Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Configuring a handler's rules is insufficient until the handler is enabled for event generation. “Enable the handler, confirm its status, and replay a known qualifying log under authorized testing conditions” would remedy that alternative situation, but it would not correct the present issue: incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store.

“Preserve required source records and use the supported case status and targeted suppression workflow as appropriate” is the supported response when removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis. Here the decisive response is “Remove exposed credential material from the case, rotate the affected secret and replace it with redacted diagnostic context”, so that different intervention does not meet the stated requirement.

An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. “Link the relevant observed log field, time and source to the indicator record and case narrative” applies to that other condition. The reported evidence is a responder pastes full connector API credentials into an incident comment while documenting a failed automation run; this alternative would address the wrong dependency.

Incorrect parser time extraction can misplace otherwise ingested messages outside the investigator's selected event interval. “Correct the compatible log parsing definition and validate timestamp format and timezone against known samples” would remedy that alternative situation, but it would not correct the present issue: log file rollover behavior is distinct from event loss and must be evaluated against retained sequence and archive coverage.

“Use the supported secured Fortinet logging transport and verify certificate or authenticated channel settings where required” is the supported response when destination configuration alone does not prove negotiated transport security or trusted endpoint identity. Here the decisive response is “Inspect rollover settings and archive file continuity alongside received log counts for the impacted interval”, so that different intervention does not meet the stated requirement.

Raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type. “Verify the Analytics log availability, ADOM scope and relevant indexed log subtype before debugging the report template” applies to that other condition. The reported evidence is a branch log archive rotates rapidly during a traffic storm and analysts mistake the larger number of smaller files for missing events; this alternative would address the wrong dependency.

A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. “Build account-centric authentication alerts with success-after-failures logic and contextual enrichment” would remedy that alternative situation, but it would not correct the present issue: a DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted.

“Separate file-policy and malware investigations when designing alert explanations” is the supported response when file filtering can block an object by its type without an antivirus malware verdict. Here the decisive response is “Avoid overstating data loss without action and destination evidence in DLP incident summaries”, so that different intervention does not meet the stated requirement.

An application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions. “Review application classification changes with business owners after signature and policy updates” applies to that other condition. The reported evidence is a DLP rule reports a sensitive-file upload, but the case owner assumes the whole document was exfiltrated before inspecting the action; this alternative would address the wrong dependency.

That intervention addresses fortimail event enrichment missing, where Seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events. Here, the relevant failure is instead: An enabled connector cannot manufacture telemetry that the originating device has stopped generating or forwarding.

That intervention addresses unsupported log fields in normalizer, where A change in producer field names or data types can invalidate saved SQL queries and parser mappings without stopping ingestion. In this question the necessary remedy is “Inspect source-side category settings and the data collection path for the log types required by the chosen SOC feature”, which this alternative does not provide.

That intervention addresses ioc subscription state and threat intelligence, where Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. The observed condition is a Security Fabric integration is configured, yet a planned threat hunting view lacks telemetry after a source-side log category was disabled; this mechanism addresses another problem.

Even a valid response action fails to protect the intended path if it targets a device unrelated to the originating event. “Resolve the source device and authorized enforcement gateway from the alert context before selecting the response connector” would remedy that alternative situation, but it would not correct the present issue: local automation privileges do not grant the remote connector account permission for the intended FortiOS API action.

“Validate indicator type and map the appropriate field to a supported connector action before executing” is the supported response when connector actions require correctly typed parameters; URL, domain and IP indicators are not interchangeable inputs. Here the decisive response is “Inspect remote API role permissions and grant only the minimal supported operation within approved change controls”, so that different intervention does not meet the stated requirement.

Transient task output is not equivalent to documented incident evidence that can be reviewed later. “Configure a supported task or case action to record relevant enrichment and its source in the incident” applies to that other condition. The reported evidence is a security analyst can run a playbook in FortiAnalyzer but its FortiGate configuration task returns an authorization error; this alternative would address the wrong dependency.

A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. “Review saved dashboard scopes when source membership and device groups change” would remedy that alternative situation, but it would not correct the present issue: a change in grouping, deduplication or severity filters can alter incident counts without altering the raw set of attempts.

