Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Event severity is one dimension and does not automatically determine operational priority without asset importance or confirmed outcome. “Use asset criticality, exposure, action and event evidence to set triage priority separately from source severity” would remedy that alternative situation, but it would not correct the present issue: a summary, cache or earlier export may survive after the underlying log records required for drilldown have expired.

“Filter the signature and action, then pivot to authenticated user, source IP and device records in the selected interval” is the supported response when an application-level aggregate alone does not identify individual users or show which endpoints were affected. Here the decisive response is “Verify actual raw or Analytics retention and avoid presenting a stale summary as if all supporting events remain available”, so that different intervention does not meet the stated requirement.

Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. “Correlate the anomaly with the approved job, identity, endpoints and data volume to confirm or challenge its explanation” applies to that other condition. The reported evidence is a widget contains a historical point but a click-through to individual records returns no results after retention cleanup; this alternative would address the wrong dependency.

The analyst can explain the two outcomes by their distinct names or policy conditions. This is a different failure mechanism from the current case, which concerns the analyst can identify which protected assets were targeted and which attempts were blocked or progressed.

This option instead describes the report identifies the true high-bandwidth clients separately from high-connection-rate sources. Testing that independent mechanism would not show whether the reported fault has been resolved.

Evidence shows whether the transfer was prevented or if follow-up host inspection is required. The stem describes the SOC sees repeated IPS logs for one signature from dozens of public source IPs and needs to determine if a coordinated campaign is under way, so this explanation does not account for the observations.

Threat-centric and endpoint-centric views group the same underlying detections differently and serve distinct investigation pivots. “Use the relevant endpoint-oriented event view or pivot by source host while retaining the threat indicator context” would remedy that alternative situation, but it would not correct the present issue: exporting automation definitions can expose integration details and requires review of embedded connectors or credential references.

“Route detection to an approval or manual on-demand response step and execute the blocking connector only after authorization” is the supported response when trigger conditions alone do not provide the required independent approval boundary for a disruptive change. Here the decisive response is “Export the necessary playbook content with connector inclusion deliberately controlled and sanitized for the recipient”, so that different intervention does not meet the stated requirement.

Suppressing future duplicate alerts does not replace the need to retain source logs and prior event evidence. “Use scoped suppression for the ongoing noise while preserving the incident and original relevant event records” applies to that other condition. The reported evidence is an analyst exports a working playbook to share externally without checking the included connector information and its destination environment; this alternative would address the wrong dependency.

An external translated address alone may represent many internal sources and cannot uniquely identify one initiating host. “Retain full session and translation fields needed to attribute shared-address events during investigations” would remedy that alternative situation, but it would not correct the present issue: aggregated visual summaries omit some record-level fields needed to explain the exact policy decision.

“Use action-aware interpretation in triage and avoid labeling every denied session a breach” is the supported response when a denied traffic action records a blocked attempt rather than confirmation of successful permitted access or compromise. Here the decisive response is “Preserve traceable event IDs or filters when converting dashboard observations into policy-change requests”, so that different intervention does not meet the stated requirement.

A shared CDN endpoint can serve many unrelated legitimate web services, so destination frequency alone cannot establish malicious purpose. “Require supporting content or detection context before blocking high-volume shared cloud destinations” applies to that other condition. The reported evidence is a FortiView traffic chart shows a surge during a narrow interval, but the team cannot explain which firewall rule allowed the sessions; this alternative would address the wrong dependency.

Once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained. “Confirm available historical data and recover from a separately maintained compliant archive where technically supported” would remedy that alternative situation, but it would not correct the present issue: the replacement is a separate physical source identity, so device authorization and inventory associations can require updating.

“Restore the supported Collector-to-Analyzer path and validate backlog forwarding or recovery behavior” is the supported response when local collection may continue while the forwarding link is down, and upstream analysis has a freshness gap until forwarding resumes. Here the decisive response is “Register and authorize the new serial, assign the appropriate ADOM and preserve the retired unit's historical records”, so that different intervention does not meet the stated requirement.

Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure. “Inspect disk quota and data policy status, then correct capacity, retention or priority settings within supported limits” applies to that other condition. The reported evidence is a failed firewall is replaced under a new hardware serial and the SOC expects its replacement traffic to appear under the retired device without adjustment; this alternative would address the wrong dependency.

Event generation does not itself prove a notification action is configured and connected to the correct handler. “Test notification profile recipients and transport after on-call roster and mail-server changes” would remedy that alternative situation, but it would not correct the present issue: alert severity configured without business impact or enforcement outcome may distort incident response priorities.

