Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The incident explicitly records the feed version, freshness and supporting present-day evidence. This is a different failure mechanism from the current case, which concerns a deliberate test blocks only the expected benign target and the reversal procedure restores baseline state.

This option instead describes the resolved case remains auditable and unrelated or future security events still appear normally. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident contains useful error evidence without revealing the credential, and the old token no longer works. The stem describes a new isolation playbook is evaluated against production infrastructure before anyone confirms its target selection and rollback plan, so this explanation does not account for the observations.

Display names alone are not reliable unique log-source identities when device names can be duplicated or changed. “Require unique inventory labels and validate immutable identifiers in cross-device correlation workflows” would remedy that alternative situation, but it would not correct the present issue: fabric connector API authentication and firewall log transport are separate dependencies; one can fail while the other works.

“Version and regression-test custom parsing rules whenever external products change their syslog schema” is the supported response when the collector can retain a message without automatically understanding every vendor-specific key or mapping it into expected normalized fields. Here the decisive response is “Include downstream Fabric connectors in token rotation plans and monitor each connector's health status”, so that different intervention does not meet the stated requirement.

Network firewall events do not automatically include endpoint manager attributes when the required Fabric integration or feed is absent. “Recheck endpoint integration after EMS policy, connector or tenant permission changes” applies to that other condition. The reported evidence is a SOC team rotates a service token on an integrated product and FortiAnalyzer stops enriching related findings despite continuing to receive firewall logs; this alternative would address the wrong dependency.

That intervention addresses multiple administrators editing shared log views, where A shared administrative identity prevents dependable change attribution and cannot enforce individual access privileges. Here, the relevant failure is instead: Device serial identity and VDOM identity are distinct dimensions; omitting VDOM context can combine unrelated policy and traffic records.

That intervention addresses ioc subscription state and threat intelligence, where Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. In this question the necessary remedy is “Filter or group logs by both the originating device and VDOM when reconstructing the specific tenant's traffic”, which this alternative does not provide.

That intervention addresses fortimail event enrichment missing, where Seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events. The observed condition is a multi-VDOM FortiGate appears as one physical device, but the analyst's investigation mixes traffic from two separate virtual domains; this mechanism addresses another problem.

A simulated timeout is resolved without duplicated blocks and the job records its eventual confirmed state. This is a different failure mechanism from the current case, which concerns weak isolated reputation matches remain reviewable events, while the defined strong pattern creates an incident.

This option instead describes a post-upgrade known test event triggers its expected playbook with task-level success. Testing that independent mechanism would not show whether the reported fault has been resolved.

A representative single detection generates the intended notification with consistent severity and ownership. The stem describes an automated incident workflow creates a critical case on every weak reputation hit and leaves responders with an unmanageable queue, so this explanation does not account for the observations.

Hard-coded notification recipients can become stale when case assignment or on-call ownership changes. “Audit notification target mappings as part of incident workflow and roster changes” would remedy that alternative situation, but it would not correct the present issue: a defined workflow and configured trigger do not execute automatically when the playbook is disabled.

“Tune time windows using realistic negative and positive sequences rather than a single artificial burst” is the supported response when a threshold and its observation interval jointly define what constitutes a detectable burst; too narrow a window can miss sustained patterns. Here the decisive response is “Use staged enablement and smoke tests following playbook imports and upgrades”, so that different intervention does not meet the stated requirement.

The current incident status alone does not provide the full chronology of analyst actions and changes. “Protect case audit history and require named SOC accounts rather than shared logins” applies to that other condition. The reported evidence is an imported playbook includes working connectors but never starts on qualifying events because it was left disabled as a precaution; this alternative would address the wrong dependency.

Dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields. “Validate source log types against report metrics before modifying visual layout or scheduling” would remedy that alternative situation, but it would not correct the present issue: a report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works.

“Test macro output types and source data independently from the report layout” is the supported response when a report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. Here the decisive response is “Record ADOM and source selection in recurring report configuration reviews”, so that different intervention does not meet the stated requirement.

Charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records. “Check dataset dependencies whenever copying report templates between environments” applies to that other condition. The reported evidence is a SOC manager runs a predefined threat summary and finds zero detections for a branch whose logs are visible to analysts under a different ADOM; this alternative would address the wrong dependency.

That intervention addresses historical ioc rescan after content updates, where Existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow. Here, the relevant failure is instead: The sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works.

That intervention addresses disk quota saturation and dropped logs, where Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. In this question the necessary remedy is “Measure traffic log arrival rates, choose a supported ingestion scale and adjust source logging scope or architecture accordingly”, which this alternative does not provide.

That intervention addresses log device registration after rma, where The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. The observed condition is an enterprise adds dozens of high-volume edge devices and event arrival rate overwhelms the current analytics service after onboarding; this mechanism addresses another problem.

Collector mode concentrates on receiving and forwarding or retaining logs and does not offer the full local analysis functions available in Analyzer mode. “Use an Analyzer-capable deployment for investigation and reporting, or forward logs from the Collector to its designated Analyzer” would remedy that alternative situation, but it would not correct the present issue: successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume.

“Check traffic-log generation, category selection and Log View filters rather than diagnosing a complete device outage” is the supported response when log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. Here the decisive response is “Compare receive rate, analytics processing and backlog indicators and scale or tune the supported ingestion pipeline”, so that different intervention does not meet the stated requirement.

Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. “Verify the required time period in each storage tier and restore or reprocess logs through a supported analytics workflow if needed” applies to that other condition. The reported evidence is fresh log packets appear in receiver statistics but FortiView graphs remain behind during a burst of traffic from several devices; this alternative would address the wrong dependency.

That intervention addresses user entity analytics baseline change, where Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. Here, the relevant failure is instead: Different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies.

That intervention addresses large transfer after unusual login, where A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. In this question the necessary remedy is “Filter or group supported endpoint records by known asset category and evaluate each against its appropriate baseline”, which this alternative does not provide.

That intervention addresses compromised host isolation hypothesis, where An IOC association can be provisional, and the wrong host can be targeted when addresses or inventory identifiers are stale. The observed condition is a SOC investigation includes employees and kiosk devices but applies the same risk expectation to both device categories; this mechanism addresses another problem.

That intervention addresses suppression remains after travel ends, where A suppression kept beyond its legitimate time window can conceal subsequent security-relevant activity. Here, the relevant failure is instead: Transient task output is not equivalent to documented incident evidence that can be reviewed later.

That intervention addresses security fabric connector wrong device target, where Even a valid response action fails to protect the intended path if it targets a device unrelated to the originating event. In this question the necessary remedy is “Configure a supported task or case action to record relevant enrichment and its source in the incident”, which this alternative does not provide.

That intervention addresses playbook action parameter wrong indicator type, where Connector actions require correctly typed parameters; URL, domain and IP indicators are not interchangeable inputs. The observed condition is an enrichment lookup returns useful reputation data during automation but the incident record does not preserve that information for the next shift; this mechanism addresses another problem.

A second analyst can rerun the query and reproduce the sampled events over the same retained interval. This is a different failure mechanism from the current case, which concerns the case separates denied probes from accepted RDP sessions supported by host authentication evidence.

This option instead describes a controlled log from the new branch appears in the expected summary after filter correction. Testing that independent mechanism would not show whether the reported fault has been resolved.

The report identifies the specific aggregation or filtering change responsible for the difference. The stem describes a workstation initiates RDP connections to many internal servers, with most attempts denied and a few accepted within minutes, so this explanation does not account for the observations.