Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted. “Validate tunnel uptime and business traffic reachability as separate acceptance measures” would remedy that alternative situation, but it would not correct the present issue: a high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method.

“Review category changes and keep exception requests tied to specific logged URLs and users” is the supported response when a category-based web-filter policy can block a site even without an identified malware signature. Here the decisive response is “Build account-centric authentication alerts with success-after-failures logic and contextual enrichment”, so that different intervention does not meet the stated requirement.

IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof. “Use geolocation anomalies as one factor in a privileged access review rather than a standalone compromise verdict” applies to that other condition. The reported evidence is a remote-access gateway reports hundreds of failed SSL VPN logins for one account overnight, followed by a single successful login; this alternative would address the wrong dependency.

MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds. “Configure actual event rules and test supporting data before using technique mapping for reporting” would remedy that alternative situation, but it would not correct the present issue: the event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption.

“Apply a narrowly defined suppression or exception for the authorized scanner, expected signature and scheduled window” is the supported response when known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. Here the decisive response is “Switch the analysis to the authorized branch ADOM or deploy a properly scoped handler there”, so that different intervention does not meet the stated requirement.

Views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. “Check handler tags and the view filter and align them to the documented intended category” applies to that other condition. The reported evidence is a cloned handler is enabled in the headquarters ADOM but expected branch log messages are present only under the regional ADOM; this alternative would address the wrong dependency.

A new qualifying test event creates a related incident with traceable event evidence. This is a different failure mechanism from the current case, which concerns the case records completed corrective actions and post-remediation checks on the targeted host.

This option instead describes the receiving analyst can reconstruct prior work without repeating intrusive containment actions. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident references the correct asset and raw detections, allowing an authorized analyst to continue the investigation. The stem describes a case is closed after an IOC alarm quiets down but no one checks whether the compromised host was actually remediated, so this explanation does not account for the observations.

Viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile. “Review automation execution roles and preserve least privilege during urgent incident response” would remedy that alternative situation, but it would not correct the present issue: connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome.

“Maintain positive and negative branch tests for each automation revision” is the supported response when disconnected or incorrectly configured task routes can make a branch unreachable regardless of the input event. Here the decisive response is “Maintain a connector capability inventory and check target-version support before importing playbooks”, so that different intervention does not meet the stated requirement.

A playbook definition can reference integrations that are absent or have different credentials in the destination environment. “Audit imported dependencies and avoid assuming playbook portability includes secrets or authorization” applies to that other condition. The reported evidence is a responder imports an automation that expects a device isolation action, but the configured connector does not offer that action for its target; this alternative would address the wrong dependency.

Once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained. “Confirm available historical data and recover from a separately maintained compliant archive where technically supported” would remedy that alternative situation, but it would not correct the present issue: connector reachability does not imply the remote API grants the specific permitted operations required for the SOC workflow.

“Constrain the investigation to the intended serials, VDOMs and ADOM before interpreting IP-based correlation” is the supported response when queries without appropriate source restrictions can combine multiple devices that share the same private IP addresses. Here the decisive response is “Grant the minimal supported API permissions for the needed read operation and retest connector action authorization”, so that different intervention does not meet the stated requirement.

Imported historical records preserve their original source attributes rather than becoming new events produced by the replacement. “Inspect source serial and import provenance and maintain the historical device attribution during retrospective analysis” applies to that other condition. The reported evidence is an enrichment connector is online but cannot retrieve device status because the external API account has only an unrelated read permission; this alternative would address the wrong dependency.

An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. “Link the relevant observed log field, time and source to the indicator record and case narrative” would remedy that alternative situation, but it would not correct the present issue: live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated.

“Remove exposed credential material from the case, rotate the affected secret and replace it with redacted diagnostic context” is the supported response when incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store. Here the decisive response is “Use controlled noncritical test indicators and an isolated or approved test enforcement scope for the first run”, so that different intervention does not meet the stated requirement.

Removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis. “Preserve required source records and use the supported case status and targeted suppression workflow as appropriate” applies to that other condition. The reported evidence is a new isolation playbook is evaluated against production infrastructure before anyone confirms its target selection and rollback plan; this alternative would address the wrong dependency.

