Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A tunnel negotiation success does not establish that subsequent policy, routing or encrypted application flows were permitted. “Join tunnel events with related traffic logs and check the intended application session and routing behavior” would remedy that alternative situation, but it would not correct the present issue: IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof.

“Inspect query name, DNS action and subsequent sessions to distinguish attempted lookup from successful command-channel access” is the supported response when DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP. Here the decisive response is “Correlate administrative logs with known VPN gateways, MFA records, source reputation and recent account activity”, so that different intervention does not meet the stated requirement.

A category-based web-filter policy can block a site even without an identified malware signature. “Inspect the web-filter category, action, matching policy and exact requested hostname before proposing an exception” applies to that other condition. The reported evidence is a privileged admin account logs in from an unfamiliar geographic location and the SOC needs to assess the risk without assuming geolocation is definitive; this alternative would address the wrong dependency.

Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. “Assign the appropriate event view tags to the custom handler and verify its output classification” would remedy that alternative situation, but it would not correct the present issue: a simple event count does not establish the order or relationship of multiple steps required for an attack pattern.

“Tighten the temporal window and grouping to the actual attacker behavior and test historical false positives” is the supported response when an excessive correlation window can connect unrelated events that happen to share a hostname or indicator. Here the decisive response is “Use a supported correlation handler with ordered event conditions, user grouping and a bounded time window”, so that different intervention does not meet the stated requirement.

Event generation does not itself prove a notification action is configured and connected to the correct handler. “Configure and associate an authorized notification profile with the event handler and test delivery” applies to that other condition. The reported evidence is an SOC rule must detect a failed login burst followed by one successful login rather than simply any two authentication events; this alternative would address the wrong dependency.

A predefined handler can contain several rules, and disabling the full handler removes detection coverage beyond one unwanted rule. “Maintain a rule-level inventory before making broad detection status changes” would remedy that alternative situation, but it would not correct the present issue: notification delivery depends on its configured mail transport and credentials separately from event detection.

“Use least-privilege trigger criteria and test negative controls before automating disruptive actions” is the supported response when a generic EVENT_TRIGGER without scope conditions can launch on unrelated events and create unsafe automated response. Here the decisive response is “Monitor mail delivery errors and update notification credentials in the secret rotation plan”, so that different intervention does not meet the stated requirement.

An ON_DEMAND trigger requires deliberate execution and does not behave like an event-triggered workflow. “Name and document manual versus automatic playbooks so responders know when actions will execute” applies to that other condition. The reported evidence is the event handler is generating alerts, but email notifications stopped after an SMTP relay authentication change; this alternative would address the wrong dependency.

That intervention addresses high eps ingestion capacity planning, where The sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works. Here, the relevant failure is instead: Local collection may continue while the forwarding link is down, and upstream analysis has a freshness gap until forwarding resumes.

That intervention addresses disk quota saturation and dropped logs, where Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. In this question the necessary remedy is “Restore the supported Collector-to-Analyzer path and validate backlog forwarding or recovery behavior”, which this alternative does not provide.

That intervention addresses log device registration after rma, where The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. The observed condition is a regional Collector records events locally but central investigations stop receiving the region's new events during a WAN outage; this mechanism addresses another problem.

That intervention addresses email attachment lure and web pivot, where Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. Here, the relevant failure is instead: Generic HTTPS totals obscure application categories that may reveal unsanctioned file-sharing services.

That intervention addresses failed web requests caused by certificate error, where Connection failure and security detection are different causes; a missing malware log cannot identify a TLS or certificate root cause. In this question the necessary remedy is “Use application-aware FortiView or application-control telemetry with user and destination filters”, which this alternative does not provide.

That intervention addresses dns and web filter indicator disagreement, where Different hostnames or cached endpoints can share an IP and different security profiles evaluate different request fields. The observed condition is a manager asks the SOC to identify unmanaged cloud storage usage by department rather than all web browsing activity; this mechanism addresses another problem.

