Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A suppression kept beyond its legitimate time window can conceal subsequent security-relevant activity. “Use time-limited exceptions and alert on active suppressions that exceed the stated business reason” would remedy that alternative situation, but it would not correct the present issue: aggregating all failures globally instead of grouping by a relevant user key can manufacture a false account-centric pattern.

“Require peer review and expiration for high-impact event suppression changes” is the supported response when suppression criteria without precise identity and event scope can hide unrelated true-positive detections. Here the decisive response is “Validate aggregation keys with synthetic multi-user test records before enabling notifications”, so that different intervention does not meet the stated requirement.

Configuring a handler's rules is insufficient until the handler is enabled for event generation. “Include status checks and positive test evidence in detection deployment signoff” applies to that other condition. The reported evidence is a failed-login detector reaches its threshold across ten unrelated users and generates an account-compromise alert for one person; this alternative would address the wrong dependency.

That intervention addresses ioc subscription state and threat intelligence, where Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. Here, the relevant failure is instead: A change in producer field names or data types can invalidate saved SQL queries and parser mappings without stopping ingestion.

That intervention addresses wrong vdom context in records, where Device serial identity and VDOM identity are distinct dimensions; omitting VDOM context can combine unrelated policy and traffic records. In this question the necessary remedy is “Compare the current raw record with the normalized schema and update supported mapping or dataset references”, which this alternative does not provide.

That intervention addresses fortimail event enrichment missing, where Seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events. The observed condition is after enabling a new firmware log field, a custom SOC query produces empty values even though the raw log contains the updated key; this mechanism addresses another problem.

A proportion chart obscures chronological order, even when the dataset contains valid time-bucketed results. “Select visualization types based on the analytic question, not merely the template default” would remedy that alternative situation, but it would not correct the present issue: device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included.

“Align historical reporting commitments with retention policies and periodic restore drills” is the supported response when a report cannot reconstruct events outside available indexed data solely by extending its date selector. Here the decisive response is “Review device-group membership when organizational assignments or branch locations change”, so that different intervention does not meet the stated requirement.

An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. “Require a dataset fixture and source scope review before publishing custom report graphics” applies to that other condition. The reported evidence is a regional compliance report includes remote branches from another country because the source device group was too broad; this alternative would address the wrong dependency.

Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. “Monitor intelligence subscription renewal and update age alongside log collection health” would remedy that alternative situation, but it would not correct the present issue: successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain.

“Track delivery lag and preserve both timestamp interpretations in outage investigations” is the supported response when delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. Here the decisive response is “Test representative read-only analyst profiles after administrator and ADOM permissions are changed”, so that different intervention does not meet the stated requirement.

A completed backup job is not proof that the required stored log files are intact and recoverable for investigation. “Maintain periodic recovery drills and validate retention and access controls on backup copies” applies to that other condition. The reported evidence is an analyst can authenticate to the FortiAnalyzer GUI but the log search pane reports insufficient permission for one ADOM; this alternative would address the wrong dependency.

Predefined datasets are reusable built-in resources and are not edited or deleted like analyst-created custom datasets. “Track copied datasets and review downstream chart bindings before changes or deletion” would remedy that alternative situation, but it would not correct the present issue: a report cannot reconstruct events outside available indexed data solely by extending its date selector.

“Select visualization types based on the analytic question, not merely the template default” is the supported response when a proportion chart obscures chronological order, even when the dataset contains valid time-bucketed results. Here the decisive response is “Align historical reporting commitments with retention policies and periodic restore drills”, so that different intervention does not meet the stated requirement.

Device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included. “Review device-group membership when organizational assignments or branch locations change” applies to that other condition. The reported evidence is a quarterly report request spans ninety days but the indexed Analytics retention policy retains only the latest month; this alternative would address the wrong dependency.

A case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity. “Require source log references and explicit uncertainty in significant incident escalations” would remedy that alternative situation, but it would not correct the present issue: unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays.

“Include filter provenance and timestamp range in evidence export procedures” is the supported response when exported rows without their query context are insufficient to reproduce the exact event population. Here the decisive response is “Document the time basis in saved investigations and audit source clock health”, so that different intervention does not meet the stated requirement.