That intervention addresses device group membership stale after relocation, where Log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation. Here, the relevant failure is instead: Traffic can match and be forwarded by a firewall policy even when session logging is disabled on that specific rule.

That intervention addresses wrong adom after device onboarding, where Administrative domains isolate device inventory and associated log visibility, so the analyst's selected ADOM can exclude the logging source. In this question the necessary remedy is “Enable the approved traffic logging option on the matching firewall policy and retest the intended session type”, which this alternative does not provide.

That intervention addresses fortigate remote logging not enabled, where A healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs. The observed condition is a critical FortiGate policy forwards Internet traffic but sends no session entries to FortiAnalyzer while other policies produce records normally; this mechanism addresses another problem.

Identical usernames do not prove both sessions originated from the same approved management path. “Alert on privileged access outside trusted sources and monitor configuration of administrative trusted hosts” would remedy that alternative situation, but it would not correct the present issue: an incident interval crossing midnight cannot be faithfully represented by a single daytime date bucket.

“Define performance metrics explicitly before using FortiView connection durations as service health indicators” is the supported response when connection duration alone may include idle time and is not identical to end-user application response latency. Here the decisive response is “Use absolute incident windows in handoffs involving rotating shifts and timezone boundaries”, so that different intervention does not meet the stated requirement.

Metadata in a security log does not imply the analyzer stores an accessible full copy of the transmitted payload. “Avoid promising file-content recovery from standard event logs without verifying actual sample collection” applies to that other condition. The reported evidence is an SOC investigation covering a night shift uses calendar date filters that unintentionally exclude activity shortly after midnight; this alternative would address the wrong dependency.

Producer-specific severity encodings may not map into the analyzer's normalized severity field without a suitable parser definition. “Regression-test severity mappings after connector, firmware or parser updates” would remedy that alternative situation, but it would not correct the present issue: imported historical records preserve their original source attributes rather than becoming new events produced by the replacement.

“Set data retention to documented business requirements and test restoration before the next compliance incident” is the supported response when once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained. Here the decisive response is “Tag imported evidence and avoid rewriting original log identity to match current asset names”, so that different intervention does not meet the stated requirement.

Connector reachability does not imply the remote API grants the specific permitted operations required for the SOC workflow. “Audit connector service account scopes and deny broad permissions as a shortcut to integration failures” applies to that other condition. The reported evidence is an imported historical log file was copied from a decommissioned firewall and appears in a search alongside events from a replacement device; this alternative would address the wrong dependency.

File filtering can block an object by its type without an antivirus malware verdict. “Inspect the file-filter event subtype, detected file type, policy and enforcement action” would remedy that alternative situation, but it would not correct the present issue: a DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted.

“Filter administrative event logs by user, source, outcome and interval and compare with successful access or account lockout events” is the supported response when a pattern of failed authentications can indicate brute-force activity even when no login has succeeded. Here the decisive response is “Inspect DLP log action, matched rule, relevant content metadata and corresponding traffic session”, so that different intervention does not meet the stated requirement.

An application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions. “Review the detected application, signature and policy action and test a precisely scoped permitted alternative if approved” applies to that other condition. The reported evidence is a DLP rule reports a sensitive-file upload, but the case owner assumes the whole document was exfiltrated before inspecting the action; this alternative would address the wrong dependency.

A completed backup job is not proof that the required stored log files are intact and recoverable for investigation. “Maintain periodic recovery drills and validate retention and access controls on backup copies” would remedy that alternative situation, but it would not correct the present issue: HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity.

“Track delivery lag and preserve both timestamp interpretations in outage investigations” is the supported response when delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. Here the decisive response is “Validate HA-aware device groups and log selectors in SOC content during planned firewall failovers”, so that different intervention does not meet the stated requirement.

Successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. “Test representative read-only analyst profiles after administrator and ADOM permissions are changed” applies to that other condition. The reported evidence is an active-passive FortiGate pair fails over and logs begin arriving under a different member serial, causing a saved device-specific search to appear empty; this alternative would address the wrong dependency.