Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses playbook task timeout and retry controls, where A timeout does not prove the remote action failed, so blindly repeating non-idempotent tasks can cause inconsistent state. Here, the relevant failure is instead: Overlapping rules and notification routing can produce duplicated escalation for one underlying source event.

That intervention addresses incident triggered by event with inadequate confidence, where Automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. In this question the necessary remedy is “Audit rule overlap, notification profiles and explicit escalation ownership to select the correct route”, which this alternative does not provide.

That intervention addresses playbook task output type is null, where Downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds. The observed condition is two notification profiles are attached through overlapping handler rules, causing one detection to page two teams with contradictory severity labels; this mechanism addresses another problem.

New logs are attributed to the replacement while old evidence retains the original device serial. This is a different failure mechanism from the current case, which concerns historical eligible records gain new indicator matches after a rescan with newer definitions.

This option instead describes the platform processes peak test event volumes without a growing indexing backlog or unexplained data gaps. Testing that independent mechanism would not show whether the reported fault has been resolved.

Regional log receipt remains documented and central queries show recovered events after the link is restored. The stem describes an investigator wants to apply newly received threat intelligence to last week's stored traffic, but only yesterday's previously flagged indicators appear, so this explanation does not account for the observations.

That intervention addresses dos detection and actual service availability, where A DoS or anomaly detection is not by itself evidence that the protected application became unavailable. Here, the relevant failure is instead: A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted.

That intervention addresses file filter log versus antivirus diagnosis, where File filtering can block an object by its type without an antivirus malware verdict. In this question the necessary remedy is “Inspect DLP log action, matched rule, relevant content metadata and corresponding traffic session”, which this alternative does not provide.

That intervention addresses intrusion event source and target reversal, where Directional address fields describe traffic endpoints; incident roles cannot be assigned correctly if source and target are reversed. The observed condition is a DLP rule reports a sensitive-file upload, but the case owner assumes the whole document was exfiltrated before inspecting the action; this mechanism addresses another problem.

Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. “Require destination-state verification for high-impact automation rather than relying on a green job icon alone” would remedy that alternative situation, but it would not correct the present issue: a suppression kept beyond its legitimate time window can conceal subsequent security-relevant activity.

“Require peer review and expiration for high-impact event suppression changes” is the supported response when suppression criteria without precise identity and event scope can hide unrelated true-positive detections. Here the decisive response is “Use time-limited exceptions and alert on active suppressions that exceed the stated business reason”, so that different intervention does not meet the stated requirement.

Aggregating all failures globally instead of grouping by a relevant user key can manufacture a false account-centric pattern. “Validate aggregation keys with synthetic multi-user test records before enabling notifications” applies to that other condition. The reported evidence is a temporary impossible-travel exception was set for an employee's international trip but still hides later suspicious logins; this alternative would address the wrong dependency.

That intervention addresses report output profile wrong recipient, where Report output profile recipients can remain stale even when generated content and filters are correct. Here, the relevant failure is instead: Device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included.

That intervention addresses report historical period beyond retention, where A report cannot reconstruct events outside available indexed data solely by extending its date selector. In this question the necessary remedy is “Restrict report source selection to the authorized region and rerun with the same time window”, which this alternative does not provide.

That intervention addresses report chart builder query not validated, where An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. The observed condition is a regional compliance report includes remote branches from another country because the source device group was too broad; this mechanism addresses another problem.

Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. “Require destination-state verification for high-impact automation rather than relying on a green job icon alone” would remedy that alternative situation, but it would not correct the present issue: an event trigger runs on matching individual events, which may precede incident creation and analyst classification.

“Use least-privilege trigger criteria and test negative controls before automating disruptive actions” is the supported response when a generic EVENT_TRIGGER without scope conditions can launch on unrelated events and create unsafe automated response. Here the decisive response is “Document whether each automation listens for event creation or incident creation in its design review”, so that different intervention does not meet the stated requirement.

