Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. “Maintain separate Analytics and Archive retention requirements instead of treating all stored logs as equally searchable” would remedy that alternative situation, but it would not correct the present issue: successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume.

“Set monitoring thresholds for critical log categories independently of overall device log volume” is the supported response when log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. Here the decisive response is “Alert on indexing latency separately from raw log receipt and maintain ingestion headroom for bursts”, so that different intervention does not meet the stated requirement.

Clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages. “Monitor source clock offsets and document event-time versus receipt-time treatment during investigations” applies to that other condition. The reported evidence is fresh log packets appear in receiver statistics but FortiView graphs remain behind during a burst of traffic from several devices; this alternative would address the wrong dependency.

That intervention addresses intrusion event source and target reversal, where Directional address fields describe traffic endpoints; incident roles cannot be assigned correctly if source and target are reversed. Here, the relevant failure is instead: An application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions.

That intervention addresses file filter log versus antivirus diagnosis, where File filtering can block an object by its type without an antivirus malware verdict. In this question the necessary remedy is “Review the detected application, signature and policy action and test a precisely scoped permitted alternative if approved”, which this alternative does not provide.

That intervention addresses dlp event and evidence sufficiency, where A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. The observed condition is after enabling a new application-control signature set, a finance workflow stops and related FortiAnalyzer logs show a blocked application classification; this mechanism addresses another problem.

Reputation is a contextual risk indicator, not conclusive evidence that a particular session delivered a harmful payload. “Document intelligence confidence and require supporting behavioral evidence before broad containment” would remedy that alternative situation, but it would not correct the present issue: severity thresholds exclude all events below the chosen level regardless of their contextual investigative importance.

“Document the time basis in saved investigations and audit source clock health” is the supported response when unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays. Here the decisive response is “Avoid hardcoding Critical-only filters for exploratory hunts that span disparate log categories”, so that different intervention does not meet the stated requirement.

A case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity. “Require source log references and explicit uncertainty in significant incident escalations” applies to that other condition. The reported evidence is a suspicious campaign goes undetected because the analyst filters only Critical records while the relevant web filtering entries have a lower severity; this alternative would address the wrong dependency.

One controlled detection initiates one appropriate response sequence without a self-amplifying loop. This is a different failure mechanism from the current case, which concerns a controlled failure-then-success sequence triggers while an unrelated reverse order does not.

This option instead describes a test detection appears in the intended endpoint category and retains its original linked log. Testing that independent mechanism would not show whether the reported fault has been resolved.

Events from unrelated days no longer join while known genuine short-interval sequences still correlate. The stem describes an SOC rule must detect a failed login burst followed by one successful login rather than simply any two authentication events, so this explanation does not account for the observations.

Policy identifiers and configuration context must be interpreted against the configuration effective when the event was logged. “Confirm the historical policy identity and change timestamp before attributing a saved traffic event to the current rule text” would remedy that alternative situation, but it would not correct the present issue: a tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted.

“Inspect query name, DNS action and subsequent sessions to distinguish attempted lookup from successful command-channel access” is the supported response when DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP. Here the decisive response is “Join tunnel events with related traffic logs and check the intended application session and routing behavior”, so that different intervention does not meet the stated requirement.

A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. “Correlate VPN authentication logs by user, source address, outcome, time and any second-factor events” applies to that other condition. The reported evidence is an administrator sees a successful site-to-site VPN tunnel event and assumes application traffic crossed it successfully; this alternative would address the wrong dependency.

A suppression kept beyond its legitimate time window can conceal subsequent security-relevant activity. “Use time-limited exceptions and alert on active suppressions that exceed the stated business reason” would remedy that alternative situation, but it would not correct the present issue: a case without evidence-backed affected-asset context cannot be reliably routed or validated during response.

“Design event-correlation and case-deduplication practices around asset, time and indicator context” is the supported response when overlapping detections may describe one underlying host investigation rather than independent incidents. Here the decisive response is “Require asset identification and supporting event links in incident intake templates”, so that different intervention does not meet the stated requirement.

Absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily. “Enforce a closure checklist that distinguishes quiet telemetry from confirmed resolution” applies to that other condition. The reported evidence is a security operator creates an incident from an alert but does not record the device, user or endpoint affected, confusing response ownership; this alternative would address the wrong dependency.

Traffic can match and be forwarded by a firewall policy even when session logging is disabled on that specific rule. “Audit logging settings on new firewall policies instead of assuming that remote logging is globally sufficient” would remedy that alternative situation, but it would not correct the present issue: administrative domains isolate device inventory and associated log visibility, so the analyst's selected ADOM can exclude the logging source.

“Review newly discovered devices and reconcile serial numbers against the approved branch onboarding register” is the supported response when receiving a connection is not equivalent to authorizing the device and assigning its logs to the expected administrative domain. Here the decisive response is “Include ADOM placement and analyst role checks in the device onboarding acceptance test”, so that different intervention does not meet the stated requirement.

A healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs. “Test originating log generation as well as collector reachability whenever installing a new gateway” applies to that other condition. The reported evidence is a managed FortiGate logs normally, yet a regional analyst sees no data because the source device was registered in a separate tenant ADOM; this alternative would address the wrong dependency.

The investigation returns sessions from only the intended virtual domain and policy identifiers map to that VDOM. This is a different failure mechanism from the current case, which concerns a known test security event appears in both raw Log View and the appropriate analytic view after restoring generation.

This option instead describes new records populate the intended normalized field while unaffected log categories still parse correctly. Testing that independent mechanism would not show whether the reported fault has been resolved.

Current threat intelligence updates resume and supported log indicators can be inspected with the new definitions. The stem describes a Security Fabric integration is configured, yet a planned threat hunting view lacks telemetry after a source-side log category was disabled, so this explanation does not account for the observations.

Editing a shared baseline template can alter multiple reports or remove a known-good rollback point. “Clone the appropriate report or template and change the cloned layout for the specific audience” would remedy that alternative situation, but it would not correct the present issue: a blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect.

“Stagger schedules or reduce duplicate jobs and tune supported caching or dataset scope within reporting needs” is the supported response when simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. Here the decisive response is “Examine report diagnostic logs and test the underlying dataset with the same device and period filters”, so that different intervention does not meet the stated requirement.

Distinct asset counts and individual event message totals measure different populations and cannot be compared as equal. “Inspect the dataset grouping and aggregation and report both unique-host and total-event metrics with labels” applies to that other condition. The reported evidence is a security report's threat chart displays no rows, and the analyst starts redesigning the template before checking query execution; this alternative would address the wrong dependency.

Generation success does not prove the dataset query returned the expected source records or that the content is substantively correct. “Pair report delivery monitoring with substantive output quality checks for important reports” would remedy that alternative situation, but it would not correct the present issue: a saved report definition does not automatically run periodically unless its schedule and output settings are enabled.

“Monitor report delivery errors independently of generation completion status” is the supported response when successful report generation and successful email delivery are separate stages with independent transport dependencies. Here the decisive response is “Review recurrence and owner notification settings after creating or cloning reports”, so that different intervention does not meet the stated requirement.

Predefined datasets are reusable built-in resources and are not edited or deleted like analyst-created custom datasets. “Track copied datasets and review downstream chart bindings before changes or deletion” applies to that other condition. The reported evidence is an analyst creates an accurate FortiAnalyzer risk report but no copies are produced on Monday because the schedule was never activated; this alternative would address the wrong dependency.

That intervention addresses indicators across dns and web traffic, where One endpoint can generate many related DNS and HTTP observations for the same indicator across a short period. Here, the relevant failure is instead: Connection duration alone may include idle time and is not identical to end-user application response latency.

That intervention addresses file extraction from log metadata limitation, where Metadata in a security log does not imply the analyzer stores an accessible full copy of the transmitted payload. In this question the necessary remedy is “Correlate the session with application performance telemetry or suitable timing fields instead of using duration as latency”, which this alternative does not provide.

That intervention addresses log time filter excluding overnight shift, where An incident interval crossing midnight cannot be faithfully represented by a single daytime date bucket. The observed condition is a web session appears to last several minutes and an analyst claims its application response time was equally slow; this mechanism addresses another problem.