Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records. “Inspect the chart's dataset reference and attach a compatible tested dataset to the report template” would remedy that alternative situation, but it would not correct the present issue: dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields.

“Verify Analytics log retention for the needed period and use a supported data reprocessing workflow if available” is the supported response when report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. Here the decisive response is “Edit or clone the dataset for the appropriate security log type and test the query against known IPS events”, so that different intervention does not meet the stated requirement.

A report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. “Use a supported macro tied to an appropriate query that returns the required summary value” applies to that other condition. The reported evidence is a custom FortiAnalyzer report chart shows no IPS detections because the underlying dataset queries traffic rather than security event logs; this alternative would address the wrong dependency.

Exported rows without their query context are insufficient to reproduce the exact event population. “Record the scoped Log View filter conditions and export metadata alongside the preserved rows” would remedy that alternative situation, but it would not correct the present issue: long-lived flows can contribute usage across report windows, and time aggregation does not necessarily correspond to new session creation.

“Group events by signature, target, source, action and time before comparing campaign characteristics” is the supported response when a shared signature ID is not proof that every alert targets the same asset or represents the same attacker session. Here the decisive response is “Inspect raw session start, end and duration fields and the widget's aggregation method”, so that different intervention does not meet the stated requirement.

An antivirus detection identifies a suspicious object, but the configured security action determines whether delivery was blocked or allowed. “Inspect the antivirus action, file details, traffic association and any endpoint alerts for the same download” applies to that other condition. The reported evidence is an analyst observes an application session lasting through midnight but believes it was created twice because daily charts display activity on both dates; this alternative would address the wrong dependency.

A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. “Record ADOM and source selection in recurring report configuration reviews” would remedy that alternative situation, but it would not correct the present issue: a blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect.

“Review report schedule concurrency and workload sizing after every major device-source increase” is the supported response when simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. Here the decisive response is “Use data-source and query diagnostics as the first troubleshooting step for empty report visuals”, so that different intervention does not meet the stated requirement.

A new report run can reflect current query and group definitions rather than the exact scope used for the earlier issued report. “Archive report configuration and evidence provenance with each important compliance issuance” applies to that other condition. The reported evidence is a security report's threat chart displays no rows, and the analyst starts redesigning the template before checking query execution; this alternative would address the wrong dependency.

Historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. “Compare original indicator definition time with the current feed and retain the case evidence provenance” would remedy that alternative situation, but it would not correct the present issue: endpoint addresses can change while host and user identities remain consistent, so an IP-only pivot can truncate a case timeline.

“Review the IOC type, confidence, original connection and any relevant DNS or URL information” is the supported response when an IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. Here the decisive response is “Correlate log host identity, authenticated user, DHCP records and observed address changes within the relevant period”, so that different intervention does not meet the stated requirement.

Hash equality identifies matching file content but does not alone establish when or how each endpoint obtained it. “Group supported malware or endpoint logs by hash and correlate host, user, time and delivery method” applies to that other condition. The reported evidence is an infected client received a new IP address during the investigation, and a simple search by its old IP returns no recent traffic; this alternative would address the wrong dependency.

Delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. “Track delivery lag and preserve both timestamp interpretations in outage investigations” would remedy that alternative situation, but it would not correct the present issue: historical threat hunts require suitable retained records, and discarding indexed logs reduces the evidence available to future searches.

“Test representative read-only analyst profiles after administrator and ADOM permissions are changed” is the supported response when successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. Here the decisive response is “Include forensic lookback needs and IOC rescan periods in retention policy reviews”, so that different intervention does not meet the stated requirement.

A completed backup job is not proof that the required stored log files are intact and recoverable for investigation. “Maintain periodic recovery drills and validate retention and access controls on backup copies” applies to that other condition. The reported evidence is the SOC is about to shorten analytics retention for an emergency disk cleanup while relying on threat hunting to investigate older campaigns; this alternative would address the wrong dependency.

A test failover timeline shows events from the correct active member before and after the transition. This is a different failure mechanism from the current case, which concerns the analyst can search the authorized ADOM without gaining access to unrelated tenant data.

This option instead describes the reconstructed timeline matches the firewall's actual event order rather than the later batch delivery time. Testing that independent mechanism would not show whether the reported fault has been resolved.

