Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses report generated for wrong device group, where Device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included. Here, the relevant failure is instead: A proportion chart obscures chronological order, even when the dataset contains valid time-bucketed results.

That intervention addresses report output profile wrong recipient, where Report output profile recipients can remain stale even when generated content and filters are correct. In this question the necessary remedy is “Use a suitable line or bar visualization with a time-series dataset for daily trend reporting”, which this alternative does not provide.

That intervention addresses report chart builder query not validated, where An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. The observed condition is an analyst uses a pie chart for daily blocked-event counts and cannot communicate the sharp rise during one specific day; this mechanism addresses another problem.

Imported historical records preserve their original source attributes rather than becoming new events produced by the replacement. “Tag imported evidence and avoid rewriting original log identity to match current asset names” would remedy that alternative situation, but it would not correct the present issue: an alert dependent on parsed fields can stop matching when the parser schema or producer keys change.

“Troubleshoot collection and analytics as separate layers and alert on each independently” is the supported response when a disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. Here the decisive response is “Maintain parser-to-alert dependency tests and monitor for sudden field null-rate changes”, so that different intervention does not meet the stated requirement.

The same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata. “Annotate evidence exports with time zone and source clock assumptions in the chain-of-custody process” applies to that other condition. The reported evidence is an alert rule compares normalized destination names, but after a parser update that field becomes empty for one incoming log subtype; this alternative would address the wrong dependency.

That intervention addresses playbook loops caused by response logs, where Response-generated events can feed back into the same broad trigger unless source or action context is excluded. Here, the relevant failure is instead: A predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection.

That intervention addresses basic event source filter too broad, where Without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope. In this question the necessary remedy is “Identify the relevant built-in detection handler and enable it with an appropriate rule and event scope”, which this alternative does not provide.

That intervention addresses basic event rule wrong log category, where A rule cannot match required authentication fields when its selected log source or subtype does not contain them. The observed condition is a SOC dashboard's compromised-host view stops updating even though Log View still shows fresh botnet-related traffic records from the same FortiGate; this mechanism addresses another problem.

That intervention addresses denied traffic action interpretation, where A denied traffic action records a blocked attempt rather than confirmation of successful permitted access or compromise. Here, the relevant failure is instead: A shared CDN endpoint can serve many unrelated legitimate web services, so destination frequency alone cannot establish malicious purpose.

That intervention addresses session policy lookup after rule reorder, where Policy identifiers and configuration context must be interpreted against the configuration effective when the event was logged. In this question the necessary remedy is “Inspect resolved domains, applications, web-filter categories, security actions and affected user behavior”, which this alternative does not provide.

That intervention addresses nat address versus originating host, where An external translated address alone may represent many internal sources and cannot uniquely identify one initiating host. The observed condition is an analyst flags a content delivery network IP as suspicious because it appears in thousands of destination sessions across departments; this mechanism addresses another problem.

An IOC association can be provisional, and the wrong host can be targeted when addresses or inventory identifiers are stale. “Require identity validation and a reversible containment plan for automated high-impact actions” would remedy that alternative situation, but it would not correct the present issue: destination concentration can result from legitimate DNS or routing changes, not necessarily a newly targeted malicious server.

“Correlate periodicity alerts with endpoint and threat intelligence context before escalation” is the supported response when periodic connections may indicate command-and-control polling but also appear in legitimate update checks or monitoring agents. Here the decisive response is “Maintain a planned change calendar when baselining network and application flow anomalies”, so that different intervention does not meet the stated requirement.

A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. “Use multi-stage timeline correlation to investigate unusual authentication followed by data movement” applies to that other condition. The reported evidence is a previously quiet service IP suddenly dominates traffic, but the destination is part of a planned application migration; this alternative would address the wrong dependency.

A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. “Review saved dashboard scopes when source membership and device groups change” would remedy that alternative situation, but it would not correct the present issue: a security policy change can create many deny logs that reflect changed enforcement rather than increased attacker attempts.

