Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The generated chart shows the day of the spike and agrees with the underlying counts. This is a different failure mechanism from the current case, which concerns the report clearly identifies which dates contain verifiable data and any coverage gaps.

This option instead describes the correct audience receives the test document and unauthorized recipients do not. Testing that independent mechanism would not show whether the reported fault has been resolved.

The regional totals exclude unrelated sources and reconcile to an independently scoped Log View search. The stem describes a quarterly report request spans ninety days but the indexed Analytics retention policy retains only the latest month, so this explanation does not account for the observations.

That intervention addresses fortiview device filter hides new branch, where A saved device selection or group can exclude a newly added source even when collection and indexing work correctly. Here, the relevant failure is instead: An IOC association can be provisional, and the wrong host can be targeted when addresses or inventory identifiers are stale.

That intervention addresses fortiview top destinations after dns change, where Destination concentration can result from legitimate DNS or routing changes, not necessarily a newly targeted malicious server. In this question the necessary remedy is “Confirm endpoint identity, indicator context, current IP and related network activity before any authorized containment”, which this alternative does not provide.

That intervention addresses large transfer after unusual login, where A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. The observed condition is fortiAnalyzer flags an endpoint as potentially compromised after IOC matches, and an operator wants to isolate it immediately without validating identity; this mechanism addresses another problem.

The analyst prioritizes the privileged anomaly appropriately without altering the raw event severity field. This is a different failure mechanism from the current case, which concerns the investigation follows the same managed endpoint across its two assigned IP addresses.

This option instead describes the investigation identifies each affected host and the chronology of observed file detections. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analyst can identify whether the flagged flow actually touched the malicious service rather than a benign tenant on the same IP. The stem describes an infected client received a new IP address during the investigation, and a simple search by its old IP returns no recent traffic, so this explanation does not account for the observations.

Report output cannot contain detections from log categories the originating devices did not generate or forward. “Confirm the antivirus log source and category are enabled and verify fresh test data before retrying the report” would remedy that alternative situation, but it would not correct the present issue: grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute.

“Review report time zone, schedule and query period settings and test the boundary in a consistent reference time” is the supported response when scheduling time zone and dataset event-time interpretation can misalign reporting periods, particularly across DST changes. Here the decisive response is “Validate identity-source integration and user-field availability, then report unknown users explicitly rather than fabricating attribution”, so that different intervention does not meet the stated requirement.

Event occurrence time and log receipt time differ during buffering, and an inappropriate time field can shift daily totals. “Use the appropriate event-time field for the analytic question and check buffering delay in the dataset” applies to that other condition. The reported evidence is at a weekly executive reporting review, A report lists Unknown as the dominant user even though traffic devices and log volume are healthy; this alternative would address the wrong dependency.

Stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. “Check the current FortiGuard IOC update age and corroborate with recent observations before authorizing response” would remedy that alternative situation, but it would not correct the present issue: a failed mitigation increases unresolved risk and should not be treated as a completed incident response step.

“Apply a narrowly defined suppression or exception for the authorized scanner, expected signature and scheduled window” is the supported response when known scanner behavior explains selected detections but does not justify removing detection coverage network-wide. Here the decisive response is “Escalate the case according to risk, attach task failure evidence and assign a manual containment owner”, so that different intervention does not meet the stated requirement.

Views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. “Check handler tags and the view filter and align them to the documented intended category” applies to that other condition. The reported evidence is an analyst launches automated containment, but the connector reports failure and the incident remains assigned to a low-priority queue; this alternative would address the wrong dependency.

That intervention addresses ioc feed update during active investigation, where Stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. Here, the relevant failure is instead: Removing source evidence is not the same as recording a resolved incident outcome and may harm later audit or analysis.

That intervention addresses incident analyst notes contain secrets, where Incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store. In this question the necessary remedy is “Preserve required source records and use the supported case status and targeted suppression workflow as appropriate”, which this alternative does not provide.

That intervention addresses runbook tests without safe sandbox target, where Live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated. The observed condition is a responder proposes deleting noisy Event Monitor records after resolving an incident to keep dashboards uncluttered; this mechanism addresses another problem.

That intervention addresses case escalation after failed remediation, where A failed mitigation increases unresolved risk and should not be treated as a completed incident response step. Here, the relevant failure is instead: Known scanner behavior explains selected detections but does not justify removing detection coverage network-wide.

