Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events. “Verify the FortiMail log source registration, permissions and event log pipeline into the correct ADOM” would remedy that alternative situation, but it would not correct the present issue: administrative domains isolate device inventory and associated log visibility, so the analyst's selected ADOM can exclude the logging source.

“Configure the supported FortiGate remote-logging destination and the appropriate logging policies and categories” is the supported response when a healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs. Here the decisive response is “Verify the source serial and correct ADOM membership or authorized ADOM selection without weakening tenant separation”, so that different intervention does not meet the stated requirement.

Remote log delivery requires the allowed protocol and destination path independently of ordinary user traffic forwarding. “Check the configured FortiAnalyzer logging transport and permit only the necessary branch-to-collector management path” applies to that other condition. The reported evidence is a managed FortiGate logs normally, yet a regional analyst sees no data because the source device was registered in a separate tenant ADOM; this alternative would address the wrong dependency.

That intervention addresses report generation diagnostics for empty chart, where A blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect. Here, the relevant failure is instead: Distinct asset counts and individual event message totals measure different populations and cannot be compared as equal.

That intervention addresses automated report schedule and storage budget, where Simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. In this question the necessary remedy is “Inspect the dataset grouping and aggregation and report both unique-host and total-event metrics with labels”, which this alternative does not provide.

That intervention addresses historical report reproducibility after changes, where A new report run can reflect current query and group definitions rather than the exact scope used for the earlier issued report. The observed condition is an analyst expects a chart's ten unique hosts to equal 300 related raw IDS log messages and calls the chart inaccurate; this mechanism addresses another problem.

A case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity. “Require source log references and explicit uncertainty in significant incident escalations” would remedy that alternative situation, but it would not correct the present issue: metadata in a security log does not imply the analyzer stores an accessible full copy of the transmitted payload.

“Use distinct-host counts and explicit observation counts for threat intelligence dashboards” is the supported response when one endpoint can generate many related DNS and HTTP observations for the same indicator across a short period. Here the decisive response is “Avoid promising file-content recovery from standard event logs without verifying actual sample collection”, so that different intervention does not meet the stated requirement.

An incident interval crossing midnight cannot be faithfully represented by a single daytime date bucket. “Use absolute incident windows in handoffs involving rotating shifts and timezone boundaries” applies to that other condition. The reported evidence is a legal team requests the original downloaded malicious binary from an antivirus log entry that contains only file name and hash metadata; this alternative would address the wrong dependency.

That intervention addresses saved search filter wrong boolean logic, where Combining mutually exclusive predicates with AND can eliminate matches that would satisfy a properly grouped OR condition. Here, the relevant failure is instead: Exported rows without their query context are insufficient to reproduce the exact event population.

That intervention addresses conflicting event order due time zone, where Unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays. In this question the necessary remedy is “Record the scoped Log View filter conditions and export metadata alongside the preserved rows”, which this alternative does not provide.

That intervention addresses incident escalation through related raw evidence, where A case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity. The observed condition is an analyst sends a CSV excerpt to another team but omits the ADOM, device and time filters used to produce it; this mechanism addresses another problem.

That intervention addresses report chart missing its dataset, where Charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records. Here, the relevant failure is instead: A saved report definition does not automatically run periodically unless its schedule and output settings are enabled.

That intervention addresses dataset time filter excludes reporting week, where An extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records. In this question the necessary remedy is “Set the intended report schedule and verified output profile, then test the next planned generation”, which this alternative does not provide.

That intervention addresses sql grouping double counts device sessions, where Counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host. The observed condition is an analyst creates an accurate FortiAnalyzer risk report but no copies are produced on Monday because the schedule was never activated; this mechanism addresses another problem.

The current incident status alone does not provide the full chronology of analyst actions and changes. “Protect case audit history and require named SOC accounts rather than shared logins” would remedy that alternative situation, but it would not correct the present issue: the event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption.

“Design escalation rules for unresolved high-severity incidents and automation errors” is the supported response when a failed mitigation increases unresolved risk and should not be treated as a completed incident response step. Here the decisive response is “Test handler data selection against current source-to-ADOM inventory before enablement”, so that different intervention does not meet the stated requirement.

