Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses notification profile missing on handler, where Event generation does not itself prove a notification action is configured and connected to the correct handler. Here, the relevant failure is instead: An excessive correlation window can connect unrelated events that happen to share a hostname or indicator.

That intervention addresses incorrect event severity assignment, where Alert severity configured without business impact or enforcement outcome may distort incident response priorities. In this question the necessary remedy is “Tighten the temporal window and grouping to the actual attacker behavior and test historical false positives”, which this alternative does not provide.

That intervention addresses correlation handler ordered security stages, where A simple event count does not establish the order or relationship of multiple steps required for an attack pattern. The observed condition is a custom multi-stage handler joins alerts that occurred many days apart and generates spurious campaign incidents; this mechanism addresses another problem.

The case records whether the same authenticated identity initiated the subsequent transfer and whether policy permitted it. This is a different failure mechanism from the current case, which concerns the analyst distinguishes unusual employee activity from expected kiosk or scanner transactions.

This option instead describes the spike is classified against the planned migration without ignoring genuine detection logs. Testing that independent mechanism would not show whether the reported fault has been resolved.

The proposed response is tied to the correct live asset with documented supporting evidence. The stem describes a SOC investigation includes employees and kiosk devices but applies the same risk expectation to both device categories, so this explanation does not account for the observations.

An event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled. “Apply automatic case creation selectively to avoid turning low-value noise into a backlog of incidents” would remedy that alternative situation, but it would not correct the present issue: viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile.

“Audit imported dependencies and avoid assuming playbook portability includes secrets or authorization” is the supported response when a playbook definition can reference integrations that are absent or have different credentials in the destination environment. Here the decisive response is “Review automation execution roles and preserve least privilege during urgent incident response”, so that different intervention does not meet the stated requirement.

Connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome. “Maintain a connector capability inventory and check target-version support before importing playbooks” applies to that other condition. The reported evidence is a read-only analyst wants to execute a high-impact on-demand block playbook but the interface denies the operation; this alternative would address the wrong dependency.

Endpoint addresses can change while host and user identities remain consistent, so an IP-only pivot can truncate a case timeline. “Correlate log host identity, authenticated user, DHCP records and observed address changes within the relevant period” would remedy that alternative situation, but it would not correct the present issue: the same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous.

“Compare original indicator definition time with the current feed and retain the case evidence provenance” is the supported response when historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. Here the decisive response is “Restrict events by tenant ADOM, device and VDOM before pivoting on the private source address”, so that different intervention does not meet the stated requirement.

An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. “Review the IOC type, confidence, original connection and any relevant DNS or URL information” applies to that other condition. The reported evidence is a centralized SOC sees traffic from 10.0.1.25 across several tenants and mistakenly groups all events as one infected workstation; this alternative would address the wrong dependency.

Trigger conditions alone do not provide the required independent approval boundary for a disruptive change. “Record approver identity and ensure emergency override paths are controlled and auditable” would remedy that alternative situation, but it would not correct the present issue: suppressing future duplicate alerts does not replace the need to retain source logs and prior event evidence.

“Train analysts to compare By Threat and By Endpoint views rather than relying on one perspective” is the supported response when threat-centric and endpoint-centric views group the same underlying detections differently and serve distinct investigation pivots. Here the decisive response is “Separate alert suppression controls from retention and evidence-preservation requirements”, so that different intervention does not meet the stated requirement.

Receiving external alert logs may require a suitable enabled event-collector handler to transform the ingested alert into an event. “Validate each external alert feed's parsing and handler visibility in integration acceptance tests” applies to that other condition. The reported evidence is a help desk suppresses noisy endpoint events while a confirmed incident still needs the earlier detections for retrospective investigation; this alternative would address the wrong dependency.

Report output cannot contain detections from log categories the originating devices did not generate or forward. “Monitor upstream log-category coverage as part of reporting SLA checks” would remedy that alternative situation, but it would not correct the present issue: grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute.

“Use explicit time standards and boundary tests in geographically distributed reporting” is the supported response when scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. Here the decisive response is “Track identity field completeness as a quality measure for user-based analytics reports”, so that different intervention does not meet the stated requirement.