That intervention addresses mitre technique metadata does not trigger detection, where MITRE taxonomy metadata classifies a rule but does not itself define log matching conditions or event thresholds. In this question the necessary remedy is “Apply a narrowly defined suppression or exception for the authorized scanner, expected signature and scheduled window”, which this alternative does not provide.

That intervention addresses event alert tag not shared with investigation view, where Views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. The observed condition is an approved internal vulnerability scanner repeatedly triggers intrusion alerts, and analysts consider disabling IPS events for all hosts; this mechanism addresses another problem.

That intervention addresses event alert tag not shared with investigation view, where Views depend on event classification and saved filtering; event existence alone does not guarantee inclusion in every dashboard. Here, the relevant failure is instead: A reassigned incident can lose context when notes, evidence and executed actions are not retained within its audit history.

That intervention addresses incident case missing affected host scope, where A case without evidence-backed affected-asset context cannot be reliably routed or validated during response. In this question the necessary remedy is “Attach the source logs, timeline, prior decisions and playbook action results to the incident before reassignment”, which this alternative does not provide.

That intervention addresses incident grouping after multiple related alerts, where Overlapping detections may describe one underlying host investigation rather than independent incidents. The observed condition is an analyst transfers a malware case to the endpoint team without preserving the investigations and tools already run; this mechanism addresses another problem.

Session logs cannot show authenticated user identity unless the relevant identity source and log fields are available and associated. “Monitor identity-field coverage and treat large sudden unknown-user increases as a telemetry quality signal” would remedy that alternative situation, but it would not correct the present issue: high bandwidth volume alone does not prove malicious behavior and measures a different dimension from detections and security actions.

“Record time range and filters alongside saved dashboard screenshots in case notes” is the supported response when fortiView widgets obey their selected time ranges and filters; a narrow current interval can omit legitimate historical records. Here the decisive response is “Correlate traffic utilization metrics with security detections before assigning incident severity”, so that different intervention does not meet the stated requirement.

Traffic session totals and security threat detections count different records, each requiring its own log subtype and metric. “Label charts with the underlying log category and aggregation method before distributing risk summaries” applies to that other condition. The reported evidence is the operations team claims a workstation is the largest threat simply because it leads the FortiView traffic sources chart by transmitted bytes; this alternative would address the wrong dependency.

Some FortiAnalyzer SOC analytics functions depend on a Fabric ADOM and its configured log sources, not merely a licensed user account. “Use an eligible Fabric ADOM and onboard the required supported source data under the appropriate organizational boundary” would remedy that alternative situation, but it would not correct the present issue: collector mode concentrates on receiving and forwarding or retaining logs and does not offer the full local analysis functions available in Analyzer mode.

“Trace the configured collector-to-Analyzer forwarding path and run investigations on the intended analysis instance” is the supported response when the collection tier and the analytics tier can hold different operational functions and storage responsibilities in a distributed deployment. Here the decisive response is “Use an Analyzer-capable deployment for investigation and reporting, or forward logs from the Collector to its designated Analyzer”, so that different intervention does not meet the stated requirement.

An overly broad ADOM assignment breaks the logical security boundary even when device logging and database storage are otherwise functioning. “Restrict the administrator's ADOM assignments and privileges to the authorized tenant and test effective access” applies to that other condition. The reported evidence is an operator deploys a FortiAnalyzer instance in Collector mode and expects the same local FortiView and analytics capabilities that an Analyzer unit provides; this alternative would address the wrong dependency.

That intervention addresses lost data after too-short retention window, where Once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained. Here, the relevant failure is instead: Formatted log presentation can show selected parsed fields while raw messages preserve the full original key-value content.

That intervention addresses security fabric correlation without time alignment, where Independent device time formats and offsets can create a misleading chain when normalized event times are not aligned. In this question the necessary remedy is “Inspect the raw log for the target record and compare with its formatted fields and parsing definition”, which this alternative does not provide.

That intervention addresses fortianalyzer audit event gaps, where Firewall session telemetry is not the same evidence as administrative changes made directly on the analyzer appliance. The observed condition is an analyst cannot find an unfamiliar field in the formatted log display and concludes it never arrived from the device; this mechanism addresses another problem.