Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type. “Verify the Analytics log availability, ADOM scope and relevant indexed log subtype before debugging the report template” would remedy that alternative situation, but it would not correct the present issue: log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry.

“Check analytics retention, available indexed logs and quota settings before promising historical report coverage” is the supported response when rollover and storage retention settings determine file availability, while report datasets require suitable Analytics log data. Here the decisive response is “Check traffic-log generation, category selection and Log View filters rather than diagnosing a complete device outage”, so that different intervention does not meet the stated requirement.

Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. “Verify the required time period in each storage tier and restore or reprocess logs through a supported analytics workflow if needed” applies to that other condition. The reported evidence is a SOC dashboard appears to lack firewall policy traffic while system event messages from the same FortiGate continue to arrive; this alternative would address the wrong dependency.

That intervention addresses fabric connector api permission boundary, where Connector reachability does not imply the remote API grants the specific permitted operations required for the SOC workflow. Here, the relevant failure is instead: Once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained.

That intervention addresses log record source device serial mismatch, where Imported historical records preserve their original source attributes rather than becoming new events produced by the replacement. In this question the necessary remedy is “Confirm available historical data and recover from a separately maintained compliant archive where technically supported”, which this alternative does not provide.

That intervention addresses log parser severity string mapping, where Producer-specific severity encodings may not map into the analyzer's normalized severity field without a suitable parser definition. The observed condition is a fraud investigator requests a 60-day historical timeline but the analyzer's retention policy was tuned for only two weeks; this mechanism addresses another problem.

Historical eligible records gain new indicator matches after a rescan with newer definitions. This is a different failure mechanism from the current case, which concerns regional log receipt remains documented and central queries show recovered events after the link is restored.

This option instead describes new test logs are retained reliably and storage alarms clear without silently discarding required compliance history. Testing that independent mechanism would not show whether the reported fault has been resolved.

New logs are attributed to the replacement while old evidence retains the original device serial. The stem describes a regional Collector records events locally but central investigations stop receiving the region's new events during a WAN outage, so this explanation does not account for the observations.

That intervention addresses unknown field in third-party syslog, where The collector can retain a message without automatically understanding every vendor-specific key or mapping it into expected normalized fields. Here, the relevant failure is instead: Incorrect parser time extraction can misplace otherwise ingested messages outside the investigator's selected event interval.

That intervention addresses security fabric source identity ambiguity, where Display names alone are not reliable unique log-source identities when device names can be duplicated or changed. In this question the necessary remedy is “Correct the compatible log parsing definition and validate timestamp format and timezone against known samples”, which this alternative does not provide.

That intervention addresses forticlient telemetry missing from soc view, where Network firewall events do not automatically include endpoint manager attributes when the required Fabric integration or feed is absent. The observed condition is an external appliance sends logs with a timestamp string that cannot be interpreted by the configured parser and time-window searches miss the incidents; this mechanism addresses another problem.

That intervention addresses mitre technique metadata does not trigger detection, where MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds. Here, the relevant failure is instead: The event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption.

That intervention addresses event handler false positive with scanning appliance, where Known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. In this question the necessary remedy is “Switch the analysis to the authorized branch ADOM or deploy a properly scoped handler there”, which this alternative does not provide.

That intervention addresses event alert tag not shared with investigation view, where Views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. The observed condition is a cloned handler is enabled in the headquarters ADOM but expected branch log messages are present only under the regional ADOM; this mechanism addresses another problem.

That intervention addresses traffic log action versus security profile action, where Firewall session policy acceptance and downstream security profile enforcement refer to different decisions in the traffic path. Here, the relevant failure is instead: A widget may depend on a particular log category absent from the selected ADOM, not merely any available event messages.

That intervention addresses fortiview top threat time spike, where Changes in log collection or security profile configuration can alter observed detection counts independently of real attack frequency. In this question the necessary remedy is “Inspect the widget's required log types and verify that the originating devices generate those categories”, which this alternative does not provide.

That intervention addresses custom log view column missing field, where The selected Log View column layout can hide fields that are present in underlying record details. The observed condition is a FortiView widget appears grayed out for one ADOM even though the SOC can see current device logins and system events; this mechanism addresses another problem.

A report content check verifies known detections are included in the appropriate section. This is a different failure mechanism from the current case, which concerns the generated chart shows the day of the spike and agrees with the underlying counts.

This option instead describes the regional totals exclude unrelated sources and reconcile to an independently scoped Log View search. Testing that independent mechanism would not show whether the reported fault has been resolved.

A known sample interval produces consistent dataset rows and chart totals after validation. The stem describes an analyst uses a pie chart for daily blocked-event counts and cannot communicate the sharp rise during one specific day, so this explanation does not account for the observations.

Live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated. “Require dry-run or isolated pilot evidence before enabling high-impact production playbooks” would remedy that alternative situation, but it would not correct the present issue: removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis.

“Monitor intelligence-feed age and distinguish historical matches from current reputation in playbooks” is the supported response when stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. Here the decisive response is “Separate evidence-retention policy from dashboard triage or noise management decisions”, so that different intervention does not meet the stated requirement.

Incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store. “Train responders to redact tokens from task logs and use approved secret references” applies to that other condition. The reported evidence is a responder proposes deleting noisy Event Monitor records after resolving an incident to keep dashboards uncluttered; this alternative would address the wrong dependency.

Only a test event matching the approved detection starts the containment workflow. This is a different failure mechanism from the current case, which concerns a new matching event remains visible and its email notification reaches the intended recipient.

This option instead describes the playbook starts on a matching incident and does not start merely from an untriaged raw event. Testing that independent mechanism would not show whether the reported fault has been resolved.

The execution monitor shows an explicitly initiated job with a recorded operator or source trigger. The stem describes the event handler is generating alerts, but email notifications stopped after an SMTP relay authentication change, so this explanation does not account for the observations.

That intervention addresses disabled security fabric data feed, where An enabled connector cannot manufacture telemetry that the originating device has stopped generating or forwarding. Here, the relevant failure is instead: Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive.

That intervention addresses wrong vdom context in records, where Device serial identity and VDOM identity are distinct dimensions; omitting VDOM context can combine unrelated policy and traffic records. In this question the necessary remedy is “Verify the relevant IOC licensing and FortiGuard content update status before troubleshooting unrelated network policy”, which this alternative does not provide.

That intervention addresses fortimail event enrichment missing, where Seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events. The observed condition is analysts expect FortiAnalyzer to identify indicators from current FortiGuard intelligence, but the subscription entitlement has expired; this mechanism addresses another problem.

That intervention addresses event handler duplicate severity routing, where Overlapping rules and notification routing can produce duplicated escalation for one underlying source event. Here, the relevant failure is instead: Log collection and automated response are separate capabilities, and workflow suspension can create a response gap.

That intervention addresses incident triggered by event with inadequate confidence, where Automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. In this question the necessary remedy is “Document the disabled automation window and restore or test the trigger and connectors after maintenance”, which this alternative does not provide.

That intervention addresses playbook task timeout and retry controls, where A timeout does not prove the remote action failed, so blindly repeating non-idempotent tasks can cause inconsistent state. The observed condition is a planned FortiAnalyzer upgrade disables an event-triggered workflow, but SOC coverage is assumed intact because log receipt continues; this mechanism addresses another problem.