Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Both old and new eligible event subtypes are represented in the tested analytics results after adjustment. This is a different failure mechanism from the current case, which concerns a known test sequence from the three sources appears in its correct chronological order with consistent timezone interpretation.

This option instead describes a test configuration change yields the expected administrator attribution in the appliance's event history. Testing that independent mechanism would not show whether the reported fault has been resolved.

Changes to event and analytics configuration can be tied to each approved operator rather than a common login. The stem describes a SOC operator correlates endpoint, firewall and mail detections by device-local text timestamps and infers a false multi-stage sequence, so this explanation does not account for the observations.

A rule cannot match required authentication fields when its selected log source or subtype does not contain them. “Test event handlers using authentic sample log types instead of assumptions about similar field names” would remedy that alternative situation, but it would not correct the present issue: predefined event handlers can restrict direct editing of their original configuration and are intended as reusable templates.

“Monitor disabled built-in handlers and record which views depend on each detection rule” is the supported response when a predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. Here the decisive response is “Retain the original handler as a reference and review custom rule drift after product updates”, so that different intervention does not meet the stated requirement.

A single denied connection is insufficient evidence for a multi-attempt scan and yields excessive false-positive events. “Review alert volume and baseline traffic before changing scan detection sensitivity” applies to that other condition. The reported evidence is a team needs to customize an existing malware event handler for its regulated servers, but several protected built-in fields cannot be edited; this alternative would address the wrong dependency.

An IOC association can be provisional, and the wrong host can be targeted when addresses or inventory identifiers are stale. “Confirm endpoint identity, indicator context, current IP and related network activity before any authorized containment” would remedy that alternative situation, but it would not correct the present issue: a suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category.

“Inspect interarrival times, application, endpoint process context and intelligence matches for the destination” is the supported response when periodic connections may indicate command-and-control polling but also appear in legitimate update checks or monitoring agents. Here the decisive response is “Correlate VPN success, assigned internal address, mapped user, destination and transferred bytes over the same timeframe”, so that different intervention does not meet the stated requirement.

Different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies. “Filter or group supported endpoint records by known asset category and evaluate each against its appropriate baseline” applies to that other condition. The reported evidence is one account logs in through VPN from a new location and later transfers an atypically large volume of data to an external service; this alternative would address the wrong dependency.

The same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata. “Annotate evidence exports with time zone and source clock assumptions in the chain-of-custody process” would remedy that alternative situation, but it would not correct the present issue: log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation.

“Create a recovery plan and preflight version compatibility for each connected source and integration” is the supported response when product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. Here the decisive response is “Tie organizational and device group membership changes to the asset relocation workflow”, so that different intervention does not meet the stated requirement.

An alert dependent on parsed fields can stop matching when the parser schema or producer keys change. “Maintain parser-to-alert dependency tests and monitor for sudden field null-rate changes” applies to that other condition. The reported evidence is an access control review finds a moved branch firewall still in its old regional log group, producing misleading totals in regional dashboards; this alternative would address the wrong dependency.

That intervention addresses archive and analytics log purpose, where Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. Here, the relevant failure is instead: Clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages.

That intervention addresses traffic versus event log category, where Log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. In this question the necessary remedy is “Synchronize log sources and FortiAnalyzer with trusted time services and use consistent event-time interpretation”, which this alternative does not provide.

That intervention addresses log rollover versus report retention, where Rollover and storage retention settings determine file availability, while report datasets require suitable Analytics log data. The observed condition is a correlation search shows a VPN connection appearing after its follow-on attack even though the firewall and VPN gateway record related activity; this mechanism addresses another problem.

The noisy case subsides while controlled events for the remaining rules continue generating alerts. This is a different failure mechanism from the current case, which concerns a known sustained attempt sequence triggers without converting ordinary isolated mistakes into alerts.

This option instead describes a new test notification reaches the current assignee and the previous owner is not the only recipient. Testing that independent mechanism would not show whether the reported fault has been resolved.

The case documents the actor, time and recorded action for the investigated workflow changes. The stem describes a distributed-password-guessing event rule never fires because each failed login occurs outside its very short aggregation window, so this explanation does not account for the observations.

Traffic session totals and security threat detections count different records, each requiring its own log subtype and metric. “Label charts with the underlying log category and aggregation method before distributing risk summaries” would remedy that alternative situation, but it would not correct the present issue: fortiView widgets obey their selected time ranges and filters; a narrow current interval can omit legitimate historical records.

“Monitor identity-field coverage and treat large sudden unknown-user increases as a telemetry quality signal” is the supported response when session logs cannot show authenticated user identity unless the relevant identity source and log fields are available and associated. Here the decisive response is “Record time range and filters alongside saved dashboard screenshots in case notes”, so that different intervention does not meet the stated requirement.

Destination IP totals do not reliably identify a detected application, especially when multiple services share hosting addresses. “Correlate application identity with traffic and destination fields rather than inferring apps from IPs alone” applies to that other condition. The reported evidence is an analyst sees no data in a FortiView widget while another investigator has screenshots of yesterday's event in the same ADOM; this alternative would address the wrong dependency.

Suppressing future duplicate alerts does not replace the need to retain source logs and prior event evidence. “Separate alert suppression controls from retention and evidence-preservation requirements” would remedy that alternative situation, but it would not correct the present issue: stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead.

“Require dry-run or isolated pilot evidence before enabling high-impact production playbooks” is the supported response when live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated. Here the decisive response is “Monitor intelligence-feed age and distinguish historical matches from current reputation in playbooks”, so that different intervention does not meet the stated requirement.

An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. “Require provenance and matching field context for indicators referenced in incident decisions” applies to that other condition. The reported evidence is an investigator uses a threat indicator that was last refreshed months ago to justify a broad firewall block across the enterprise; this alternative would address the wrong dependency.

The event timeline distinguishes blocked probes from any genuinely successful connections. This is a different failure mechanism from the current case, which concerns the responsible policy and representative underlying sessions are identified for the selected spike.

This option instead describes a configuration audit aligns the event's policy field with the correct policy revision at the incident time. Testing that independent mechanism would not show whether the reported fault has been resolved.

A specific internal client is mapped to the observed external connection without conflating other users. The stem describes a FortiView traffic chart shows a surge during a narrow interval, but the team cannot explain which firewall rule allowed the sessions, so this explanation does not account for the observations.

The Fabric-specific analysis view becomes available and can display relevant indexed logs. This is a different failure mechanism from the current case, which concerns the analyst can search the permitted customer logs but cannot open another customer's device or log inventory.

This option instead describes device logs and supported management views work correctly after the ADOM version is aligned. Testing that independent mechanism would not show whether the reported fault has been resolved.

A test log is recorded at the collector and can be searched at the central Analyzer after successful forwarding. The stem describes a partner analyst who should see only one customer's logs can switch into other customers' ADOMs because the administrative profile was too broad, so this explanation does not account for the observations.

That intervention addresses report raw logs differ from aggregated counts, where Distinct asset counts and individual event message totals measure different populations and cannot be compared as equal. Here, the relevant failure is instead: An extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records.

That intervention addresses sql grouping double counts device sessions, where Counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host. In this question the necessary remedy is “Align the dataset's time constraints with the report period variables and test boundary timestamps”, which this alternative does not provide.

That intervention addresses report scheduling not enabled, where A saved report definition does not automatically run periodically unless its schedule and output settings are enabled. The observed condition is a weekly report omits Sunday night events because a customized SQL condition uses a different date window than the scheduled report; this mechanism addresses another problem.