A threshold and its observation interval jointly define what constitutes a detectable burst; too narrow a window can miss sustained patterns. “Tune time windows using realistic negative and positive sequences rather than a single artificial burst” would remedy that alternative situation, but it would not correct the present issue: a predefined handler can contain several rules, and disabling the full handler removes detection coverage beyond one unwanted rule.

“Use staged enablement and smoke tests following playbook imports and upgrades” is the supported response when a defined workflow and configured trigger do not execute automatically when the playbook is disabled. Here the decisive response is “Maintain a rule-level inventory before making broad detection status changes”, so that different intervention does not meet the stated requirement.

The current incident status alone does not provide the full chronology of analyst actions and changes. “Protect case audit history and require named SOC accounts rather than shared logins” applies to that other condition. The reported evidence is an operator disables an entire predefined event handler to silence one noisy subrule, unexpectedly removing several other useful detections; this alternative would address the wrong dependency.

The administrator can explain the block and evaluate a narrow approved exception against the real policy. This is a different failure mechanism from the current case, which concerns the reconstructed transfer shows consistent sent and received measures for the relevant vantage point.

This option instead describes the timeline establishes whether a policy deployment coincides with the observed change in blocked traffic. Testing that independent mechanism would not show whether the reported fault has been resolved.

A single observed attempt retains both supporting detections without being counted as two independent compromises. The stem describes a top-uploaders chart is compared with received bytes and appears inconsistent for a host exchanging large backup files, so this explanation does not account for the observations.

Raw logs remain visible and the correctly enabled analytics view displays eligible data after its prerequisites are met. This is a different failure mechanism from the current case, which concerns the restored messages match source hashes or expected records and can be examined in the supported tools.

This option instead describes the available search range still covers the policy's required investigation interval and storage utilization stays controlled. Testing that independent mechanism would not show whether the reported fault has been resolved.

A test failover timeline shows events from the correct active member before and after the transition. The stem describes the security team schedules a daily backup of analytics evidence but never validates that an archived log set can actually be read, so this explanation does not account for the observations.

The unknown key is visible in raw evidence and its parsing coverage can be assessed independently. This is a different failure mechanism from the current case, which concerns a test configuration change yields the expected administrator attribution in the appliance's event history.

This option instead describes a known test sequence from the three sources appears in its correct chronological order with consistent timezone interpretation. Testing that independent mechanism would not show whether the reported fault has been resolved.

Both old and new eligible event subtypes are represented in the tested analytics results after adjustment. The stem describes a compliance review requires evidence of configuration changes, but analysts search firewall traffic logs instead of FortiAnalyzer's administrative events, so this explanation does not account for the observations.

A test unapproved indicator produces notification without blocking, while an approved case proceeds to enforcement. This is a different failure mechanism from the current case, which concerns the recipient can import the approved logic without receiving active production secrets or unintended device access.

This option instead describes the historic case remains auditable and new unrelated indicators continue to generate events. Testing that independent mechanism would not show whether the reported fault has been resolved.

A sample external alert appears as a traceable event with its original source identifier. The stem describes an analyst exports a working playbook to share externally without checking the included connector information and its destination environment, so this explanation does not account for the observations.

Generic HTTPS totals obscure application categories that may reveal unsanctioned file-sharing services. “Review category labels and business exceptions before claiming all detected cloud storage is policy-breaking” would remedy that alternative situation, but it would not correct the present issue: connection failure and security detection are different causes; a missing malware log cannot identify a TLS or certificate root cause.

“Exercise multi-product phishing investigation with controlled sample events and source-aware searches” is the supported response when email detection and subsequent web access must be correlated across distinct products using consistent user and time context. Here the decisive response is “Ensure certificate error diagnostics are available during SSL inspection change windows”, so that different intervention does not meet the stated requirement.

Different hostnames or cached endpoints can share an IP and different security profiles evaluate different request fields. “Avoid correlating alerts solely by shared destination IP when domain and URL context exists” applies to that other condition. The reported evidence is an application exhibits failed HTTPS sessions, and a security analyst sees generic traffic denies but no malware detections; this alternative would address the wrong dependency.