Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. “Check the feature's enablement, deployment mode and required indexed logs separately from raw ingestion” would remedy that alternative situation, but it would not correct the present issue: the same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata.

“Update the approved log group or device selection and recompute the regional analysis for the affected period” is the supported response when log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation. Here the decisive response is “Record the underlying event timestamp and timezone conversion in the evidence package and verify it against raw records”, so that different intervention does not meet the stated requirement.

Product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. “Check current Fortinet release documentation and supported upgrade paths, then test critical analytics and connectors” applies to that other condition. The reported evidence is an investigator exports filtered events for a partner working in UTC and fails to record whether the displayed time is local console time; this alternative would address the wrong dependency.

A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. “Build account-centric authentication alerts with success-after-failures logic and contextual enrichment” would remedy that alternative situation, but it would not correct the present issue: IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof.

“Review category changes and keep exception requests tied to specific logged URLs and users” is the supported response when a category-based web-filter policy can block a site even without an identified malware signature. Here the decisive response is “Use geolocation anomalies as one factor in a privileged access review rather than a standalone compromise verdict”, so that different intervention does not meet the stated requirement.

DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP. “Correlate DNS filter results with traffic and endpoint evidence before concluding beacon success” applies to that other condition. The reported evidence is a privileged admin account logs in from an unfamiliar geographic location and the SOC needs to assess the risk without assuming geolocation is definitive; this alternative would address the wrong dependency.

That intervention addresses sql grouping double counts device sessions, where Counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host. Here, the relevant failure is instead: Successful report generation and successful email delivery are separate stages with independent transport dependencies.

That intervention addresses dataset time filter excludes reporting week, where An extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records. In this question the necessary remedy is “Inspect report output profile and mail server configuration and resolve delivery authentication or routing errors”, which this alternative does not provide.

That intervention addresses predefined dataset cloned for customization, where Predefined datasets are reusable built-in resources and are not edited or deleted like analyst-created custom datasets. The observed condition is the task monitor shows a report was generated, yet executives received no attached file after a mail relay configuration change; this mechanism addresses another problem.

ADOM separation restricts the inventory and data scope used by analytics and incident workflows by design. “Use a deliberately authorized cross-domain reporting design or run scoped analysis within each ADOM as policy allows” would remedy that alternative situation, but it would not correct the present issue: destination configuration alone does not prove negotiated transport security or trusted endpoint identity.

“Search by stable device identifiers across the move and map the old and new friendly names to the same asset” is the supported response when hostname changes do not necessarily change underlying device serial identity but can make name-only searches incomplete. Here the decisive response is “Use the supported secured Fortinet logging transport and verify certificate or authenticated channel settings where required”, so that different intervention does not meet the stated requirement.

Raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type. “Verify the Analytics log availability, ADOM scope and relevant indexed log subtype before debugging the report template” applies to that other condition. The reported evidence is a security architect assumes that merely entering a FortiAnalyzer IP guarantees encrypted log traffic across an untrusted network; this alternative would address the wrong dependency.

Connection duration alone may include idle time and is not identical to end-user application response latency. “Define performance metrics explicitly before using FortiView connection durations as service health indicators” would remedy that alternative situation, but it would not correct the present issue: one endpoint can generate many related DNS and HTTP observations for the same indicator across a short period.

“Avoid promising file-content recovery from standard event logs without verifying actual sample collection” is the supported response when metadata in a security log does not imply the analyzer stores an accessible full copy of the transmitted payload. Here the decisive response is “Use distinct-host counts and explicit observation counts for threat intelligence dashboards”, so that different intervention does not meet the stated requirement.

Identical usernames do not prove both sessions originated from the same approved management path. “Alert on privileged access outside trusted sources and monitor configuration of administrative trusted hosts” applies to that other condition. The reported evidence is a malicious domain appears in both DNS and web-filter records, but the analyst incorrectly counts every record as a distinct infected host; this alternative would address the wrong dependency.

Evidence shows whether the transfer was prevented or if follow-up host inspection is required. This is a different failure mechanism from the current case, which concerns the single long-lived session is distinguished from genuinely separate connections when reconciling daily totals.

This option instead describes the analyst can identify which protected assets were targeted and which attempts were blocked or progressed. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident report states whether the attempt was blocked, permitted or corroborated by host compromise evidence. The stem describes an analyst observes an application session lasting through midnight but believes it was created twice because daily charts display activity on both dates, so this explanation does not account for the observations.

Imported historical records preserve their original source attributes rather than becoming new events produced by the replacement. “Inspect source serial and import provenance and maintain the historical device attribution during retrospective analysis” would remedy that alternative situation, but it would not correct the present issue: local collection may continue while the forwarding link is down, and upstream analysis has a freshness gap until forwarding resumes.

“Configure an available IOC rescan policy for the supported log history and keep the threat database current” is the supported response when existing historical logs are not necessarily re-evaluated against every later intelligence update without the relevant rescan workflow. Here the decisive response is “Restore the supported Collector-to-Analyzer path and validate backlog forwarding or recovery behavior”, so that different intervention does not meet the stated requirement.

The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. “Register and authorize the new serial, assign the appropriate ADOM and preserve the retired unit's historical records” applies to that other condition. The reported evidence is a regional Collector records events locally but central investigations stop receiving the region's new events during a WAN outage; this alternative would address the wrong dependency.

Normal scanner activity stops generating duplicate cases while the same pattern from an unapproved host still alerts. This is a different failure mechanism from the current case, which concerns a qualifying log generates an event that carries the intended classification metadata.

This option instead describes the test event appears in the targeted threat view with its linked log intact. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident stays active with clear ownership until an independent test verifies mitigation. The stem describes a detection engineer assigns a MITRE technique label to an event handler and expects matching attack events without creating log rules, so this explanation does not account for the observations.

The receiving analyst can reconstruct prior work without repeating intrusive containment actions. This is a different failure mechanism from the current case, which concerns the resolved case remains auditable and unrelated or future security events still appear normally.

This option instead describes a deliberate test blocks only the expected benign target and the reversal procedure restores baseline state. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident contains useful error evidence without revealing the credential, and the old token no longer works. The stem describes a responder proposes deleting noisy Event Monitor records after resolving an incident to keep dashboards uncluttered, so this explanation does not account for the observations.

That intervention addresses report macro expects one scalar value, where A report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. Here, the relevant failure is instead: Charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records.

That intervention addresses predefined report scope wrong adom, where A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. In this question the necessary remedy is “Inspect the chart's dataset reference and attach a compatible tested dataset to the report template”, which this alternative does not provide.

That intervention addresses dataset query uses wrong log type, where Dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields. The observed condition is a copied report template contains a chart placeholder but the plot remains blank after generation even though the ADOM has recent data; this mechanism addresses another problem.

Event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome. “Use asset criticality, exposure, action and event evidence to set triage priority separately from source severity” would remedy that alternative situation, but it would not correct the present issue: a summary, cache or earlier export may survive after the underlying log records required for drilldown have expired.

“Filter the signature and action, then pivot to authenticated user, source IP and device records in the selected interval” is the supported response when an application-level aggregate alone does not identify individual users or show which endpoints were affected. Here the decisive response is “Verify actual raw or Analytics retention and avoid presenting a stale summary as if all supporting events remain available”, so that different intervention does not meet the stated requirement.

Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. “Correlate the anomaly with the approved job, identity, endpoints and data volume to confirm or challenge its explanation” applies to that other condition. The reported evidence is a widget contains a historical point but a click-through to individual records returns no results after retention cleanup; this alternative would address the wrong dependency.