Reputation is a contextual risk indicator, not conclusive evidence that a particular session delivered a harmful payload. “Document intelligence confidence and require supporting behavioral evidence before broad containment” applies to that other condition. The reported evidence is an incident dashboard displays two detections an hour apart, but one device records UTC and the other local summertime; this alternative would address the wrong dependency.

Connection failure and security detection are different causes; a missing malware log cannot identify a TLS or certificate root cause. “Ensure certificate error diagnostics are available during SSL inspection change windows” would remedy that alternative situation, but it would not correct the present issue: a DoS or anomaly detection is not by itself evidence that the protected application became unavailable.

“Avoid correlating alerts solely by shared destination IP when domain and URL context exists” is the supported response when different hostnames or cached endpoints can share an IP and different security profiles evaluate different request fields. Here the decisive response is “Pair network DoS alerts with service health evidence before assigning outage severity”, so that different intervention does not meet the stated requirement.

Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. “Exercise multi-product phishing investigation with controlled sample events and source-aware searches” applies to that other condition. The reported evidence is a FortiGate records a flood-related anomaly toward a published service while the service team reports no customer-visible outage; this alternative would address the wrong dependency.

Dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields. “Edit or clone the dataset for the appropriate security log type and test the query against known IPS events” would remedy that alternative situation, but it would not correct the present issue: a new report run can reflect current query and group definitions rather than the exact scope used for the earlier issued report.

“Inspect the dataset grouping and aggregation and report both unique-host and total-event metrics with labels” is the supported response when distinct asset counts and individual event message totals measure different populations and cannot be compared as equal. Here the decisive response is “Retain versioned report definitions, dataset queries, source group membership and report output hashes for that period”, so that different intervention does not meet the stated requirement.

A blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect. “Examine report diagnostic logs and test the underlying dataset with the same device and period filters” applies to that other condition. The reported evidence is a compliance officer wants to reproduce a report from last quarter after its dataset and device group were modified recently; this alternative would address the wrong dependency.

That intervention addresses fortiview application usage attribution, where Destination IP totals do not reliably identify a detected application, especially when multiple services share hosting addresses. Here, the relevant failure is instead: Session logs cannot show authenticated user identity unless the relevant identity source and log fields are available and associated.

That intervention addresses fortiview dashboard time window mismatch, where FortiView widgets obey their selected time ranges and filters; a narrow current interval can omit legitimate historical records. In this question the necessary remedy is “Review the originating identity integration and log field coverage before drawing conclusions about anonymous use”, which this alternative does not provide.

That intervention addresses fortiview top sources by bandwidth, where High bandwidth volume alone does not prove malicious behavior and measures a different dimension from detections and security actions. The observed condition is a SOC report groups web traffic by user, but many otherwise valid sessions appear as unknown users after identity integration changes; this mechanism addresses another problem.

That intervention addresses correlation handler ordered security stages, where A simple event count does not establish the order or relationship of multiple steps required for an attack pattern. Here, the relevant failure is instead: Alert severity configured without business impact or enforcement outcome may distort incident response priorities.

That intervention addresses notification profile missing on handler, where Event generation does not itself prove a notification action is configured and connected to the correct handler. In this question the necessary remedy is “Review handler severity and asset criticality and adjust the rule or triage policy using documented evidence”, which this alternative does not provide.

That intervention addresses event monitor tag view misclassification, where Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. The observed condition is a noisy blocked scan triggers a critical incident while a privileged authentication anomaly is marked low without asset context; this mechanism addresses another problem.

Known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. “Maintain expiring scanner exceptions tied to documented test windows and asset identity” would remedy that alternative situation, but it would not correct the present issue: a failed mitigation increases unresolved risk and should not be treated as a completed incident response step.

“Test handler data selection against current source-to-ADOM inventory before enablement” is the supported response when the event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption. Here the decisive response is “Design escalation rules for unresolved high-severity incidents and automation errors”, so that different intervention does not meet the stated requirement.

MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds. “Review both detection logic and ATT&CK labels during rule quality audits” applies to that other condition. The reported evidence is an analyst launches automated containment, but the connector reports failure and the incident remains assigned to a low-priority queue; this alternative would address the wrong dependency.