Fortinet FCP_FAZ_AN-7.6 Questions & Answers

An external translated address alone may represent many internal sources and cannot uniquely identify one initiating host. “Retain full session and translation fields needed to attribute shared-address events during investigations” would remedy that alternative situation, but it would not correct the present issue: an IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target.

“Document session-boundary assumptions before comparing analytics buckets to connection counts” is the supported response when long-lived flows can contribute usage across report windows, and time aggregation does not necessarily correspond to new session creation. Here the decisive response is “Require corroboration for claims of successful exploitation and preserve the original IPS log record”, so that different intervention does not meet the stated requirement.

An antivirus detection identifies a suspicious object, but the configured security action determines whether delivery was blocked or allowed. “Record the response action and endpoint evidence for every significant malware detection” applies to that other condition. The reported evidence is a FortiGate IPS log records a high-severity signature match, and the SOC announces confirmed compromise without checking the action or server evidence; this alternative would address the wrong dependency.

Unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays. “Document the time basis in saved investigations and audit source clock health” would remedy that alternative situation, but it would not correct the present issue: exported rows without their query context are insufficient to reproduce the exact event population.

“Document intelligence confidence and require supporting behavioral evidence before broad containment” is the supported response when reputation is a contextual risk indicator, not conclusive evidence that a particular session delivered a harmful payload. Here the decisive response is “Include filter provenance and timestamp range in evidence export procedures”, so that different intervention does not meet the stated requirement.

Severity thresholds exclude all events below the chosen level regardless of their contextual investigative importance. “Avoid hardcoding Critical-only filters for exploratory hunts that span disparate log categories” applies to that other condition. The reported evidence is an analyst sends a CSV excerpt to another team but omits the ADOM, device and time filters used to produce it; this alternative would address the wrong dependency.

The cloned handler produces the intended test detection without changing the original system handler. This is a different failure mechanism from the current case, which concerns a matching test from the branch triggers but the same pattern from an out-of-scope device does not.

This option instead describes a harmless single probe does not fire while a sustained controlled scan crosses the rule threshold. Testing that independent mechanism would not show whether the reported fault has been resolved.

A controlled matching security log produces the expected Event Monitor entry under the host view. The stem describes a branch-only login alert begins firing for every firewall because the event handler lacks the intended device source constraint, so this explanation does not account for the observations.

Remote log delivery requires the allowed protocol and destination path independently of ordinary user traffic forwarding. “Track collector transport dependencies in network-change testing and alert on silent collection loss” would remedy that alternative situation, but it would not correct the present issue: a healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs.

“Review newly discovered devices and reconcile serial numbers against the approved branch onboarding register” is the supported response when receiving a connection is not equivalent to authorizing the device and assigning its logs to the expected administrative domain. Here the decisive response is “Test originating log generation as well as collector reachability whenever installing a new gateway”, so that different intervention does not meet the stated requirement.

Administrative domains isolate device inventory and associated log visibility, so the analyst's selected ADOM can exclude the logging source. “Include ADOM placement and analyst role checks in the device onboarding acceptance test” applies to that other condition. The reported evidence is the central analyzer is reachable, but a newly deployed FortiGate produces no traffic records after a policy change because remote log sending was never enabled; this alternative would address the wrong dependency.

Raw logs remain visible and the correctly enabled analytics view displays eligible data after its prerequisites are met. This is a different failure mechanism from the current case, which concerns the partner can reproduce the event order from the same UTC reference without guessing the analyst's locale.

This option instead describes a new synthetic record of the affected subtype carries a usable destination field and matches the test rule. Testing that independent mechanism would not show whether the reported fault has been resolved.

Post-upgrade test logs, event handlers, playbooks and key reports operate on the supported combination. The stem describes an investigator exports filtered events for a partner working in UTC and fails to record whether the displayed time is local console time, so this explanation does not account for the observations.

That intervention addresses predefined report scope wrong adom, where A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. Here, the relevant failure is instead: A blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect.