The available search range still covers the policy's required investigation interval and storage utilization stays controlled. The stem describes an analyst can authenticate to the FortiAnalyzer GUI but the log search pane reports insufficient permission for one ADOM, so this explanation does not account for the observations.

That intervention addresses event threshold too low during routine scans, where A single denied connection is insufficient evidence for a multi-attempt scan and yields excessive false-positive events. Here, the relevant failure is instead: A rule cannot match required authentication fields when its selected log source or subtype does not contain them.

That intervention addresses predefined event handler disabled, where A predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. In this question the necessary remedy is “Choose the relevant VPN event logs and set filters against the actual authenticated user and outcome fields”, which this alternative does not provide.

That intervention addresses basic event source filter too broad, where Without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope. The observed condition is a custom rule looks for VPN authentication failures, but its data selector targets general traffic sessions rather than VPN events; this mechanism addresses another problem.

That intervention addresses disk quota saturation and dropped logs, where Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. Here, the relevant failure is instead: Existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow.

That intervention addresses network connection loss between analyzer and collector, where Local collection may continue while the forwarding link is down, and upstream analysis has a freshness gap until forwarding resumes. In this question the necessary remedy is “Configure an available IOC rescan policy for the supported log history and keep the threat database current”, which this alternative does not provide.

That intervention addresses log device registration after rma, where The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. The observed condition is an investigator wants to apply newly received threat intelligence to last week's stored traffic, but only yesterday's previously flagged indicators appear; this mechanism addresses another problem.

Endpoint addresses can change while host and user identities remain consistent, so an IP-only pivot can truncate a case timeline. “Include identity or asset inventory correlation in long-running investigations rather than relying on static IP addresses” would remedy that alternative situation, but it would not correct the present issue: an IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction.

“Keep hash evidence and host attribution together to avoid collapsing unrelated occurrences into one untested story” is the supported response when hash equality identifies matching file content but does not alone establish when or how each endpoint obtained it. Here the decisive response is “Require contextual validation for indicators on shared hosting before blocking entire address ranges”, so that different intervention does not meet the stated requirement.

The same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous. “Attach tenant and origin context to saved IP-based queries and automation rules” applies to that other condition. The reported evidence is an IOC service flags traffic to an IP associated with malicious activity, but the IP belongs to widely shared cloud infrastructure; this alternative would address the wrong dependency.

Log file rollover behavior is distinct from event loss and must be evaluated against retained sequence and archive coverage. “Check rotation policy and archival capacity under realistic peak logging loads” would remedy that alternative situation, but it would not correct the present issue: collector mode concentrates on receiving and forwarding or retaining logs and does not offer the full local analysis functions available in Analyzer mode.

“Review ADOM mappings and administrator profiles during onboarding and quarterly entitlement checks” is the supported response when an overly broad ADOM assignment breaks the logical security boundary even when device logging and database storage are otherwise functioning. Here the decisive response is “Document deployment roles and verify operational capabilities before assigning the appliance to SOC analysts”, so that different intervention does not meet the stated requirement.

The collection tier and the analytics tier can hold different operational functions and storage responsibilities in a distributed deployment. “Maintain a current data-flow diagram and monitor each hop independently instead of treating collection as analysis” applies to that other condition. The reported evidence is an operator deploys a FortiAnalyzer instance in Collector mode and expects the same local FortiView and analytics capabilities that an Analyzer unit provides; this alternative would address the wrong dependency.

Generic HTTPS totals obscure application categories that may reveal unsanctioned file-sharing services. “Use application-aware FortiView or application-control telemetry with user and destination filters” would remedy that alternative situation, but it would not correct the present issue: email detection and subsequent web access must be correlated across distinct products using consistent user and time context.

“Compare queried hostname, web Host or URL fields, addresses, times and profile actions before asserting a bypass” is the supported response when different hostnames or cached endpoints can share an IP and different security profiles evaluate different request fields. Here the decisive response is “Join mail, user, URL and web-filter records from the supported sources in the relevant ADOM”, so that different intervention does not meet the stated requirement.

A DoS or anomaly detection is not by itself evidence that the protected application became unavailable. “Inspect the detected rate, protective action and independent service availability measurements over the same interval” applies to that other condition. The reported evidence is fortiMail marks a suspicious attachment and a user soon opens a related URL, but the analyst has only one of the two products' dashboards; this alternative would address the wrong dependency.