An ON_DEMAND trigger requires deliberate execution and does not behave like an event-triggered workflow. “Name and document manual versus automatic playbooks so responders know when actions will execute” applies to that other condition. The reported evidence is a team wants a playbook to start only after an incident has been created and triaged, but it configured an event trigger instead; this alternative would address the wrong dependency.

That intervention addresses playbook job status versus actual mitigation, where Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. Here, the relevant failure is instead: A generic EVENT_TRIGGER without scope conditions can launch on unrelated events and create unsafe automated response.

That intervention addresses playbook tasks need predecessor completion, where A playbook task's dependencies determine when it executes; missing predecessor relationships can expose uninitialized parameters. In this question the necessary remedy is “Apply specific event attributes and grouping filters to the trigger before enabling the playbook”, which this alternative does not provide.

That intervention addresses on-demand playbook trigger not run, where An ON_DEMAND trigger requires deliberate execution and does not behave like an event-triggered workflow. The observed condition is a newly enabled playbook runs containment tasks for every event, including routine system alerts, because no event-trigger filter was set; this mechanism addresses another problem.

The case identifies each observed affected endpoint linked to the same indicator and event evidence. This is a different failure mechanism from the current case, which concerns an IP test invokes an IP-block action and a URL test selects a compatible URL-aware control.

This option instead describes the next analyst can read the enrichment and timestamp from the case without rerunning the lookup. Testing that independent mechanism would not show whether the reported fault has been resolved.

A test event causes action only on the branch's approved enforcement point and leaves headquarters unchanged. The stem describes a playbook passes a URL string into a connector task expecting an IP address and produces an error instead of containment, so this explanation does not account for the observations.

A saved report definition does not automatically run periodically unless its schedule and output settings are enabled. “Review recurrence and owner notification settings after creating or cloning reports” would remedy that alternative situation, but it would not correct the present issue: charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records.

“Capacity-plan Analytics storage to match report lookback requirements separately from archive retention” is the supported response when report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. Here the decisive response is “Check dataset dependencies whenever copying report templates between environments”, so that different intervention does not meet the stated requirement.

A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. “Record ADOM and source selection in recurring report configuration reviews” applies to that other condition. The reported evidence is a copied report template contains a chart placeholder but the plot remains blank after generation even though the ADOM has recent data; this alternative would address the wrong dependency.

Incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store. “Train responders to redact tokens from task logs and use approved secret references” would remedy that alternative situation, but it would not correct the present issue: absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily.

“Require asset identification and supporting event links in incident intake templates” is the supported response when a case without evidence-backed affected-asset context cannot be reliably routed or validated during response. Here the decisive response is “Enforce a closure checklist that distinguishes quiet telemetry from confirmed resolution”, so that different intervention does not meet the stated requirement.

Overlapping detections may describe one underlying host investigation rather than independent incidents. “Design event-correlation and case-deduplication practices around asset, time and indicator context” applies to that other condition. The reported evidence is a case is closed after an IOC alarm quiets down but no one checks whether the compromised host was actually remediated; this alternative would address the wrong dependency.

An external translated address alone may represent many internal sources and cannot uniquely identify one initiating host. “Retain full session and translation fields needed to attribute shared-address events during investigations” would remedy that alternative situation, but it would not correct the present issue: an IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target.

“Document session-boundary assumptions before comparing analytics buckets to connection counts” is the supported response when long-lived flows can contribute usage across report windows, and time aggregation does not necessarily correspond to new session creation. Here the decisive response is “Require corroboration for claims of successful exploitation and preserve the original IPS log record”, so that different intervention does not meet the stated requirement.

An antivirus detection identifies a suspicious object, but the configured security action determines whether delivery was blocked or allowed. “Record the response action and endpoint evidence for every significant malware detection” applies to that other condition. The reported evidence is a FortiGate IPS log records a high-severity signature match, and the SOC announces confirmed compromise without checking the action or server evidence; this alternative would address the wrong dependency.