Fortinet FCP_FAZ_AN-7.6 Questions & Answers

High bandwidth volume alone does not prove malicious behavior and measures a different dimension from detections and security actions. “Correlate traffic utilization metrics with security detections before assigning incident severity” would remedy that alternative situation, but it would not correct the present issue: traffic session totals and security threat detections count different records, each requiring its own log subtype and metric.

“Monitor identity-field coverage and treat large sudden unknown-user increases as a telemetry quality signal” is the supported response when session logs cannot show authenticated user identity unless the relevant identity source and log fields are available and associated. Here the decisive response is “Label charts with the underlying log category and aggregation method before distributing risk summaries”, so that different intervention does not meet the stated requirement.

Destination IP totals do not reliably identify a detected application, especially when multiple services share hosting addresses. “Correlate application identity with traffic and destination fields rather than inferring apps from IPs alone” applies to that other condition. The reported evidence is the SOC interprets FortiView's high total traffic count as the number of detected attacks and overstates risk to executives; this alternative would address the wrong dependency.

That intervention addresses raw and formatted log representations, where Formatted log presentation can show selected parsed fields while raw messages preserve the full original key-value content. Here, the relevant failure is instead: A shared administrative identity prevents dependable change attribution and cannot enforce individual access privileges.

That intervention addresses fortianalyzer audit event gaps, where Firewall session telemetry is not the same evidence as administrative changes made directly on the analyzer appliance. In this question the necessary remedy is “Issue named administrator identities with appropriate SOC profiles and inspect administrative event logs”, which this alternative does not provide.

That intervention addresses log data source change after fortios upgrade, where Stored searches and parsers built for an older subtype schema may exclude the new message values. The observed condition is a shared investigation console has a generic elevated login, making it impossible to determine which operator changed analytics or event settings; this mechanism addresses another problem.

A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. “Clone the dataset for the department-specific change and repoint only the intended chart” would remedy that alternative situation, but it would not correct the present issue: event occurrence time and log receipt time differ during buffering, and an inappropriate time field can shift daily totals.

“Confirm the antivirus log source and category are enabled and verify fresh test data before retrying the report” is the supported response when report output cannot contain detections from log categories the originating devices did not generate or forward. Here the decisive response is “Use the appropriate event-time field for the analytic question and check buffering delay in the dataset”, so that different intervention does not meet the stated requirement.

Grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute. “Validate identity-source integration and user-field availability, then report unknown users explicitly rather than fabricating attribution” applies to that other condition. The reported evidence is a report of attack activity during a WAN outage shows all delayed logs in the following day's chart when collector forwarding resumes; this alternative would address the wrong dependency.

That intervention addresses fortiview device filter hides new branch, where A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. Here, the relevant failure is instead: A change in grouping, deduplication or severity filters can alter incident counts without altering the raw set of attempts.

That intervention addresses fortiview widget gray missing log types, where A widget may depend on a particular log category absent from the selected ADOM, not merely any available event messages. In this question the necessary remedy is “Compare query definitions, distinct event keys and the same source time range before explaining the trend”, which this alternative does not provide.

That intervention addresses suspicious internal lateral rdp attempts, where Broad internal management-port scanning can suggest lateral movement, but accepted sessions need distinct identity and server context. The observed condition is a monthly threat chart shows fewer incidents than the previous week, but the underlying unique attempted connections have not fallen; this mechanism addresses another problem.

Playbook task execution requires an authorized remote connector credential, not just a configured action name. “Rotate connector secrets safely and test high-impact actions after changes to the remote API account” would remedy that alternative situation, but it would not correct the present issue: a playbook definition can reference integrations that are absent or have different credentials in the destination environment.

“Maintain a connector capability inventory and check target-version support before importing playbooks” is the supported response when connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome. Here the decisive response is “Audit imported dependencies and avoid assuming playbook portability includes secrets or authorization”, so that different intervention does not meet the stated requirement.

Viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile. “Review automation execution roles and preserve least privilege during urgent incident response” applies to that other condition. The reported evidence is a SOC team imports a known-good playbook into a different ADOM but its tasks fail because required connectors were not imported or mapped; this alternative would address the wrong dependency.

New regional dashboards include the moved source in the correct region without changing source log records. This is a different failure mechanism from the current case, which concerns a new synthetic record of the affected subtype carries a usable destination field and matches the test rule.

This option instead describes post-upgrade test logs, event handlers, playbooks and key reports operate on the supported combination. Testing that independent mechanism would not show whether the reported fault has been resolved.

The partner can reproduce the event order from the same UTC reference without guessing the analyst's locale. The stem describes an alert rule compares normalized destination names, but after a parser update that field becomes empty for one incoming log subtype, so this explanation does not account for the observations.

That intervention addresses event handler false positive with scanning appliance, where Known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. Here, the relevant failure is instead: Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags.

That intervention addresses notification profile missing on handler, where Event generation does not itself prove a notification action is configured and connected to the correct handler. In this question the necessary remedy is “Assign the appropriate event view tags to the custom handler and verify its output classification”, which this alternative does not provide.

That intervention addresses incorrect event severity assignment, where Alert severity configured without business impact or enforcement outcome may distort incident response priorities. The observed condition is a custom malware handler generates events but they do not appear under the desired endpoint-oriented Event Monitor view; this mechanism addresses another problem.

ADOM separation restricts the inventory and data scope used by analytics and incident workflows by design. “Treat tenant isolation as a control, not a failure to fix by granting unrestricted global administrator access” would remedy that alternative situation, but it would not correct the present issue: destination configuration alone does not prove negotiated transport security or trusted endpoint identity.

“Check rotation policy and archival capacity under realistic peak logging loads” is the supported response when log file rollover behavior is distinct from event loss and must be evaluated against retained sequence and archive coverage. Here the decisive response is “Inspect transport security during branch onboarding and after certificates or firmware change”, so that different intervention does not meet the stated requirement.

Raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type. “Test an uncomplicated dataset against actual analytics data before customizing report layouts” applies to that other condition. The reported evidence is a security architect assumes that merely entering a FortiAnalyzer IP guarantees encrypted log traffic across an untrusted network; this alternative would address the wrong dependency.

The investigation returns sessions from only the intended virtual domain and policy identifiers map to that VDOM. This is a different failure mechanism from the current case, which concerns storage utilization improves while the required Analytics reporting period and compliant archive copies remain accessible.

This option instead describes the FortiGate logging connection becomes healthy and fresh log sequence timestamps advance after the ACL correction. Testing that independent mechanism would not show whether the reported fault has been resolved.

The relevant endpoint identity or security events can be correlated with network activity in the supported view. The stem describes a spike in traffic causes storage pressure and an operator wants to delete raw archive logs without understanding policy for analytics and reports, so this explanation does not account for the observations.

That intervention addresses endpoint inventory group used in investigation, where Different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies. Here, the relevant failure is instead: Event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome.

That intervention addresses case pivot by application control signature, where An application-level aggregate alone does not identify individual users or show which endpoints were affected. In this question the necessary remedy is “Use asset criticality, exposure, action and event evidence to set triage priority separately from source severity”, which this alternative does not provide.

That intervention addresses user entity analytics baseline change, where Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. The observed condition is a low-severity event has high business impact because it affects a privileged administrator, while a high-severity noisy signature is repeatedly blocked; this mechanism addresses another problem.

Views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. “Validate event routing to each operational queue when custom handlers change” would remedy that alternative situation, but it would not correct the present issue: MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds.

“Maintain expiring scanner exceptions tied to documented test windows and asset identity” is the supported response when known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. Here the decisive response is “Review both detection logic and ATT&CK labels during rule quality audits”, so that different intervention does not meet the stated requirement.

The event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption. “Test handler data selection against current source-to-ADOM inventory before enablement” applies to that other condition. The reported evidence is a detection engineer assigns a MITRE technique label to an event handler and expects matching attack events without creating log rules; this alternative would address the wrong dependency.