Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses macro references missing field alias, where A macro expects a defined dataset field, and alias changes can break the reference even when the SQL returns data. Here, the relevant failure is instead: The sort order determines the displayed ranking, and an inverse ORDER BY can misrepresent a top-N claim.

That intervention addresses confidential information in report columns, where A technically valid report can expose sensitive log attributes when output fields and recipients exceed authorized need. In this question the necessary remedy is “Correct the dataset's grouping and descending count sort while checking its limit and tie handling”, which this alternative does not provide.

That intervention addresses output pdf versus csv recipient need, where A presentation-oriented report layout is not equivalent to a record-level export needed for data reconciliation. The observed condition is a report called Top Threats lists low-count signatures first because a customized dataset sorts ascending rather than descending; this mechanism addresses another problem.

That intervention addresses event monitor tag view misclassification, where Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. Here, the relevant failure is instead: A historical IP address may no longer identify the affected endpoint at the moment of automated containment.

That intervention addresses basic event source filter too broad, where Without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope. In this question the necessary remedy is “Revalidate current identity and address ownership before applying a reversible block on the proper enforcement device”, which this alternative does not provide.

That intervention addresses playbook configuration change audit, where A small Boolean condition change can greatly alter automation scope and must be treated as a privileged response-policy change. The observed condition is a delayed incident playbook blocks the IP address once used by a compromised laptop even though DHCP has reassigned it to an unrelated server; this mechanism addresses another problem.

That intervention addresses fortianalyzer firmware compatibility planning, where Product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. Here, the relevant failure is instead: A disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally.

That intervention addresses device group membership stale after relocation, where Log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation. In this question the necessary remedy is “Check the feature's enablement, deployment mode and required indexed logs separately from raw ingestion”, which this alternative does not provide.

That intervention addresses parser update changes alert field availability, where An alert dependent on parsed fields can stop matching when the parser schema or producer keys change. The observed condition is an operator assumes missing FortiView data proves the FortiGate has stopped logging, but Log View still shows current raw records; this mechanism addresses another problem.

Changes in log collection or security profile configuration can alter observed detection counts independently of real attack frequency. “Annotate security dashboard baselines with logging and signature change events” would remedy that alternative situation, but it would not correct the present issue: event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome.

“Retain user attribution and sample affected sessions during major application-control rule changes” is the supported response when an application-level aggregate alone does not identify individual users or show which endpoints were affected. Here the decisive response is “Document risk-based triage rules and review their effect on high-volume, low-impact alerts”, so that different intervention does not meet the stated requirement.

Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. “Record planned automation behavior changes and periodically retune monitored baselines” applies to that other condition. The reported evidence is a low-severity event has high business impact because it affects a privileged administrator, while a high-severity noisy signature is repeatedly blocked; this alternative would address the wrong dependency.

The responsible policy and representative underlying sessions are identified for the selected spike. This is a different failure mechanism from the current case, which concerns a specific internal client is mapped to the observed external connection without conflating other users.

This option instead describes the analysis isolates any malicious domains or abnormal users without classifying the entire CDN address as hostile. Testing that independent mechanism would not show whether the reported fault has been resolved.

A configuration audit aligns the event's policy field with the correct policy revision at the incident time. The stem describes an alert contains an Internet-facing translated IP address shared by many internal clients, and the analyst wants the responsible workstation, so this explanation does not account for the observations.

Destination configuration alone does not prove negotiated transport security or trusted endpoint identity. “Inspect transport security during branch onboarding and after certificates or firmware change” would remedy that alternative situation, but it would not correct the present issue: raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type.

“Keep a device rename history and favor immutable identifiers in incident correlation and evidence export” is the supported response when hostname changes do not necessarily change underlying device serial identity but can make name-only searches incomplete. Here the decisive response is “Test an uncomplicated dataset against actual analytics data before customizing report layouts”, so that different intervention does not meet the stated requirement.

