Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A second analyst can rerun the query and reproduce the sampled events over the same retained interval. This is a different failure mechanism from the current case, which concerns the case separates denied probes from accepted RDP sessions supported by host authentication evidence.

This option instead describes a controlled log from the new branch appears in the expected summary after filter correction. Testing that independent mechanism would not show whether the reported fault has been resolved.

The report identifies the specific aggregation or filtering change responsible for the difference. The stem describes a workstation initiates RDP connections to many internal servers, with most attempts denied and a few accepted within minutes, so this explanation does not account for the observations.

Remote log delivery requires the allowed protocol and destination path independently of ordinary user traffic forwarding. “Track collector transport dependencies in network-change testing and alert on silent collection loss” would remedy that alternative situation, but it would not correct the present issue: traffic can match and be forwarded by a firewall policy even when session logging is disabled on that specific rule.

“Test originating log generation as well as collector reachability whenever installing a new gateway” is the supported response when a healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs. Here the decisive response is “Audit logging settings on new firewall policies instead of assuming that remote logging is globally sufficient”, so that different intervention does not meet the stated requirement.

Receiving a connection is not equivalent to authorizing the device and assigning its logs to the expected administrative domain. “Review newly discovered devices and reconcile serial numbers against the approved branch onboarding register” applies to that other condition. The reported evidence is a critical FortiGate policy forwards Internet traffic but sends no session entries to FortiAnalyzer while other policies produce records normally; this alternative would address the wrong dependency.

The affected users are identified with matching application-control event IDs and times. This is a different failure mechanism from the current case, which concerns the analyst prioritizes the privileged anomaly appropriately without altering the raw event severity field.

This option instead describes the incident includes all relevant alerts while the case record avoids counting duplicate impact. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident notes which summary data exists and which record-level evidence can no longer be reproduced. The stem describes a low-severity event has high business impact because it affects a privileged administrator, while a high-severity noisy signature is repeatedly blocked, so this explanation does not account for the observations.

Once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained. “Confirm available historical data and recover from a separately maintained compliant archive where technically supported” would remedy that alternative situation, but it would not correct the present issue: queries without appropriate source restrictions can combine multiple devices that share the same private IP addresses.

“Grant the minimal supported API permissions for the needed read operation and retest connector action authorization” is the supported response when connector reachability does not imply the remote API grants the specific permitted operations required for the SOC workflow. Here the decisive response is “Constrain the investigation to the intended serials, VDOMs and ADOM before interpreting IP-based correlation”, so that different intervention does not meet the stated requirement.

Producer-specific severity encodings may not map into the analyzer's normalized severity field without a suitable parser definition. “Inspect representative raw severity values and align the supported parser mapping to the intended normalized scale” applies to that other condition. The reported evidence is an investigator runs a saved query without selecting its intended device group and mistakenly attributes unrelated events to one branch; this alternative would address the wrong dependency.

MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds. “Review both detection logic and ATT&CK labels during rule quality audits” would remedy that alternative situation, but it would not correct the present issue: views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard.

“Maintain expiring scanner exceptions tied to documented test windows and asset identity” is the supported response when known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. Here the decisive response is “Validate event routing to each operational queue when custom handlers change”, so that different intervention does not meet the stated requirement.

A failed mitigation increases unresolved risk and should not be treated as a completed incident response step. “Design escalation rules for unresolved high-severity incidents and automation errors” applies to that other condition. The reported evidence is a custom threat event fires correctly but is absent from the team's saved Event Monitor threat view; this alternative would address the wrong dependency.

That intervention addresses external ingested event handling, where Receiving external alert logs may require a suitable enabled event-collector handler to transform the ingested alert into an event. Here, the relevant failure is instead: Exporting automation definitions can expose integration details and requires review of embedded connectors or credential references.

That intervention addresses incident evidence preserved during event suppression, where Suppressing future duplicate alerts does not replace the need to retain source logs and prior event evidence. In this question the necessary remedy is “Export the necessary playbook content with connector inclusion deliberately controlled and sanitized for the recipient”, which this alternative does not provide.

That intervention addresses playbook sequence after successful approval, where Trigger conditions alone do not provide the required independent approval boundary for a disruptive change. The observed condition is an analyst exports a working playbook to share externally without checking the included connector information and its destination environment; this mechanism addresses another problem.

That intervention addresses email attachment lure and web pivot, where Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. Here, the relevant failure is instead: Different hostnames or cached endpoints can share an IP and different security profiles evaluate different request fields.

That intervention addresses failed web requests caused by certificate error, where Connection failure and security detection are different causes; a missing malware log cannot identify a TLS or certificate root cause. In this question the necessary remedy is “Compare queried hostname, web Host or URL fields, addresses, times and profile actions before asserting a bypass”, which this alternative does not provide.

That intervention addresses dos detection and actual service availability, where A DoS or anomaly detection is not by itself evidence that the protected application became unavailable. The observed condition is the DNS filter blocks a suspicious hostname, but a web-filter dashboard shows a permitted request to a different hostname at the same IP; this mechanism addresses another problem.

Events from unrelated days no longer join while known genuine short-interval sequences still correlate. This is a different failure mechanism from the current case, which concerns a qualifying test event produces an alert and an on-call notification with the correct source context.

This option instead describes a test detection appears in the intended endpoint category and retains its original linked log. Testing that independent mechanism would not show whether the reported fault has been resolved.

The resulting test alerts are prioritized consistently with the stated risk rules. The stem describes a serious event is visible in Event Monitor but the on-call team receives no email despite expecting notification, so this explanation does not account for the observations.

Simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. “Review report schedule concurrency and workload sizing after every major device-source increase” would remedy that alternative situation, but it would not correct the present issue: expensive broad SQL queries and report concurrency can exceed the available analytics processing resources.

“Document cache-refresh steps in report testing and track dataset revision timestamps” is the supported response when report caching can reuse prepared results rather than recomputing every query immediately under all conditions. Here the decisive response is “Profile expensive datasets and monitor scheduled report concurrency before monthly deadlines”, so that different intervention does not meet the stated requirement.

Generation success does not prove the dataset query returned the expected source records or that the content is substantively correct. “Pair report delivery monitoring with substantive output quality checks for important reports” applies to that other condition. The reported evidence is a large monthly dataset repeatedly times out during generation while smaller reports still complete normally; this alternative would address the wrong dependency.

A configuration audit aligns the event's policy field with the correct policy revision at the incident time. This is a different failure mechanism from the current case, which concerns the matching historical events appear with timestamps inside the selected incident window.

This option instead describes the top application and contributing hosts can be traced to original session records in the chosen interval. Testing that independent mechanism would not show whether the reported fault has been resolved.

The reported threat total agrees with the relevant detection records instead of all accepted sessions. The stem describes an analyst sees no data in a FortiView widget while another investigator has screenshots of yesterday's event in the same ADOM, so this explanation does not account for the observations.

Current threat intelligence updates resume and supported log indicators can be inspected with the new definitions. This is a different failure mechanism from the current case, which concerns a historical report query succeeds only for periods with the required Analytics data and its scope is clearly documented.

This option instead describes the analytics backlog reduces and newly received test traffic appears in FortiView within the expected interval. Testing that independent mechanism would not show whether the reported fault has been resolved.

Test events from both devices display a coherent sequence after clock and timezone corrections. The stem describes during a storage review, an analyst assumes that setting a large archive quota guarantees reports can query months of historical data, so this explanation does not account for the observations.