Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow. “Review rescan schedules and retention windows so investigative coverage does not depend on one-time ingestion matching” would remedy that alternative situation, but it would not correct the present issue: the replacement is a separate physical source identity, so device authorization and inventory associations can require updating.

“Recalculate EPS capacity with every large source expansion and include burst headroom in sizing” is the supported response when the sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works. Here the decisive response is “Include log source migration and historical identity continuity in the device replacement runbook”, so that different intervention does not meet the stated requirement.

Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. “Forecast ingestion rates and set escalating disk utilization alerts before critical thresholds” applies to that other condition. The reported evidence is a failed firewall is replaced under a new hardware serial and the SOC expects its replacement traffic to appear under the retired device without adjustment; this alternative would address the wrong dependency.

The investigation identifies each affected host and the chronology of observed file detections. This is a different failure mechanism from the current case, which concerns the report separately records the attack attempt, firewall mitigation and actual customer impact.

This option instead describes the investigation distinguishes a TLS trust failure from policy rejection or threat blocking. Testing that independent mechanism would not show whether the reported fault has been resolved.

The case distinguishes a delivered lure, a clicked URL and any blocked or successful follow-on connection. The stem describes a FortiGate records a flood-related anomaly toward a published service while the service team reports no customer-visible outage, so this explanation does not account for the observations.

Log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. “Check traffic-log generation, category selection and Log View filters rather than diagnosing a complete device outage” would remedy that alternative situation, but it would not correct the present issue: rollover and storage retention settings determine file availability, while report datasets require suitable Analytics log data.

“Compare receive rate, analytics processing and backlog indicators and scale or tune the supported ingestion pipeline” is the supported response when successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume. Here the decisive response is “Check analytics retention, available indexed logs and quota settings before promising historical report coverage”, so that different intervention does not meet the stated requirement.

Clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages. “Synchronize log sources and FortiAnalyzer with trusted time services and use consistent event-time interpretation” applies to that other condition. The reported evidence is during a storage review, an analyst assumes that setting a large archive quota guarantees reports can query months of historical data; this alternative would address the wrong dependency.

A predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. “Identify the relevant built-in detection handler and enable it with an appropriate rule and event scope” would remedy that alternative situation, but it would not correct the present issue: without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope.

“Choose the relevant VPN event logs and set filters against the actual authenticated user and outcome fields” is the supported response when a rule cannot match required authentication fields when its selected log source or subtype does not contain them. Here the decisive response is “Constrain the handler to the approved source devices and relevant authentication logs”, so that different intervention does not meet the stated requirement.

Predefined event handlers can restrict direct editing of their original configuration and are intended as reusable templates. “Clone the appropriate built-in handler and edit the supported rules, scope and thresholds in the custom copy” applies to that other condition. The reported evidence is a branch-only login alert begins firing for every firewall because the event handler lacks the intended device source constraint; this alternative would address the wrong dependency.

The widget becomes populated after suitable log data is ingested for the selected ADOM. This is a different failure mechanism from the current case, which concerns the field can be read on the relevant messages without changing the original stored log.

This option instead describes the team can distinguish newly visible detections from a genuine rise in threat attempts. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analyst explains why network policy allowed a session while a prohibited URL request was blocked. The stem describes an investigator receives a log containing an important application field, but the standard visible columns do not show it in the message list, so this explanation does not account for the observations.

HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity. “Verify the cluster member identifiers and expand approved searches to the appropriate HA source identity and period” would remedy that alternative situation, but it would not correct the present issue: historical threat hunts require suitable retained records, and discarding indexed logs reduces the evidence available to future searches.

“Analyze source event timestamps and receipt delay separately while retaining the queue and forwarding context” is the supported response when delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. Here the decisive response is “Estimate required retrospective hunt windows and adjust retention with approved archival or capacity measures first”, so that different intervention does not meet the stated requirement.

Successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. “Update the analyst's assigned administrative profile and permitted ADOM scope to the least necessary access” applies to that other condition. The reported evidence is the SOC is about to shorten analytics retention for an emergency disk cleanup while relying on threat hunting to investigate older campaigns; this alternative would address the wrong dependency.

The event appears in Event Monitor with the correct handler name after enabling. This is a different failure mechanism from the current case, which concerns a test unapproved indicator produces notification without blocking, while an approved case proceeds to enforcement.

This option instead describes the recipient can import the approved logic without receiving active production secrets or unintended device access. Testing that independent mechanism would not show whether the reported fault has been resolved.

The case identifies each observed affected endpoint linked to the same indicator and event evidence. The stem describes an organization requires a human-approved block decision before a FortiGate automation task may run on production traffic, so this explanation does not account for the observations.

Local collection may continue while the forwarding link is down, and upstream analysis has a freshness gap until forwarding resumes. “Restore the supported Collector-to-Analyzer path and validate backlog forwarding or recovery behavior” would remedy that alternative situation, but it would not correct the present issue: retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure.

“Configure an available IOC rescan policy for the supported log history and keep the threat database current” is the supported response when existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow. Here the decisive response is “Inspect disk quota and data policy status, then correct capacity, retention or priority settings within supported limits”, so that different intervention does not meet the stated requirement.

The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. “Register and authorize the new serial, assign the appropriate ADOM and preserve the retired unit's historical records” applies to that other condition. The reported evidence is fortiAnalyzer storage reaches its quota during a busy inspection week and the SOC finds gaps even though the edge firewall still sends logs; this alternative would address the wrong dependency.

A controlled traffic session appears in the correct traffic subtype while device event records remain separately available. This is a different failure mechanism from the current case, which concerns test events from both devices display a coherent sequence after clock and timezone corrections.

This option instead describes historical raw evidence remains accessible while a properly indexed test interval can populate a report query. Testing that independent mechanism would not show whether the reported fault has been resolved.

A historical report query succeeds only for periods with the required Analytics data and its scope is clearly documented. The stem describes a correlation search shows a VPN connection appearing after its follow-on attack even though the firewall and VPN gateway record related activity, so this explanation does not account for the observations.

Event occurrence time and log receipt time differ during buffering, and an inappropriate time field can shift daily totals. “Use the appropriate event-time field for the analytic question and check buffering delay in the dataset” would remedy that alternative situation, but it would not correct the present issue: report output cannot contain detections from log categories the originating devices did not generate or forward.

“Review report time zone, schedule and query period settings and test the boundary in a consistent reference time” is the supported response when scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. Here the decisive response is “Confirm the antivirus log source and category are enabled and verify fresh test data before retrying the report”, so that different intervention does not meet the stated requirement.

A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. “Clone the dataset for the department-specific change and repoint only the intended chart” applies to that other condition. The reported evidence is a weekly antivirus report generates successfully but is empty because endpoint security log generation was disabled upstream during maintenance; this alternative would address the wrong dependency.

A report cannot reconstruct events outside available indexed data solely by extending its date selector. “Align historical reporting commitments with retention policies and periodic restore drills” would remedy that alternative situation, but it would not correct the present issue: a new report run can reflect current query and group definitions rather than the exact scope used for the earlier issued report.

“Review report schedule concurrency and workload sizing after every major device-source increase” is the supported response when simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. Here the decisive response is “Archive report configuration and evidence provenance with each important compliance issuance”, so that different intervention does not meet the stated requirement.

A blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect. “Use data-source and query diagnostics as the first troubleshooting step for empty report visuals” applies to that other condition. The reported evidence is a compliance officer wants to reproduce a report from last quarter after its dataset and device group were modified recently; this alternative would address the wrong dependency.