Log file rollover behavior is distinct from event loss and must be evaluated against retained sequence and archive coverage. “Check rotation policy and archival capacity under realistic peak logging loads” applies to that other condition. The reported evidence is after successful log collection, a new report remains empty because the appliance is retaining raw archives but lacks the expected Analytics dataset; this alternative would address the wrong dependency.

Exported rows without their query context are insufficient to reproduce the exact event population. “Record the scoped Log View filter conditions and export metadata alongside the preserved rows” would remedy that alternative situation, but it would not correct the present issue: a case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity.

“Combine source reputation with action, application, destination and related detections before choosing response” is the supported response when reputation is a contextual risk indicator, not conclusive evidence that a particular session delivered a harmful payload. Here the decisive response is “Open related logs from the incident and examine host, account, source, destination and precise timing for each stage”, so that different intervention does not meet the stated requirement.

Unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays. “Normalize source timestamps to one standard and check the device clock and daylight saving settings” applies to that other condition. The reported evidence is a senior analyst receives a high-level incident summary but cannot verify the alleged lateral movement because the linked raw events are not included; this alternative would address the wrong dependency.

Automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. “Tune event filters and automatic incident creation criteria to focus on actionable validated detections” would remedy that alternative situation, but it would not correct the present issue: overlapping detections may describe one underlying host investigation rather than independent incidents.

“Enable the supported Automatically Create Incident option for the appropriate high-confidence event handler” is the supported response when an event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled. Here the decisive response is “Link related events and, where appropriate, consolidate into a single case with separate supporting indicators”, so that different intervention does not meet the stated requirement.

A reassigned incident can lose context when notes, evidence and executed actions are not retained within its audit history. “Attach the source logs, timeline, prior decisions and playbook action results to the incident before reassignment” applies to that other condition. The reported evidence is several event handlers detect suspicious file hashes and DNS lookups on the same host within minutes, generating separate cases; this alternative would address the wrong dependency.

Events at the beginning and end of the intended week are included exactly once in the query. This is a different failure mechanism from the current case, which concerns the report task history shows a successful scheduled run with the correct date window.

This option instead describes a test output profile sends a generated report to the approved recipient without changing the dataset. Testing that independent mechanism would not show whether the reported fault has been resolved.

The custom query returns the required results and unrelated built-in reports continue using their original dataset. The stem describes an analyst creates an accurate FortiAnalyzer risk report but no copies are produced on Monday because the schedule was never activated, so this explanation does not account for the observations.

A completed backup job is not proof that the required stored log files are intact and recoverable for investigation. “Perform a controlled restore of representative log archives into a supported isolated investigation workflow” would remedy that alternative situation, but it would not correct the present issue: successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain.

“Verify the cluster member identifiers and expand approved searches to the appropriate HA source identity and period” is the supported response when HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity. Here the decisive response is “Update the analyst's assigned administrative profile and permitted ADOM scope to the least necessary access”, so that different intervention does not meet the stated requirement.

Historical threat hunts require suitable retained records, and discarding indexed logs reduces the evidence available to future searches. “Estimate required retrospective hunt windows and adjust retention with approved archival or capacity measures first” applies to that other condition. The reported evidence is an analyst can authenticate to the FortiAnalyzer GUI but the log search pane reports insufficient permission for one ADOM; this alternative would address the wrong dependency.

Existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow. “Review rescan schedules and retention windows so investigative coverage does not depend on one-time ingestion matching” would remedy that alternative situation, but it would not correct the present issue: the replacement is a separate physical source identity, so device authorization and inventory associations can require updating.

“Recalculate EPS capacity with every large source expansion and include burst headroom in sizing” is the supported response when the sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works. Here the decisive response is “Include log source migration and historical identity continuity in the device replacement runbook”, so that different intervention does not meet the stated requirement.

Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. “Forecast ingestion rates and set escalating disk utilization alerts before critical thresholds” applies to that other condition. The reported evidence is a failed firewall is replaced under a new hardware serial and the SOC expects its replacement traffic to appear under the retired device without adjustment; this alternative would address the wrong dependency.