Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses top destination anomaly with cdn, where A shared CDN endpoint can serve many unrelated legitimate web services, so destination frequency alone cannot establish malicious purpose. Here, the relevant failure is instead: Policy identifiers and configuration context must be interpreted against the configuration effective when the event was logged.

That intervention addresses drilling from summary into log detail, where Aggregated visual summaries omit some record-level fields needed to explain the exact policy decision. In this question the necessary remedy is “Confirm the historical policy identity and change timestamp before attributing a saved traffic event to the current rule text”, which this alternative does not provide.

That intervention addresses denied traffic action interpretation, where A denied traffic action records a blocked attempt rather than confirmation of successful permitted access or compromise. The observed condition is an investigator concludes policy 27 caused an event today using the current firewall rule list, although administrators reordered policies yesterday; this mechanism addresses another problem.

A reassigned incident can lose context when notes, evidence and executed actions are not retained within its audit history. “Attach the source logs, timeline, prior decisions and playbook action results to the incident before reassignment” would remedy that alternative situation, but it would not correct the present issue: absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily.

“Link related events and, where appropriate, consolidate into a single case with separate supporting indicators” is the supported response when overlapping detections may describe one underlying host investigation rather than independent incidents. Here the decisive response is “Review linked evidence, containment actions and independent remediation checks before moving the incident to closed state”, so that different intervention does not meet the stated requirement.

A case without evidence-backed affected-asset context cannot be reliably routed or validated during response. “Populate the incident with linked event evidence and the identified affected host or identity before assignment” applies to that other condition. The reported evidence is a case is closed after an IOC alarm quiets down but no one checks whether the compromised host was actually remediated; this alternative would address the wrong dependency.

The final event list includes pre- and post-midnight records from the same investigative interval. This is a different failure mechanism from the current case, which concerns the case records the filtered domain and shows whether any network connection followed the DNS decision.

This option instead describes the application shows an allowed session over the correct tunnel, not merely a healthy control-plane exchange. Testing that independent mechanism would not show whether the reported fault has been resolved.

The administrator can explain the block and evaluate a narrow approved exception against the real policy. The stem describes a workstation repeatedly resolves a suspected command-and-control domain and FortiAnalyzer receives DNS filter detections with replacement responses, so this explanation does not account for the observations.

That intervention addresses incident evidence preserved during event suppression, where Suppressing future duplicate alerts does not replace the need to retain source logs and prior event evidence. Here, the relevant failure is instead: Trigger conditions alone do not provide the required independent approval boundary for a disruptive change.

That intervention addresses playbook export includes sensitive connector references, where Exporting automation definitions can expose integration details and requires review of embedded connectors or credential references. In this question the necessary remedy is “Route detection to an approval or manual on-demand response step and execute the blocking connector only after authorization”, which this alternative does not provide.

That intervention addresses event monitor endpoint and threat grouping, where Threat-centric and endpoint-centric views group the same underlying detections differently and serve distinct investigation pivots. The observed condition is an organization requires a human-approved block decision before a FortiGate automation task may run on production traffic; this mechanism addresses another problem.

ADOM separation restricts the inventory and data scope used by analytics and incident workflows by design. “Use a deliberately authorized cross-domain reporting design or run scoped analysis within each ADOM as policy allows” would remedy that alternative situation, but it would not correct the present issue: raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type.

“Use the supported secured Fortinet logging transport and verify certificate or authenticated channel settings where required” is the supported response when destination configuration alone does not prove negotiated transport security or trusted endpoint identity. Here the decisive response is “Verify the Analytics log availability, ADOM scope and relevant indexed log subtype before debugging the report template”, so that different intervention does not meet the stated requirement.

Log file rollover behavior is distinct from event loss and must be evaluated against retained sequence and archive coverage. “Inspect rollover settings and archive file continuity alongside received log counts for the impacted interval” applies to that other condition. The reported evidence is after successful log collection, a new report remains empty because the appliance is retaining raw archives but lacks the expected Analytics dataset; this alternative would address the wrong dependency.

The sort order determines the displayed ranking, and an inverse ORDER BY can misrepresent a top-N claim. “Correct the dataset's grouping and descending count sort while checking its limit and tie handling” would remedy that alternative situation, but it would not correct the present issue: static layout text and dynamically computed report period fields are different sources of metadata.

