Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The recipient can import the approved logic without receiving active production secrets or unintended device access. This is a different failure mechanism from the current case, which concerns the case identifies each observed affected endpoint linked to the same indicator and event evidence.

This option instead describes a sample external alert appears as a traceable event with its original source identifier. Testing that independent mechanism would not show whether the reported fault has been resolved.

A test unapproved indicator produces notification without blocking, while an approved case proceeds to enforcement. The stem describes an analyst sees botnet alerts in a threat view but cannot quickly identify all endpoints associated with that command server, so this explanation does not account for the observations.

Failures for distinct users are separated and a burst against one target meets the correct rule threshold. This is a different failure mechanism from the current case, which concerns new matching anomalies after the trip generate normal events while historical audit remains intact.

This option instead describes the event appears in Event Monitor with the correct handler name after enabling. Testing that independent mechanism would not show whether the reported fault has been resolved.

Matching benign maintenance events are suppressed while unrelated security events still generate alerts. The stem describes a temporary impossible-travel exception was set for an employee's international trip but still hides later suspicious logins, so this explanation does not account for the observations.

The current incident status alone does not provide the full chronology of analyst actions and changes. “Review the supported incident audit history and relevant administrative event records for each change” would remedy that alternative situation, but it would not correct the present issue: a predefined handler can contain several rules, and disabling the full handler removes detection coverage beyond one unwanted rule.

“Review dependencies and tests, then enable the approved playbook and confirm its runtime status” is the supported response when a defined workflow and configured trigger do not execute automatically when the playbook is disabled. Here the decisive response is “Review the handler's component rules and tune or selectively disable only the problematic rule when supported”, so that different intervention does not meet the stated requirement.

A threshold and its observation interval jointly define what constitutes a detectable burst; too narrow a window can miss sustained patterns. “Choose a window aligned with the attack hypothesis and test both distributed and benign failure schedules” applies to that other condition. The reported evidence is an operator disables an entire predefined event handler to silence one noisy subrule, unexpectedly removing several other useful detections; this alternative would address the wrong dependency.

A second analyst can rerun the query and reproduce the sampled events over the same retained interval. This is a different failure mechanism from the current case, which concerns the known paired test events fall in the expected order after consistent time conversion.

This option instead describes the analyst can reconstruct a documented event sequence from original entries rather than summary labels alone. Testing that independent mechanism would not show whether the reported fault has been resolved.

Known campaign test records are returned without interpreting a lower severity as proof of harmlessness. The stem describes an incident dashboard displays two detections an hour apart, but one device records UTC and the other local summertime, so this explanation does not account for the observations.

A new matching event remains visible and its email notification reaches the intended recipient. This is a different failure mechanism from the current case, which concerns only a test event matching the approved detection starts the containment workflow.

This option instead describes the execution monitor shows an explicitly initiated job with a recorded operator or source trigger. Testing that independent mechanism would not show whether the reported fault has been resolved.

The firewall action runs only after the lookup returns the expected indicator and required approval checks pass. The stem describes a newly enabled playbook runs containment tasks for every event, including routine system alerts, because no event-trigger filter was set, so this explanation does not account for the observations.

Long-lived flows can contribute usage across report windows, and time aggregation does not necessarily correspond to new session creation. “Inspect raw session start, end and duration fields and the widget's aggregation method” would remedy that alternative situation, but it would not correct the present issue: an IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target.

“Compare session counts, sent and received bytes, applications and time range for each candidate host” is the supported response when many short low-volume sessions can outnumber fewer high-volume sessions, so count and byte volume are distinct metrics. Here the decisive response is “Examine IPS action, signature, traffic session context and supporting endpoint or server events”, so that different intervention does not meet the stated requirement.

A shared signature ID is not proof that every alert targets the same asset or represents the same attacker session. “Group events by signature, target, source, action and time before comparing campaign characteristics” applies to that other condition. The reported evidence is a FortiGate IPS log records a high-severity signature match, and the SOC announces confirmed compromise without checking the action or server evidence; this alternative would address the wrong dependency.

