Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses domain indicator expiration after cleanup, where Historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. Here, the relevant failure is instead: Hash equality identifies matching file content but does not alone establish when or how each endpoint obtained it.

That intervention addresses fortiview source filter on reused rfc1918 ranges, where The same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous. In this question the necessary remedy is “Group supported malware or endpoint logs by hash and correlate host, user, time and delivery method”, which this alternative does not provide.

That intervention addresses fortiguard ioc ip match shared infrastructure, where An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. The observed condition is the SOC finds an identical suspicious file hash on several endpoints and wants to know whether it represents a shared incident; this mechanism addresses another problem.

That intervention addresses fortiview top sources by bandwidth, where High bandwidth volume alone does not prove malicious behavior and measures a different dimension from detections and security actions. Here, the relevant failure is instead: Connection failure and security detection are different causes; a missing malware log cannot identify a TLS or certificate root cause.

That intervention addresses email attachment lure and web pivot, where Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. In this question the necessary remedy is “Correlate the relevant traffic action, SSL inspection events and certificate validation diagnostics when logged”, which this alternative does not provide.

That intervention addresses dos detection and actual service availability, where A DoS or anomaly detection is not by itself evidence that the protected application became unavailable. The observed condition is an application exhibits failed HTTPS sessions, and a security analyst sees generic traffic denies but no malware detections; this mechanism addresses another problem.

A connector credential with broad external permissions can cross tenant boundaries even when incident visibility is ADOM-scoped. “Use separate minimum-privilege connector credentials and explicit target-device validation for each ADOM” would remedy that alternative situation, but it would not correct the present issue: downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds.

“Audit rule overlap, notification profiles and explicit escalation ownership to select the correct route” is the supported response when overlapping rules and notification routing can produce duplicated escalation for one underlying source event. Here the decisive response is “Validate the required indicator field and route empty results to manual review or a safe no-action branch”, so that different intervention does not meet the stated requirement.

Log collection and automated response are separate capabilities, and workflow suspension can create a response gap. “Document the disabled automation window and restore or test the trigger and connectors after maintenance” applies to that other condition. The reported evidence is an indicator-enrichment task sometimes returns no IP address and the next task tries to create a firewall object named with an empty string; this alternative would address the wrong dependency.

That intervention addresses excessive failed admin authentication, where A pattern of failed authentications can indicate brute-force activity even when no login has succeeded. Here, the relevant failure is instead: Directional address fields describe traffic endpoints; incident roles cannot be assigned correctly if source and target are reversed.

That intervention addresses application-control category blocked, where An application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions. In this question the necessary remedy is “Inspect source and destination fields, network zones, policy direction and signatures for the original log records”, which this alternative does not provide.

That intervention addresses dlp event and evidence sufficiency, where A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. The observed condition is an IPS dashboard shows source and destination addresses, but the analyst mistakenly treats the protected server's destination as the attacking endpoint; this mechanism addresses another problem.

An IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target. “Require corroboration for claims of successful exploitation and preserve the original IPS log record” would remedy that alternative situation, but it would not correct the present issue: an antivirus detection identifies a suspicious object, but the configured security action determines whether delivery was blocked or allowed.

“Specify whether each anomaly rule measures connections, bytes, duration or security events” is the supported response when many short low-volume sessions can outnumber fewer high-volume sessions, so count and byte volume are distinct metrics. Here the decisive response is “Record the response action and endpoint evidence for every significant malware detection”, so that different intervention does not meet the stated requirement.

Long-lived flows can contribute usage across report windows, and time aggregation does not necessarily correspond to new session creation. “Document session-boundary assumptions before comparing analytics buckets to connection counts” applies to that other condition. The reported evidence is a security analyst finds a malware-detection event on a download and wants to know whether the file reached the endpoint; this alternative would address the wrong dependency.

That intervention addresses logging health with clustered fortigate devices, where HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity. Here, the relevant failure is instead: The collection tier and the analytics tier can hold different operational functions and storage responsibilities in a distributed deployment.

