Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Identical usernames do not prove both sessions originated from the same approved management path. “Correlate login events by source IP, time, authentication method and administrative action history” would remedy that alternative situation, but it would not correct the present issue: file filtering can block an object by its type without an antivirus malware verdict.

“Filter administrative event logs by user, source, outcome and interval and compare with successful access or account lockout events” is the supported response when a pattern of failed authentications can indicate brute-force activity even when no login has succeeded. Here the decisive response is “Inspect the file-filter event subtype, detected file type, policy and enforcement action”, so that different intervention does not meet the stated requirement.

A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. “Inspect DLP log action, matched rule, relevant content metadata and corresponding traffic session” applies to that other condition. The reported evidence is a PDF attachment is rejected by a gateway and analysts search only malware signatures even though the object triggered a file-type rule; this alternative would address the wrong dependency.

An alert dependent on parsed fields can stop matching when the parser schema or producer keys change. “Compare the current raw payload, parsed fields and alert query and repair the supported mapping or condition” would remedy that alternative situation, but it would not correct the present issue: log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation.

“Check current Fortinet release documentation and supported upgrade paths, then test critical analytics and connectors” is the supported response when product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. Here the decisive response is “Update the approved log group or device selection and recompute the regional analysis for the affected period”, so that different intervention does not meet the stated requirement.

The same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata. “Record the underlying event timestamp and timezone conversion in the evidence package and verify it against raw records” applies to that other condition. The reported evidence is an access control review finds a moved branch firewall still in its old regional log group, producing misleading totals in regional dashboards; this alternative would address the wrong dependency.

That intervention addresses application-control category blocked, where An application-control policy may identify and block traffic based on application signatures independently of ordinary port permissions. Here, the relevant failure is instead: A pattern of failed authentications can indicate brute-force activity even when no login has succeeded.

That intervention addresses file filter log versus antivirus diagnosis, where File filtering can block an object by its type without an antivirus malware verdict. In this question the necessary remedy is “Filter administrative event logs by user, source, outcome and interval and compare with successful access or account lockout events”, which this alternative does not provide.

That intervention addresses dlp event and evidence sufficiency, where A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. The observed condition is fortiAnalyzer appliance event logs show repeated failed GUI logins for the same admin identity from a single untrusted address; this mechanism addresses another problem.

Trigger conditions alone do not provide the required independent approval boundary for a disruptive change. “Route detection to an approval or manual on-demand response step and execute the blocking connector only after authorization” would remedy that alternative situation, but it would not correct the present issue: uncontrolled repeated detections can create duplicate work even when the cause of the specific known event is understood.

“Define event grouping using the proper user and source dimensions with the intended time window” is the supported response when aggregating all failures globally instead of grouping by a relevant user key can manufacture a false account-centric pattern. Here the decisive response is “Apply a narrowly scoped event suppression rule for the known source, event and approved maintenance interval”, so that different intervention does not meet the stated requirement.

Suppression criteria without precise identity and event scope can hide unrelated true-positive detections. “Narrow the suppression to the investigated user, matching handler and time interval rather than a global filter” applies to that other condition. The reported evidence is an event handler raises a new case for each identical benign maintenance action and floods the incident queue during planned work; this alternative would address the wrong dependency.

That intervention addresses playbook action unsupported by connector, where Connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome. Here, the relevant failure is instead: A playbook definition can reference integrations that are absent or have different credentials in the destination environment.

That intervention addresses playbook task branch unreachable, where Disconnected or incorrectly configured task routes can make a branch unreachable regardless of the input event. In this question the necessary remedy is “Import the needed connector definitions where allowed and remap their credentials and permissions to the target ADOM”, which this alternative does not provide.

That intervention addresses playbook connector cannot authenticate, where Playbook task execution requires an authorized remote connector credential, not just a configured action name. The observed condition is a SOC team imports a known-good playbook into a different ADOM but its tasks fail because required connectors were not imported or mapped; this mechanism addresses another problem.

Report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. “Verify Analytics log retention for the needed period and use a supported data reprocessing workflow if available” would remedy that alternative situation, but it would not correct the present issue: editing a shared baseline template can alter multiple reports or remove a known-good rollback point.