Product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. “Create a recovery plan and preflight version compatibility for each connected source and integration” would remedy that alternative situation, but it would not correct the present issue: the same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata.

“Troubleshoot collection and analytics as separate layers and alert on each independently” is the supported response when a disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. Here the decisive response is “Annotate evidence exports with time zone and source clock assumptions in the chain-of-custody process”, so that different intervention does not meet the stated requirement.

An alert dependent on parsed fields can stop matching when the parser schema or producer keys change. “Maintain parser-to-alert dependency tests and monitor for sudden field null-rate changes” applies to that other condition. The reported evidence is an investigator exports filtered events for a partner working in UTC and fails to record whether the displayed time is local console time; this alternative would address the wrong dependency.

Log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. “Set monitoring thresholds for critical log categories independently of overall device log volume” would remedy that alternative situation, but it would not correct the present issue: rollover and storage retention settings determine file availability, while report datasets require suitable Analytics log data.

“Maintain separate Analytics and Archive retention requirements instead of treating all stored logs as equally searchable” is the supported response when archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. Here the decisive response is “Capacity-plan indexed and archived log storage separately with measured daily ingestion rates”, so that different intervention does not meet the stated requirement.

Successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume. “Alert on indexing latency separately from raw log receipt and maintain ingestion headroom for bursts” applies to that other condition. The reported evidence is during a storage review, an analyst assumes that setting a large archive quota guarantees reports can query months of historical data; this alternative would address the wrong dependency.

That intervention addresses macro references missing field alias, where A macro expects a defined dataset field, and alias changes can break the reference even when the SQL returns data. Here, the relevant failure is instead: A technically valid report can expose sensitive log attributes when output fields and recipients exceed authorized need.

That intervention addresses report cover page displays old dates, where Static layout text and dynamically computed report period fields are different sources of metadata. In this question the necessary remedy is “Limit the dataset fields and output profile to the approved audience and data-minimization requirements”, which this alternative does not provide.

That intervention addresses table chart sorts top threats incorrectly, where The sort order determines the displayed ranking, and an inverse ORDER BY can misrepresent a top-N claim. The observed condition is a scheduled report includes user identities and internal hostnames but is sent broadly to an external distribution list; this mechanism addresses another problem.

That intervention addresses report uses received rather than event time, where Event occurrence time and log receipt time differ during buffering, and an inappropriate time field can shift daily totals. Here, the relevant failure is instead: A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query.

That intervention addresses scheduled report timezone drift, where Scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. In this question the necessary remedy is “Clone the dataset for the department-specific change and repoint only the intended chart”, which this alternative does not provide.

That intervention addresses report group-by user with unknown identities, where Grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute. The observed condition is several reports use a common custom dataset, and a change for one department unexpectedly modifies charts in all other reports; this mechanism addresses another problem.

That intervention addresses collector mode mistaken for analysis mode, where Collector mode concentrates on receiving and forwarding or retaining logs and does not offer the full local analysis functions available in Analyzer mode. Here, the relevant failure is instead: An overly broad ADOM assignment breaks the logical security boundary even when device logging and database storage are otherwise functioning.

That intervention addresses analyzer collector downstream topology, where The collection tier and the analytics tier can hold different operational functions and storage responsibilities in a distributed deployment. In this question the necessary remedy is “Restrict the administrator's ADOM assignments and privileges to the authorized tenant and test effective access”, which this alternative does not provide.

That intervention addresses fabric adom for expanded soc analytics, where Some FortiAnalyzer SOC analytics functions depend on a Fabric ADOM and its configured log sources, not merely a licensed user account. The observed condition is a partner analyst who should see only one customer's logs can switch into other customers' ADOMs because the administrative profile was too broad; this mechanism addresses another problem.