“Publish a directional field legend with recurring high-volume traffic dashboards” is the supported response when sent and received byte counters describe different traffic directions and can be interpreted from the chosen device perspective. Here the decisive response is “Overlay change windows on security event trends and retain configuration audit records”, so that different intervention does not meet the stated requirement.

A source-ranked failure total does not reveal the identities targeted or whether any session later succeeded. “Build combined source- and account-centric authentication detections to avoid missing distributed guessing” applies to that other condition. The reported evidence is users report a sudden increase in blocked sessions and the SOC attributes it to a new malware campaign without examining firewall changes; this alternative would address the wrong dependency.

A branch test message generates the desired event without leaking unrelated tenant data. This is a different failure mechanism from the current case, which concerns the test event appears in the targeted threat view with its linked log intact.

This option instead describes normal scanner activity stops generating duplicate cases while the same pattern from an unapproved host still alerts. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident stays active with clear ownership until an independent test verifies mitigation. The stem describes a custom threat event fires correctly but is absent from the team's saved Event Monitor threat view, so this explanation does not account for the observations.

That intervention addresses playbook task output type is null, where Downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds. Here, the relevant failure is instead: A timeout does not prove the remote action failed, so blindly repeating non-idempotent tasks can cause inconsistent state.

That intervention addresses suspended automation during maintenance, where Log collection and automated response are separate capabilities, and workflow suspension can create a response gap. In this question the necessary remedy is “Check the target state first and use supported bounded retries with idempotent action logic where possible”, which this alternative does not provide.

That intervention addresses incident triggered by event with inadequate confidence, where Automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. The observed condition is a network connector occasionally times out after sending a block command, and repeated blind retries create duplicate configuration entries; this mechanism addresses another problem.

Report output profile recipients can remain stale even when generated content and filters are correct. “Update the output profile to the approved distribution group and retest authorized recipient delivery” would remedy that alternative situation, but it would not correct the present issue: report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records.

“Use a supported macro tied to an appropriate query that returns the required summary value” is the supported response when a report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. Here the decisive response is “Verify Analytics log retention for the needed period and use a supported data reprocessing workflow if available”, so that different intervention does not meet the stated requirement.

Dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields. “Edit or clone the dataset for the appropriate security log type and test the query against known IPS events” applies to that other condition. The reported evidence is a monthly malware report returns no chart data although archived raw log files exist for the same period; this alternative would address the wrong dependency.

That intervention addresses output pdf versus csv recipient need, where A presentation-oriented report layout is not equivalent to a record-level export needed for data reconciliation. Here, the relevant failure is instead: Event occurrence time and log receipt time differ during buffering, and an inappropriate time field can shift daily totals.

That intervention addresses multiple chart templates share one dataset, where A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. In this question the necessary remedy is “Use the appropriate event-time field for the analytic question and check buffering delay in the dataset”, which this alternative does not provide.

That intervention addresses scheduled report timezone drift, where Scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. The observed condition is a report of attack activity during a WAN outage shows all delayed logs in the following day's chart when collector forwarding resumes; this mechanism addresses another problem.

Trigger conditions alone do not provide the required independent approval boundary for a disruptive change. “Route detection to an approval or manual on-demand response step and execute the blocking connector only after authorization” would remedy that alternative situation, but it would not correct the present issue: threat-centric and endpoint-centric views group the same underlying detections differently and serve distinct investigation pivots.

“Export the necessary playbook content with connector inclusion deliberately controlled and sanitized for the recipient” is the supported response when exporting automation definitions can expose integration details and requires review of embedded connectors or credential references. Here the decisive response is “Use the relevant endpoint-oriented event view or pivot by source host while retaining the threat indicator context”, so that different intervention does not meet the stated requirement.

Receiving external alert logs may require a suitable enabled event-collector handler to transform the ingested alert into an event. “Review the external event source and enable or tune the supported ingested-event handler and its scope” applies to that other condition. The reported evidence is an analyst sees botnet alerts in a threat view but cannot quickly identify all endpoints associated with that command server; this alternative would address the wrong dependency.