Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The incident explicitly records the feed version, freshness and supporting present-day evidence. This is a different failure mechanism from the current case, which concerns a second responder can trace the IOC to a specific original event instead of relying on a bare copied string.

This option instead describes a deliberate test blocks only the expected benign target and the reversal procedure restores baseline state. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident contains useful error evidence without revealing the credential, and the old token no longer works. The stem describes a security analyst attaches an external threat-intelligence indicator to a case without recording why it matches the observed host, so this explanation does not account for the observations.

That intervention addresses on-demand playbook trigger not run, where An ON_DEMAND trigger requires deliberate execution and does not behave like an event-triggered workflow. Here, the relevant failure is instead: Response-generated events can feed back into the same broad trigger unless source or action context is excluded.

That intervention addresses playbook job status versus actual mitigation, where Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. In this question the necessary remedy is “Narrow the trigger to primary detections and exclude playbook-generated response events using supported filters”, which this alternative does not provide.

That intervention addresses playbook connector scope during adom separation, where A connector credential with broad external permissions can cross tenant boundaries even when incident visibility is ADOM-scoped. The observed condition is a playbook triggered by a security event adds a firewall block that generates another matching event and retriggers itself repeatedly; this mechanism addresses another problem.

A DLP match is evidence of a policy condition and its action must be checked to determine whether transfer was blocked or permitted. “Inspect DLP log action, matched rule, relevant content metadata and corresponding traffic session” would remedy that alternative situation, but it would not correct the present issue: a pattern of failed authentications can indicate brute-force activity even when no login has succeeded.

“Inspect source and destination fields, network zones, policy direction and signatures for the original log records” is the supported response when directional address fields describe traffic endpoints; incident roles cannot be assigned correctly if source and target are reversed. Here the decisive response is “Filter administrative event logs by user, source, outcome and interval and compare with successful access or account lockout events”, so that different intervention does not meet the stated requirement.

File filtering can block an object by its type without an antivirus malware verdict. “Inspect the file-filter event subtype, detected file type, policy and enforcement action” applies to that other condition. The reported evidence is fortiAnalyzer appliance event logs show repeated failed GUI logins for the same admin identity from a single untrusted address; this alternative would address the wrong dependency.

A controlled changed dataset yields the expected updated chart after cache handling is corrected. This is a different failure mechanism from the current case, which concerns a report content check verifies known detections are included in the appropriate section.

This option instead describes the customer report includes its new chart order while the original corporate template remains unchanged. Testing that independent mechanism would not show whether the reported fault has been resolved.

The report job completes within operational limits and returns reconciled results for the required interval. The stem describes a report task is marked completed, but the generated document has an empty threat table and the SOC treats the job as an error-free result, so this explanation does not account for the observations.

The cloned handler produces the intended test detection without changing the original system handler. This is a different failure mechanism from the current case, which concerns a failed VPN login creates a matching event, and unrelated traffic sessions do not trigger it.

This option instead describes a matching test from the branch triggers but the same pattern from an out-of-scope device does not. Testing that independent mechanism would not show whether the reported fault has been resolved.

A controlled matching security log produces the expected Event Monitor entry under the host view. The stem describes a custom rule looks for VPN authentication failures, but its data selector targets general traffic sessions rather than VPN events, so this explanation does not account for the observations.

That intervention addresses exported log sample cannot reproduce filter, where Exported rows without their query context are insufficient to reproduce the exact event population. Here, the relevant failure is instead: A case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity.

That intervention addresses conflicting event order due time zone, where Unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays. In this question the necessary remedy is “Open related logs from the incident and examine host, account, source, destination and precise timing for each stage”, which this alternative does not provide.

That intervention addresses overly narrow security-log severity filter, where Severity thresholds exclude all events below the chosen level regardless of their contextual investigative importance. The observed condition is a senior analyst receives a high-level incident summary but cannot verify the alleged lateral movement because the linked raw events are not included; this mechanism addresses another problem.

That intervention addresses scheduled report with missing source log category, where Report output cannot contain detections from log categories the originating devices did not generate or forward. Here, the relevant failure is instead: Grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute.

That intervention addresses multiple chart templates share one dataset, where A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. In this question the necessary remedy is “Validate identity-source integration and user-field availability, then report unknown users explicitly rather than fabricating attribution”, which this alternative does not provide.

That intervention addresses scheduled report timezone drift, where Scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. The observed condition is at a weekly executive reporting review, A report lists Unknown as the dominant user even though traffic devices and log volume are healthy; this mechanism addresses another problem.

The team can distinguish newly visible detections from a genuine rise in threat attempts. This is a different failure mechanism from the current case, which concerns the analyst explains why network policy allowed a session while a prohibited URL request was blocked.

This option instead describes the field can be read on the relevant messages without changing the original stored log. Testing that independent mechanism would not show whether the reported fault has been resolved.

Known sample records for either signature appear while unrelated benign traffic stays excluded. The stem describes a FortiGate traffic log shows an accepted policy action while associated web-filter records show a blocked URL transaction, so this explanation does not account for the observations.

Indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. “Verify the relevant IOC licensing and FortiGuard content update status before troubleshooting unrelated network policy” would remedy that alternative situation, but it would not correct the present issue: seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events.

“Compare the current raw record with the normalized schema and update supported mapping or dataset references” is the supported response when a change in producer field names or data types can invalidate saved SQL queries and parser mappings without stopping ingestion. Here the decisive response is “Verify the FortiMail log source registration, permissions and event log pipeline into the correct ADOM”, so that different intervention does not meet the stated requirement.

An enabled connector cannot manufacture telemetry that the originating device has stopped generating or forwarding. “Inspect source-side category settings and the data collection path for the log types required by the chosen SOC feature” applies to that other condition. The reported evidence is a phishing incident has mail gateway records in its own product, but the analyst sees only the destination firewall's web sessions in FortiAnalyzer; this alternative would address the wrong dependency.

Stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. “Monitor intelligence-feed age and distinguish historical matches from current reputation in playbooks” would remedy that alternative situation, but it would not correct the present issue: incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store.

“Require provenance and matching field context for indicators referenced in incident decisions” is the supported response when an indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. Here the decisive response is “Train responders to redact tokens from task logs and use approved secret references”, so that different intervention does not meet the stated requirement.

Live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated. “Require dry-run or isolated pilot evidence before enabling high-impact production playbooks” applies to that other condition. The reported evidence is a responder pastes full connector API credentials into an incident comment while documenting a failed automation run; this alternative would address the wrong dependency.

That intervention addresses multiple event-handler alerts for one incident, where Distinct event handlers may match different features of one underlying host incident, so count of alerts is not count of compromises. Here, the relevant failure is instead: An application-level aggregate alone does not identify individual users or show which endpoints were affected.

That intervention addresses user entity analytics baseline change, where Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. In this question the necessary remedy is “Filter the signature and action, then pivot to authenticated user, source IP and device records in the selected interval”, which this alternative does not provide.

That intervention addresses fortiview failed transaction due missing raw logs, where A summary, cache or earlier export may survive after the underlying log records required for drilldown have expired. The observed condition is a policy owner asks which users were affected by one newly blocked application signature during a scheduled change; this mechanism addresses another problem.