“Document sequence, grouping and expiration conditions when maintaining multi-stage detections” is the supported response when a simple event count does not establish the order or relationship of multiple steps required for an attack pattern. Here the decisive response is “Periodically compare event severity with actual response outcomes and tune over- or under-escalating handlers”, so that different intervention does not meet the stated requirement.

Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. “Include tag and dashboard routing in event handler acceptance tests” applies to that other condition. The reported evidence is a noisy blocked scan triggers a critical incident while a privileged authentication anomaly is marked low without asset context; this alternative would address the wrong dependency.

That intervention addresses dns and web filter indicator disagreement, where Different hostnames or cached endpoints can share an IP and different security profiles evaluate different request fields. Here, the relevant failure is instead: Destination IP totals do not reliably identify a detected application, especially when multiple services share hosting addresses.

That intervention addresses fortiview dashboard time window mismatch, where FortiView widgets obey their selected time ranges and filters; a narrow current interval can omit legitimate historical records. In this question the necessary remedy is “Use an application-oriented FortiView view or related application-control logs with source and time filters”, which this alternative does not provide.

That intervention addresses fortiview user identity empty for sessions, where Session logs cannot show authenticated user identity unless the relevant identity source and log fields are available and associated. The observed condition is a department wants to know which application generated a spike in outbound traffic but starts from the generic top-destination IP list; this mechanism addresses another problem.

Known test users produce events with attributable identities while genuinely unidentified sessions remain distinct. This is a different failure mechanism from the current case, which concerns the analyst can explain the two outcomes by their distinct names or policy conditions.

This option instead describes the investigation distinguishes a TLS trust failure from policy rejection or threat blocking. Testing that independent mechanism would not show whether the reported fault has been resolved.

The case distinguishes a delivered lure, a clicked URL and any blocked or successful follow-on connection. The stem describes the DNS filter blocks a suspicious hostname, but a web-filter dashboard shows a permitted request to a different hostname at the same IP, so this explanation does not account for the observations.

A denied traffic action records a blocked attempt rather than confirmation of successful permitted access or compromise. “Separate deny from accept actions and correlate with subsequent allowed sessions and endpoint or server evidence” would remedy that alternative situation, but it would not correct the present issue: a shared CDN endpoint can serve many unrelated legitimate web services, so destination frequency alone cannot establish malicious purpose.

“Confirm the historical policy identity and change timestamp before attributing a saved traffic event to the current rule text” is the supported response when policy identifiers and configuration context must be interpreted against the configuration effective when the event was logged. Here the decisive response is “Inspect resolved domains, applications, web-filter categories, security actions and affected user behavior”, so that different intervention does not meet the stated requirement.

An external translated address alone may represent many internal sources and cannot uniquely identify one initiating host. “Correlate the session's original source fields, NAT translation details, ports and timestamp with the relevant firewall logs” applies to that other condition. The reported evidence is an analyst flags a content delivery network IP as suspicious because it appears in thousands of destination sessions across departments; this alternative would address the wrong dependency.

That intervention addresses suppression remains after travel ends, where A suppression kept beyond its legitimate time window can conceal subsequent security-relevant activity. Here, the relevant failure is instead: Uncontrolled repeated detections can create duplicate work even when the cause of the specific known event is understood.

That intervention addresses event suppression too broad for shared user, where Suppression criteria without precise identity and event scope can hide unrelated true-positive detections. In this question the necessary remedy is “Apply a narrowly scoped event suppression rule for the known source, event and approved maintenance interval”, which this alternative does not provide.

That intervention addresses handler not enabled after creation, where Configuring a handler's rules is insufficient until the handler is enabled for event generation. The observed condition is an event handler raises a new case for each identical benign maintenance action and floods the incident queue during planned work; this mechanism addresses another problem.

That intervention addresses log parser severity string mapping, where Producer-specific severity encodings may not map into the analyzer's normalized severity field without a suitable parser definition. Here, the relevant failure is instead: Connector reachability does not imply the remote API grants the specific permitted operations required for the SOC workflow.

That intervention addresses log source selector overbroad correlation, where Queries without appropriate source restrictions can combine multiple devices that share the same private IP addresses. In this question the necessary remedy is “Grant the minimal supported API permissions for the needed read operation and retest connector action authorization”, which this alternative does not provide.

That intervention addresses lost data after too-short retention window, where Once required logs have aged out under data policy, an on-screen search cannot reconstruct evidence that was not retained. The observed condition is an enrichment connector is online but cannot retrieve device status because the external API account has only an unrelated read permission; this mechanism addresses another problem.