Event occurrence time and log receipt time differ during buffering, and an inappropriate time field can shift daily totals. “Document which timestamp field underpins every time-series report dataset” applies to that other condition. The reported evidence is at a weekly executive reporting review, A report lists Unknown as the dominant user even though traffic devices and log volume are healthy; this alternative would address the wrong dependency.

Overlapping rules and notification routing can produce duplicated escalation for one underlying source event. “Audit rule overlap, notification profiles and explicit escalation ownership to select the correct route” would remedy that alternative situation, but it would not correct the present issue: a timeout does not prove the remote action failed, so blindly repeating non-idempotent tasks can cause inconsistent state.

“Document the disabled automation window and restore or test the trigger and connectors after maintenance” is the supported response when log collection and automated response are separate capabilities, and workflow suspension can create a response gap. Here the decisive response is “Check the target state first and use supported bounded retries with idempotent action logic where possible”, so that different intervention does not meet the stated requirement.

Automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. “Tune event filters and automatic incident creation criteria to focus on actionable validated detections” applies to that other condition. The reported evidence is a network connector occasionally times out after sending a block command, and repeated blind retries create duplicate configuration entries; this alternative would address the wrong dependency.

Distinct event handlers may match different features of one underlying host incident, so count of alerts is not count of compromises. “Correlate by host, indicator, time and event context before grouping into one evidence-backed case” would remedy that alternative situation, but it would not correct the present issue: an application-level aggregate alone does not identify individual users or show which endpoints were affected.

“Verify actual raw or Analytics retention and avoid presenting a stale summary as if all supporting events remain available” is the supported response when a summary, cache or earlier export may survive after the underlying log records required for drilldown have expired. Here the decisive response is “Filter the signature and action, then pivot to authenticated user, source IP and device records in the selected interval”, so that different intervention does not meet the stated requirement.

Event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome. “Use asset criticality, exposure, action and event evidence to set triage priority separately from source severity” applies to that other condition. The reported evidence is a policy owner asks which users were affected by one newly blocked application signature during a scheduled change; this alternative would address the wrong dependency.

That intervention addresses administrator login from unexpected country, where IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof. Here, the relevant failure is instead: A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method.

That intervention addresses vpn tunnel establishment versus use, where A tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted. In this question the necessary remedy is “Correlate VPN authentication logs by user, source address, outcome, time and any second-factor events”, which this alternative does not provide.

That intervention addresses dns filter sinkhole evidence, where DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP. The observed condition is a remote-access gateway reports hundreds of failed SSL VPN logins for one account overnight, followed by a single successful login; this mechanism addresses another problem.

Aggregating all failures globally instead of grouping by a relevant user key can manufacture a false account-centric pattern. “Validate aggregation keys with synthetic multi-user test records before enabling notifications” would remedy that alternative situation, but it would not correct the present issue: configuring a handler's rules is insufficient until the handler is enabled for event generation.

“Use time-limited exceptions and alert on active suppressions that exceed the stated business reason” is the supported response when a suppression kept beyond its legitimate time window can conceal subsequent security-relevant activity. Here the decisive response is “Include status checks and positive test evidence in detection deployment signoff”, so that different intervention does not meet the stated requirement.

Uncontrolled repeated detections can create duplicate work even when the cause of the specific known event is understood. “Document suppression expiration and review suppressions rather than permanently disabling critical detection” applies to that other condition. The reported evidence is a custom event handler passes a configuration test but has produced no actual events since being saved in a disabled state; this alternative would address the wrong dependency.

Identical usernames do not prove both sessions originated from the same approved management path. “Correlate login events by source IP, time, authentication method and administrative action history” would remedy that alternative situation, but it would not correct the present issue: file filtering can block an object by its type without an antivirus malware verdict.

“Filter administrative event logs by user, source, outcome and interval and compare with successful access or account lockout events” is the supported response when a pattern of failed authentications can indicate brute-force activity even when no login has succeeded. Here the decisive response is “Inspect the file-filter event subtype, detected file type, policy and enforcement action”, so that different intervention does not meet the stated requirement.

A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. “Inspect DLP log action, matched rule, relevant content metadata and corresponding traffic session” applies to that other condition. The reported evidence is a PDF attachment is rejected by a gateway and analysts search only malware signatures even though the object triggered a file-type rule; this alternative would address the wrong dependency.