Known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. “Maintain expiring scanner exceptions tied to documented test windows and asset identity” applies to that other condition. The reported evidence is a cloned handler is enabled in the headquarters ADOM but expected branch log messages are present only under the regional ADOM; this alternative would address the wrong dependency.

Event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome. “Document risk-based triage rules and review their effect on high-volume, low-impact alerts” would remedy that alternative situation, but it would not correct the present issue: distinct event handlers may match different features of one underlying host incident, so count of alerts is not count of compromises.

“Record planned automation behavior changes and periodically retune monitored baselines” is the supported response when behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. Here the decisive response is “Define clear event-to-incident grouping rules and allow later separation when evidence shows unrelated attacks”, so that different intervention does not meet the stated requirement.

A summary, cache or earlier export may survive after the underlying log records required for drilldown have expired. “Align investigation retention with summary caches and verify drilldown after changes to data policy” applies to that other condition. The reported evidence is the same compromised host triggers five related FortiAnalyzer event handlers and the analyst creates five unrelated case tickets; this alternative would address the wrong dependency.

That intervention addresses time synchronization for multi-device events, where Clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages. Here, the relevant failure is instead: A healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs.

That intervention addresses log transport path blocked by access rules, where Remote log delivery requires the allowed protocol and destination path independently of ordinary user traffic forwarding. In this question the necessary remedy is “Configure the supported FortiGate remote-logging destination and the appropriate logging policies and categories”, which this alternative does not provide.

That intervention addresses required traffic policy missing logging, where Traffic can match and be forwarded by a firewall policy even when session logging is disabled on that specific rule. The observed condition is the central analyzer is reachable, but a newly deployed FortiGate produces no traffic records after a policy change because remote log sending was never enabled; this mechanism addresses another problem.

That intervention addresses incident audit history used for accountability, where The current incident status alone does not provide the full chronology of analyst actions and changes. Here, the relevant failure is instead: A connector credential with broad external permissions can cross tenant boundaries even when incident visibility is ADOM-scoped.

That intervention addresses playbook job status versus actual mitigation, where Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. In this question the necessary remedy is “Use separate minimum-privilege connector credentials and explicit target-device validation for each ADOM”, which this alternative does not provide.

That intervention addresses playbook loops caused by response logs, where Response-generated events can feed back into the same broad trigger unless source or action context is excluded. The observed condition is a multi-tenant SOC accidentally configures an automation connector that can alter devices belonging to a different customer ADOM; this mechanism addresses another problem.

An IOC association can be provisional, and the wrong host can be targeted when addresses or inventory identifiers are stale. “Require identity validation and a reversible containment plan for automated high-impact actions” would remedy that alternative situation, but it would not correct the present issue: periodic connections may indicate command-and-control polling but also appear in legitimate update checks or monitoring agents.

“Maintain accurate asset classification and use it when interpreting user and entity analytics” is the supported response when different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies. Here the decisive response is “Correlate periodicity alerts with endpoint and threat intelligence context before escalation”, so that different intervention does not meet the stated requirement.

A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. “Use multi-stage timeline correlation to investigate unusual authentication followed by data movement” applies to that other condition. The reported evidence is an analyst suspects beaconing after seeing repeated small HTTPS sessions to the same external host at regular intervals; this alternative would address the wrong dependency.

That intervention addresses domain indicator expiration after cleanup, where Historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. Here, the relevant failure is instead: Hash equality identifies matching file content but does not alone establish when or how each endpoint obtained it.

That intervention addresses fortiview source filter on reused rfc1918 ranges, where The same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous. In this question the necessary remedy is “Group supported malware or endpoint logs by hash and correlate host, user, time and delivery method”, which this alternative does not provide.

That intervention addresses fortiguard ioc ip match shared infrastructure, where An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. The observed condition is the SOC finds an identical suspicious file hash on several endpoints and wants to know whether it represents a shared incident; this mechanism addresses another problem.