Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily. “Enforce a closure checklist that distinguishes quiet telemetry from confirmed resolution” would remedy that alternative situation, but it would not correct the present issue: a reassigned incident can lose context when notes, evidence and executed actions are not retained within its audit history.

“Require asset identification and supporting event links in incident intake templates” is the supported response when a case without evidence-backed affected-asset context cannot be reliably routed or validated during response. Here the decisive response is “Use a standardized case handoff format and maintain incident audit history”, so that different intervention does not meet the stated requirement.

Overlapping detections may describe one underlying host investigation rather than independent incidents. “Design event-correlation and case-deduplication practices around asset, time and indicator context” applies to that other condition. The reported evidence is an analyst transfers a malware case to the endpoint team without preserving the investigations and tools already run; this alternative would address the wrong dependency.

Successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume. “Alert on indexing latency separately from raw log receipt and maintain ingestion headroom for bursts” would remedy that alternative situation, but it would not correct the present issue: existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow.

“Recalculate EPS capacity with every large source expansion and include burst headroom in sizing” is the supported response when the sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works. Here the decisive response is “Review rescan schedules and retention windows so investigative coverage does not depend on one-time ingestion matching”, so that different intervention does not meet the stated requirement.

Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. “Forecast ingestion rates and set escalating disk utilization alerts before critical thresholds” applies to that other condition. The reported evidence is an investigator wants to apply newly received threat intelligence to last week's stored traffic, but only yesterday's previously flagged indicators appear; this alternative would address the wrong dependency.

Transient task output is not equivalent to documented incident evidence that can be reviewed later. “Record source, confidence and retrieval time for data used in automated incident decisions” would remedy that alternative situation, but it would not correct the present issue: playbook task execution requires an authorized remote connector credential, not just a configured action name.

“Audit imported dependencies and avoid assuming playbook portability includes secrets or authorization” is the supported response when a playbook definition can reference integrations that are absent or have different credentials in the destination environment. Here the decisive response is “Rotate connector secrets safely and test high-impact actions after changes to the remote API account”, so that different intervention does not meet the stated requirement.

Viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile. “Review automation execution roles and preserve least privilege during urgent incident response” applies to that other condition. The reported evidence is a FortiOS connector is online in the UI but a configured quarantine action fails immediately after its API credential was revoked; this alternative would address the wrong dependency.

A historical report query succeeds only for periods with the required Analytics data and its scope is clearly documented. This is a different failure mechanism from the current case, which concerns historical raw evidence remains accessible while a properly indexed test interval can populate a report query.

This option instead describes test events from both devices display a coherent sequence after clock and timezone corrections. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analytics backlog reduces and newly received test traffic appears in FortiView within the expected interval. The stem describes a compliance analyst finds older raw messages in archive storage but cannot use them in a recent SQL-backed report after analytics retention expired, so this explanation does not account for the observations.

The case records the filtered domain and shows whether any network connection followed the DNS decision. This is a different failure mechanism from the current case, which concerns the SOC can quantify attempts and identify whether authentication ever succeeded during the test window.

This option instead describes the workflow's test traffic matches the intended application handling without an unrestricted service exception. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident accurately states whether a transfer attempt was blocked, monitored or successfully completed. The stem describes fortiAnalyzer appliance event logs show repeated failed GUI logins for the same admin identity from a single untrusted address, so this explanation does not account for the observations.

Without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope. “Constrain the handler to the approved source devices and relevant authentication logs” would remedy that alternative situation, but it would not correct the present issue: a predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection.

“Choose the relevant VPN event logs and set filters against the actual authenticated user and outcome fields” is the supported response when a rule cannot match required authentication fields when its selected log source or subtype does not contain them. Here the decisive response is “Identify the relevant built-in detection handler and enable it with an appropriate rule and event scope”, so that different intervention does not meet the stated requirement.

A single denied connection is insufficient evidence for a multi-attempt scan and yields excessive false-positive events. “Configure an appropriate occurrence threshold and time window grouped by source and target as supported” applies to that other condition. The reported evidence is a SOC dashboard's compromised-host view stops updating even though Log View still shows fresh botnet-related traffic records from the same FortiGate; this alternative would address the wrong dependency.

A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. “Use multi-stage timeline correlation to investigate unusual authentication followed by data movement” would remedy that alternative situation, but it would not correct the present issue: an IOC association can be provisional, and the wrong host can be targeted when addresses or inventory identifiers are stale.

“Maintain a planned change calendar when baselining network and application flow anomalies” is the supported response when destination concentration can result from legitimate DNS or routing changes, not necessarily a newly targeted malicious server. Here the decisive response is “Require identity validation and a reversible containment plan for automated high-impact actions”, so that different intervention does not meet the stated requirement.

Different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies. “Maintain accurate asset classification and use it when interpreting user and entity analytics” applies to that other condition. The reported evidence is fortiAnalyzer flags an endpoint as potentially compromised after IOC matches, and an operator wants to isolate it immediately without validating identity; this alternative would address the wrong dependency.

The report distinguishes elapsed session lifetime from measured application response time. This is a different failure mechanism from the current case, which concerns the affected users are identified with matching application-control event IDs and times.

This option instead describes the incident includes all relevant alerts while the case record avoids counting duplicate impact. Testing that independent mechanism would not show whether the reported fault has been resolved.

The case distinguishes the authorized routine change from unauthorized identity use using supporting records. The stem describes a policy owner asks which users were affected by one newly blocked application signature during a scheduled change, so this explanation does not account for the observations.

Firewall session policy acceptance and downstream security profile enforcement refer to different decisions in the traffic path. “Correlate the traffic session with its profile log and interpret the specific web-filter enforcement” would remedy that alternative situation, but it would not correct the present issue: distinct event handlers may match different features of one underlying host incident, so count of alerts is not count of compromises.

“Correlate the anomaly with the approved job, identity, endpoints and data volume to confirm or challenge its explanation” is the supported response when behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. Here the decisive response is “Correlate by host, indicator, time and event context before grouping into one evidence-backed case”, so that different intervention does not meet the stated requirement.

Event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome. “Use asset criticality, exposure, action and event evidence to set triage priority separately from source severity” applies to that other condition. The reported evidence is the same compromised host triggers five related FortiAnalyzer event handlers and the analyst creates five unrelated case tickets; this alternative would address the wrong dependency.

Device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included. “Review device-group membership when organizational assignments or branch locations change” would remedy that alternative situation, but it would not correct the present issue: report output profile recipients can remain stale even when generated content and filters are correct.

“Select visualization types based on the analytic question, not merely the template default” is the supported response when a proportion chart obscures chronological order, even when the dataset contains valid time-bucketed results. Here the decisive response is “Require recipient and sensitivity review for every report template or output-profile clone”, so that different intervention does not meet the stated requirement.

A report cannot reconstruct events outside available indexed data solely by extending its date selector. “Align historical reporting commitments with retention policies and periodic restore drills” applies to that other condition. The reported evidence is a regulated operations report is emailed to the wrong department after an old distribution list was copied from another template; this alternative would address the wrong dependency.

A controlled changed dataset yields the expected updated chart after cache handling is corrected. This is a different failure mechanism from the current case, which concerns the cover period agrees with the actual dataset interval across a test scheduled report.

This option instead describes the summary text prints the intended computed value from the current dataset. Testing that independent mechanism would not show whether the reported fault has been resolved.

Known high-count signatures appear before lower-count detections in the report table. The stem describes after a report schedule is moved to a new month, the cover page still displays a hard-coded prior month despite current chart data, so this explanation does not account for the observations.