“Provide a supported structured dataset or filtered log export alongside the report with approved source and field scope” is the supported response when a presentation-oriented report layout is not equivalent to a record-level export needed for data reconciliation. Here the decisive response is “Replace stale manually typed date text with the supported report period field or update the layout correctly”, so that different intervention does not meet the stated requirement.

A technically valid report can expose sensitive log attributes when output fields and recipients exceed authorized need. “Limit the dataset fields and output profile to the approved audience and data-minimization requirements” applies to that other condition. The reported evidence is after a report schedule is moved to a new month, the cover page still displays a hard-coded prior month despite current chart data; this alternative would address the wrong dependency.

The resulting test alerts are prioritized consistently with the stated risk rules. This is a different failure mechanism from the current case, which concerns the case preserves both evidence streams and one coordinated response plan for the verified host.

This option instead describes the receiving analyst can reconstruct prior work without repeating intrusive containment actions. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident references the correct asset and raw detections, allowing an authorized analyst to continue the investigation. The stem describes several event handlers detect suspicious file hashes and DNS lookups on the same host within minutes, generating separate cases, so this explanation does not account for the observations.

Hard-coded notification recipients can become stale when case assignment or on-call ownership changes. “Use approved current routing details for case notifications and test delivery to the new owner” would remedy that alternative situation, but it would not correct the present issue: a defined workflow and configured trigger do not execute automatically when the playbook is disabled.

“Review the supported incident audit history and relevant administrative event records for each change” is the supported response when the current incident status alone does not provide the full chronology of analyst actions and changes. Here the decisive response is “Review dependencies and tests, then enable the approved playbook and confirm its runtime status”, so that different intervention does not meet the stated requirement.

A threshold and its observation interval jointly define what constitutes a detectable burst; too narrow a window can miss sustained patterns. “Choose a window aligned with the attack hypothesis and test both distributed and benign failure schedules” applies to that other condition. The reported evidence is an imported playbook includes working connectors but never starts on qualifying events because it was left disabled as a precaution; this alternative would address the wrong dependency.

That intervention addresses fortiview dashboard time window mismatch, where FortiView widgets obey their selected time ranges and filters; a narrow current interval can omit legitimate historical records. Here, the relevant failure is instead: Traffic session totals and security threat detections count different records, each requiring its own log subtype and metric.

That intervention addresses fortiview user identity empty for sessions, where Session logs cannot show authenticated user identity unless the relevant identity source and log fields are available and associated. In this question the necessary remedy is “Select a threats-focused dashboard and validate detections against underlying IPS, antivirus or other security logs”, which this alternative does not provide.

That intervention addresses fortiview application usage attribution, where Destination IP totals do not reliably identify a detected application, especially when multiple services share hosting addresses. The observed condition is the SOC interprets FortiView's high total traffic count as the number of detected attacks and overstates risk to executives; this mechanism addresses another problem.

That intervention addresses incident reassignment with missing handoff, where A reassigned incident can lose context when notes, evidence and executed actions are not retained within its audit history. Here, the relevant failure is instead: An event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled.

That intervention addresses incident status closed prematurely, where Absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily. In this question the necessary remedy is “Enable the supported Automatically Create Incident option for the appropriate high-confidence event handler”, which this alternative does not provide.

That intervention addresses incident grouping after multiple related alerts, where Overlapping detections may describe one underlying host investigation rather than independent incidents. The observed condition is a high-confidence detection appears in Event Monitor, but the incident queue remains empty despite the team expecting a new case; this mechanism addresses another problem.

Delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. “Analyze source event timestamps and receipt delay separately while retaining the queue and forwarding context” would remedy that alternative situation, but it would not correct the present issue: a completed backup job is not proof that the required stored log files are intact and recoverable for investigation.

“Estimate required retrospective hunt windows and adjust retention with approved archival or capacity measures first” is the supported response when historical threat hunts require suitable retained records, and discarding indexed logs reduces the evidence available to future searches. Here the decisive response is “Perform a controlled restore of representative log archives into a supported isolated investigation workflow”, so that different intervention does not meet the stated requirement.

HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity. “Verify the cluster member identifiers and expand approved searches to the appropriate HA source identity and period” applies to that other condition. The reported evidence is the security team schedules a daily backup of analytics evidence but never validates that an archived log set can actually be read; this alternative would address the wrong dependency.