“Check the generated report, dataset tests, source device filter and Analytics log coverage” is the supported response when generation success does not prove the dataset query returned the expected source records or that the content is substantively correct. Here the decisive response is “Clone the appropriate report or template and change the cloned layout for the specific audience”, so that different intervention does not meet the stated requirement.

Expensive broad SQL queries and report concurrency can exceed the available analytics processing resources. “Inspect report diagnostic and task logs, then narrow or optimize dataset queries and schedule supported workloads” applies to that other condition. The reported evidence is a risk analyst must change the text and visual order of one customer-facing report without modifying a corporate baseline used by other teams; this alternative would address the wrong dependency.

That intervention addresses log transport path blocked by access rules, where Remote log delivery requires the allowed protocol and destination path independently of ordinary user traffic forwarding. Here, the relevant failure is instead: Receiving a connection is not equivalent to authorizing the device and assigning its logs to the expected administrative domain.

That intervention addresses required traffic policy missing logging, where Traffic can match and be forwarded by a firewall policy even when session logging is disabled on that specific rule. In this question the necessary remedy is “Inspect Device Manager, authorize the correct FortiGate serial and place it in the intended ADOM before validating ingestion”, which this alternative does not provide.

That intervention addresses fortigate remote logging not enabled, where A healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs. The observed condition is a newly installed branch FortiGate sends its first logging connection toward a central FortiAnalyzer, but the SOC cannot find the branch in its approved device inventory; this mechanism addresses another problem.

Downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds. “Add mandatory-field and type checks before all connector actions with side effects” would remedy that alternative situation, but it would not correct the present issue: known scanner behavior explains selected detections but does not justify removing detection coverage network-wide.

“Validate event routing to each operational queue when custom handlers change” is the supported response when views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. Here the decisive response is “Maintain expiring scanner exceptions tied to documented test windows and asset identity”, so that different intervention does not meet the stated requirement.

The event engine evaluates its selected ADOM and log sources; cross-domain data does not appear by assumption. “Test handler data selection against current source-to-ADOM inventory before enablement” applies to that other condition. The reported evidence is an approved internal vulnerability scanner repeatedly triggers intrusion alerts, and analysts consider disabling IPS events for all hosts; this alternative would address the wrong dependency.

The cloned handler produces the intended test detection without changing the original system handler. This is a different failure mechanism from the current case, which concerns a harmless single probe does not fire while a sustained controlled scan crosses the rule threshold.

This option instead describes a failed VPN login creates a matching event, and unrelated traffic sessions do not trigger it. Testing that independent mechanism would not show whether the reported fault has been resolved.

A matching test from the branch triggers but the same pattern from an out-of-scope device does not. The stem describes a port-scan handler creates hundreds of low-value events each hour because it fires on one ordinary denied SYN packet, so this explanation does not account for the observations.

That intervention addresses playbook branch skips notification on partial failure, where An automation may have partial task failures, and successful completion of one branch is not evidence all required actions succeeded. Here, the relevant failure is instead: Disconnected or incorrectly configured task routes can make a branch unreachable regardless of the input event.

That intervention addresses playbook action unsupported by connector, where Connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome. In this question the necessary remedy is “Inspect the playbook task links and branching conditions, then repair the supported workflow graph”, which this alternative does not provide.

That intervention addresses playbook on_demand operator authorization, where Viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile. The observed condition is a detection playbook has a notification branch that never runs even when the decision condition should route events to it; this mechanism addresses another problem.

Exporting automation definitions can expose integration details and requires review of embedded connectors or credential references. “Review export contents and connector dependencies before distributing playbooks beyond the tenant” would remedy that alternative situation, but it would not correct the present issue: receiving external alert logs may require a suitable enabled event-collector handler to transform the ingested alert into an event.

“Train analysts to compare By Threat and By Endpoint views rather than relying on one perspective” is the supported response when threat-centric and endpoint-centric views group the same underlying detections differently and serve distinct investigation pivots. Here the decisive response is “Validate each external alert feed's parsing and handler visibility in integration acceptance tests”, so that different intervention does not meet the stated requirement.

Trigger conditions alone do not provide the required independent approval boundary for a disruptive change. “Record approver identity and ensure emergency override paths are controlled and auditable” applies to that other condition. The reported evidence is a third-party security system forwards an external alert successfully, but the SOC does not see a corresponding Event Monitor record; this alternative would address the wrong dependency.