That intervention addresses incorrect tenant administrator permissions, where An overly broad ADOM assignment breaks the logical security boundary even when device logging and database storage are otherwise functioning. In this question the necessary remedy is “Trace the configured collector-to-Analyzer forwarding path and run investigations on the intended analysis instance”, which this alternative does not provide.

That intervention addresses fabric adom for expanded soc analytics, where Some FortiAnalyzer SOC analytics functions depend on a Fabric ADOM and its configured log sources, not merely a licensed user account. The observed condition is a multi-region design forwards branch logs through regional collectors, but analysts mistakenly search a collector that only relays data to a central Analyzer; this mechanism addresses another problem.

Response-generated events can feed back into the same broad trigger unless source or action context is excluded. “Model automation feedback paths and test repeat-trigger behavior before production enablement” would remedy that alternative situation, but it would not correct the present issue: low-confidence indicators and uncertain identity make irreversible or disruptive automated actions unsafe without additional validation.

“Audit connector targets and remote API scopes during every cross-tenant automation rollout” is the supported response when a connector credential with broad external permissions can cross tenant boundaries even when incident visibility is ADOM-scoped. Here the decisive response is “Separate detection confidence from containment authority and maintain reversible response runbooks”, so that different intervention does not meet the stated requirement.

Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. “Require destination-state verification for high-impact automation rather than relying on a green job icon alone” applies to that other condition. The reported evidence is the SOC proposes automatically isolating every endpoint matched by a low-confidence IOC, including servers hosting critical workloads; this alternative would address the wrong dependency.

An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. “Require a dataset fixture and source scope review before publishing custom report graphics” would remedy that alternative situation, but it would not correct the present issue: a technically valid report can expose sensitive log attributes when output fields and recipients exceed authorized need.

“Treat SQL aliases as interfaces and regression-test macros before deploying dataset changes” is the supported response when a macro expects a defined dataset field, and alias changes can break the reference even when the SQL returns data. Here the decisive response is “Review report content classification and recipient access before enabling unattended distribution”, so that different intervention does not meet the stated requirement.

Static layout text and dynamically computed report period fields are different sources of metadata. “Check cover pages and headers as well as chart content before distributing periodic reports” applies to that other condition. The reported evidence is a scheduled report includes user identities and internal hostnames but is sent broadly to an external distribution list; this alternative would address the wrong dependency.

That intervention addresses administrator login from unexpected country, where IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof. Here, the relevant failure is instead: A category-based web-filter policy can block a site even without an identified malware signature.

That intervention addresses ssl vpn login failure burst, where A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. In this question the necessary remedy is “Inspect the web-filter category, action, matching policy and exact requested hostname before proposing an exception”, which this alternative does not provide.

That intervention addresses vpn tunnel establishment versus use, where A tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted. The observed condition is a user reports that a legitimate research website is inaccessible and FortiAnalyzer shows several blocked web filter messages for that domain; this mechanism addresses another problem.

The report clearly identifies which dates contain verifiable data and any coverage gaps. This is a different failure mechanism from the current case, which concerns a test period counts events exactly once across the transition with clearly labeled local or UTC time.

This option instead describes known test users appear under their identities while truly unmatched sessions retain an unknown bucket. Testing that independent mechanism would not show whether the reported fault has been resolved.

The revised department report changes while other reports retain their previous validated results. The stem describes a daily report scheduled for midnight omits or duplicates one hour of traffic during a local daylight saving transition, so this explanation does not account for the observations.

Configuring a handler's rules is insufficient until the handler is enabled for event generation. “Enable the handler, confirm its status, and replay a known qualifying log under authorized testing conditions” would remedy that alternative situation, but it would not correct the present issue: incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store.

“Preserve required source records and use the supported case status and targeted suppression workflow as appropriate” is the supported response when removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis. Here the decisive response is “Remove exposed credential material from the case, rotate the affected secret and replace it with redacted diagnostic context”, so that different intervention does not meet the stated requirement.

An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. “Link the relevant observed log field, time and source to the indicator record and case narrative” applies to that other condition. The reported evidence is a responder pastes full connector API credentials into an incident comment while documenting a failed automation run; this alternative would address the wrong dependency.