That intervention addresses report raw logs differ from aggregated counts, where Distinct asset counts and individual event message totals measure different populations and cannot be compared as equal. In this question the necessary remedy is “Examine report diagnostic logs and test the underlying dataset with the same device and period filters”, which this alternative does not provide.

That intervention addresses automated report schedule and storage budget, where Simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. The observed condition is a security report's threat chart displays no rows, and the analyst starts redesigning the template before checking query execution; this mechanism addresses another problem.

Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. “Record planned automation behavior changes and periodically retune monitored baselines” would remedy that alternative situation, but it would not correct the present issue: a widget may depend on a particular log category absent from the selected ADOM, not merely any available event messages.

“Test Boolean filters against positive and negative fixtures before using them in production hunts” is the supported response when combining mutually exclusive predicates with AND can eliminate matches that would satisfy a properly grouped OR condition. Here the decisive response is “Validate dashboard data prerequisites during deployment instead of assuming every widget works on system events alone”, so that different intervention does not meet the stated requirement.

The selected Log View column layout can hide fields that are present in underlying record details. “Save investigation-specific column layouts and verify field existence before changing parsing rules” applies to that other condition. The reported evidence is a FortiView widget appears grayed out for one ADOM even though the SOC can see current device logins and system events; this alternative would address the wrong dependency.

An extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records. “Test dataset boundary conditions and timezone assumptions when updating schedules or SQL” would remedy that alternative situation, but it would not correct the present issue: predefined datasets are reusable built-in resources and are not edited or deleted like analyst-created custom datasets.

“State exact distinct-key logic in security report definitions and verify it against duplicates” is the supported response when counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host. Here the decisive response is “Track copied datasets and review downstream chart bindings before changes or deletion”, so that different intervention does not meet the stated requirement.

Successful report generation and successful email delivery are separate stages with independent transport dependencies. “Monitor report delivery errors independently of generation completion status” applies to that other condition. The reported evidence is an analyst attempts to delete a built-in dataset after changing its SQL and finds that the platform protects the original object; this alternative would address the wrong dependency.

The task completes using valid credentials while unauthorized operations remain blocked. This is a different failure mechanism from the current case, which concerns the cloned handler produces the intended test detection without changing the original system handler.

This option instead describes a controlled matching security log produces the expected Event Monitor entry under the host view. Testing that independent mechanism would not show whether the reported fault has been resolved.

A matching test from the branch triggers but the same pattern from an out-of-scope device does not. The stem describes a team needs to customize an existing malware event handler for its regulated servers, but several protected built-in fields cannot be edited, so this explanation does not account for the observations.

Local automation privileges do not grant the remote connector account permission for the intended FortiOS API action. “Inspect remote API role permissions and grant only the minimal supported operation within approved change controls” would remedy that alternative situation, but it would not correct the present issue: a threshold and its observation interval jointly define what constitutes a detectable burst; too narrow a window can miss sustained patterns.

“Use approved current routing details for case notifications and test delivery to the new owner” is the supported response when hard-coded notification recipients can become stale when case assignment or on-call ownership changes. Here the decisive response is “Choose a window aligned with the attack hypothesis and test both distributed and benign failure schedules”, so that different intervention does not meet the stated requirement.

The current incident status alone does not provide the full chronology of analyst actions and changes. “Review the supported incident audit history and relevant administrative event records for each change” applies to that other condition. The reported evidence is a distributed-password-guessing event rule never fires because each failed login occurs outside its very short aggregation window; this alternative would address the wrong dependency.

That intervention addresses ioc subscription state and threat intelligence, where Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. Here, the relevant failure is instead: Deleting a raw archive is not an equivalent remedy for every analytics database or retention problem and risks destroying evidence.

That intervention addresses adom log role access versus global login, where Successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. In this question the necessary remedy is “Inspect disk usage by log type and storage tier and choose an approved data-policy or capacity change that preserves mandated evidence”, which this alternative does not provide.

That intervention addresses security fabric correlation without time alignment, where Independent device time formats and offsets can create a misleading chain when normalized event times are not aligned. The observed condition is a spike in traffic causes storage pressure and an operator wants to delete raw archive logs without understanding policy for analytics and reports; this mechanism addresses another problem.