“Correlate periodicity alerts with endpoint and threat intelligence context before escalation” is the supported response when periodic connections may indicate command-and-control polling but also appear in legitimate update checks or monitoring agents. Here the decisive response is “Version control the query behind recurring campaign metrics and flag definition changes to consumers”, so that different intervention does not meet the stated requirement.

Broad internal management-port scanning can suggest lateral movement, but accepted sessions need distinct identity and server context. “Monitor unusual east-west administration patterns and require supporting login evidence before claiming compromise” applies to that other condition. The reported evidence is a monthly threat chart shows fewer incidents than the previous week, but the underlying unique attempted connections have not fallen; this alternative would address the wrong dependency.

That intervention addresses ioc feed update during active investigation, where Stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. Here, the relevant failure is instead: Live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated.

That intervention addresses ioc indicator attribution to case, where An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. In this question the necessary remedy is “Use controlled noncritical test indicators and an isolated or approved test enforcement scope for the first run”, which this alternative does not provide.

That intervention addresses deleting source event versus closing incident, where Removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis. The observed condition is a new isolation playbook is evaluated against production infrastructure before anyone confirms its target selection and rollback plan; this mechanism addresses another problem.

The report identifies the true high-bandwidth clients separately from high-connection-rate sources. This is a different failure mechanism from the current case, which concerns the incident report states whether the attempt was blocked, permitted or corroborated by host compromise evidence.

This option instead describes the analyst can identify which protected assets were targeted and which attempts were blocked or progressed. Testing that independent mechanism would not show whether the reported fault has been resolved.

The single long-lived session is distinguished from genuinely separate connections when reconciling daily totals. The stem describes a FortiGate IPS log records a high-severity signature match, and the SOC announces confirmed compromise without checking the action or server evidence, so this explanation does not account for the observations.

Storage utilization improves while the required Analytics reporting period and compliant archive copies remain accessible. This is a different failure mechanism from the current case, which concerns the analytics backlog reduces and newly received test traffic appears in FortiView within the expected interval.

This option instead describes a historical report query succeeds only for periods with the required Analytics data and its scope is clearly documented. Testing that independent mechanism would not show whether the reported fault has been resolved.

Test events from both devices display a coherent sequence after clock and timezone corrections. The stem describes fresh log packets appear in receiver statistics but FortiView graphs remain behind during a burst of traffic from several devices, so this explanation does not account for the observations.

Some FortiAnalyzer SOC analytics functions depend on a Fabric ADOM and its configured log sources, not merely a licensed user account. “Use an eligible Fabric ADOM and onboard the required supported source data under the appropriate organizational boundary” would remedy that alternative situation, but it would not correct the present issue: an ADOM's configured product version must be compatible with the managed device features and supported FortiAnalyzer workflow.

“Restrict the administrator's ADOM assignments and privileges to the authorized tenant and test effective access” is the supported response when an overly broad ADOM assignment breaks the logical security boundary even when device logging and database storage are otherwise functioning. Here the decisive response is “Review the managed device and ADOM versions, then use the supported ADOM version-upgrade or migration procedure”, so that different intervention does not meet the stated requirement.

Collector mode concentrates on receiving and forwarding or retaining logs and does not offer the full local analysis functions available in Analyzer mode. “Use an Analyzer-capable deployment for investigation and reporting, or forward logs from the Collector to its designated Analyzer” applies to that other condition. The reported evidence is after a FortiGate firmware upgrade, a device cannot be managed as expected inside an older-version ADOM although packets still reach the appliance; this alternative would address the wrong dependency.

That intervention addresses case escalation after failed remediation, where A failed mitigation increases unresolved risk and should not be treated as a completed incident response step. Here, the relevant failure is instead: MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds.

That intervention addresses event handler false positive with scanning appliance, where Known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. In this question the necessary remedy is “Configure actual event rules and test supporting data before using technique mapping for reporting”, which this alternative does not provide.

That intervention addresses event-handler data selector adom mismatch, where The event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption. The observed condition is a detection engineer assigns a MITRE technique label to an event handler and expects matching attack events without creating log rules; this mechanism addresses another problem.