failure mechanism from the current case, which concerns events from unrelated days no longer join while known genuine short-interval sequences still correlate.

This option instead describes a controlled failure-then-success sequence triggers while an unrelated reverse order does not. Testing that independent mechanism would not show whether the reported fault has been resolved.

A qualifying test event produces an alert and an on-call notification with the correct source context. The stem describes a custom multi-stage handler joins alerts that occurred many days apart and generates spurious campaign incidents, so this explanation does not account for the observations.

Rollover and storage retention settings determine file availability, while report datasets require suitable Analytics log data. “Check analytics retention, available indexed logs and quota settings before promising historical report coverage” would remedy that alternative situation, but it would not correct the present issue: clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages.

“Check traffic-log generation, category selection and Log View filters rather than diagnosing a complete device outage” is the supported response when log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. Here the decisive response is “Synchronize log sources and FortiAnalyzer with trusted time services and use consistent event-time interpretation”, so that different intervention does not meet the stated requirement.

Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. “Verify the required time period in each storage tier and restore or reprocess logs through a supported analytics workflow if needed” applies to that other condition. The reported evidence is a correlation search shows a VPN connection appearing after its follow-on attack even though the firewall and VPN gateway record related activity; this alternative would address the wrong dependency.

A proportion chart obscures chronological order, even when the dataset contains valid time-bucketed results. “Use a suitable line or bar visualization with a time-series dataset for daily trend reporting” would remedy that alternative situation, but it would not correct the present issue: an untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart.

“Verify the actual Analytics range and use a separately maintained compliant archive or supported import path when possible” is the supported response when a report cannot reconstruct events outside available indexed data solely by extending its date selector. Here the decisive response is “Run the dataset test against representative source devices and verify counts and filters before using Chart Builder”, so that different intervention does not meet the stated requirement.

Report output profile recipients can remain stale even when generated content and filters are correct. “Update the output profile to the approved distribution group and retest authorized recipient delivery” applies to that other condition. The reported evidence is a newly created chart displays plausible values, but the dataset query has not been tested against the intended ADOM and device logs; this alternative would address the wrong dependency.

An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. “Review the IOC type, confidence, original connection and any relevant DNS or URL information” would remedy that alternative situation, but it would not correct the present issue: an application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions.

“Inspect DLP log action, matched rule, relevant content metadata and corresponding traffic session” is the supported response when a DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. Here the decisive response is “Review the detected application, signature and policy action and test a precisely scoped permitted alternative if approved”, so that different intervention does not meet the stated requirement.

File filtering can block an object by its type without an antivirus malware verdict. “Inspect the file-filter event subtype, detected file type, policy and enforcement action” applies to that other condition. The reported evidence is after enabling a new application-control signature set, a finance workflow stops and related FortiAnalyzer logs show a blocked application classification; this alternative would address the wrong dependency.

Log collection and automated response are separate capabilities, and workflow suspension can create a response gap. “Include automation validation in maintenance recovery alongside log ingestion checks” would remedy that alternative situation, but it would not correct the present issue: an automation may have partial task failures, and successful completion of one branch is not evidence all required actions succeeded.

“Use schema validation and negative type tests for all automation task inputs” is the supported response when connector actions require correctly typed parameters; URL, domain and IP indicators are not interchangeable inputs. Here the decisive response is “Design and test error paths instead of validating only the happy path of playbooks”, so that different intervention does not meet the stated requirement.

Even a valid response action fails to protect the intended path if it targets a device unrelated to the originating event. “Include device identity and connector target validation in every automated firewall action” applies to that other condition. The reported evidence is a connector call to contain an address fails, but the response workflow still marks the case resolved without notifying the owner; this alternative would address the wrong dependency.

Historical eligible records gain new indicator matches after a rescan with newer definitions. This is a different failure mechanism from the current case, which concerns a test failover timeline shows events from the correct active member before and after the transition.

This option instead describes the analyst can search the authorized ADOM without gaining access to unrelated tenant data. Testing that independent mechanism would not show whether the reported fault has been resolved.

The restored messages match source hashes or expected records and can be examined in the supported tools. The stem describes an active-passive FortiGate pair fails over and logs begin arriving under a different member serial, causing a saved device-specific search to appear empty, so this explanation does not account for the observations.

The playbook starts on a matching incident and does not start merely from an untriaged raw event. This is a different failure mechanism from the current case, which concerns a simulated timeout is resolved without duplicated blocks and the job records its eventual confirmed state.

This option instead describes a test empty lookup does not change the firewall and the incident records why automatic response was skipped. Testing that independent mechanism would not show whether the reported fault has been resolved.

A representative single detection generates the intended notification with consistent severity and ownership. The stem describes a network connector occasionally times out after sending a block command, and repeated blind retries create duplicate configuration entries, so this explanation does not account for the observations.

The playbook starts on a matching incident and does not start merely from an untriaged raw event. This is a different failure mechanism from the current case, which concerns the execution monitor shows an explicitly initiated job with a recorded operator or source trigger.

This option instead describes the firewall action runs only after the lookup returns the expected indicator and required approval checks pass. Testing that independent mechanism would not show whether the reported fault has been resolved.

Only a test event matching the approved detection starts the containment workflow. The stem describes a responder creates a playbook intended for manual use from an incident but expects it to run automatically when any event appears, so this explanation does not account for the observations.

That intervention addresses predefined dataset cloned for customization, where Predefined datasets are reusable built-in resources and are not edited or deleted like analyst-created custom datasets. Here, the relevant failure is instead: Counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host.

That intervention addresses dataset time filter excludes reporting week, where An extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records. In this question the necessary remedy is “Modify the supported SQL dataset to group by the relevant host identifier and apply the appropriate distinct-count logic”, which this alternative does not provide.

That intervention addresses report scheduling not enabled, where A saved report definition does not automatically run periodically unless its schedule and output settings are enabled. The observed condition is a report claims hundreds of unique infected endpoints but counts every IPS log message instead of distinct source hosts; this mechanism addresses another problem.

The case records whether the same authenticated identity initiated the subsequent transfer and whether policy permitted it. This is a different failure mechanism from the current case, which concerns the proposed response is tied to the correct live asset with documented supporting evidence.

This option instead describes the resulting timeline distinguishes a regular heartbeat from an evidenced malicious beacon pattern. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analyst distinguishes unusual employee activity from expected kiosk or scanner transactions. The stem describes fortiAnalyzer flags an endpoint as potentially compromised after IOC matches, and an operator wants to isolate it immediately without validating identity, so this explanation does not account for the observations.