Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A test dataset returns expected malware records within the permitted historical Analytics interval. This is a different failure mechanism from the current case, which concerns a test report omits unnecessary identifiers and is delivered only to authorized recipients.

This option instead describes the cover period agrees with the actual dataset interval across a test scheduled report. Testing that independent mechanism would not show whether the reported fault has been resolved.

The auditors receive field-level evidence they can reconcile with the report's aggregate totals. The stem describes a scheduled report includes user identities and internal hostnames but is sent broadly to an external distribution list, so this explanation does not account for the observations.

That intervention addresses ioc indicator attribution to case, where An indicator value alone does not establish that the affected host generated the behavior or belongs to the malicious infrastructure. Here, the relevant failure is instead: Downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds.

That intervention addresses event handler duplicate severity routing, where Overlapping rules and notification routing can produce duplicated escalation for one underlying source event. In this question the necessary remedy is “Validate the required indicator field and route empty results to manual review or a safe no-action branch”, which this alternative does not provide.

That intervention addresses incident triggered by event with inadequate confidence, where Automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. The observed condition is an indicator-enrichment task sometimes returns no IP address and the next task tries to create a firewall object named with an empty string; this mechanism addresses another problem.

The connector reports healthy access and new enrichment appears against the related incident records. This is a different failure mechanism from the current case, which concerns an investigation can identify the exact originating serial regardless of the device's human-readable label.

This option instead describes the relevant endpoint identity or security events can be correlated with network activity in the supported view. Testing that independent mechanism would not show whether the reported fault has been resolved.

Known test messages fall into their intended search windows with consistent raw and parsed event time. The stem describes two branch FortiGate devices share a reused descriptive name, causing operators to attribute an observed threat log to the wrong physical appliance, so this explanation does not account for the observations.

A macro expects a defined dataset field, and alias changes can break the reference even when the SQL returns data. “Restore the macro's expected field alias or update the supported macro definition to match the new query” would remedy that alternative situation, but it would not correct the present issue: counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host.

“Align the dataset's time constraints with the report period variables and test boundary timestamps” is the supported response when an extra hard-coded dataset time predicate can conflict with report-wide period parameters and silently exclude records. Here the decisive response is “Modify the supported SQL dataset to group by the relevant host identifier and apply the appropriate distinct-count logic”, so that different intervention does not meet the stated requirement.

Predefined datasets are reusable built-in resources and are not edited or deleted like analyst-created custom datasets. “Clone the predefined dataset and customize the copy while preserving the original for other charts” applies to that other condition. The reported evidence is a report claims hundreds of unique infected endpoints but counts every IPS log message instead of distinct source hosts; this alternative would address the wrong dependency.

Log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. “Check traffic-log generation, category selection and Log View filters rather than diagnosing a complete device outage” would remedy that alternative situation, but it would not correct the present issue: some FortiAnalyzer SOC analytics functions depend on a Fabric ADOM and its configured log sources, not merely a licensed user account.

“Use an Analyzer-capable deployment for investigation and reporting, or forward logs from the Collector to its designated Analyzer” is the supported response when collector mode concentrates on receiving and forwarding or retaining logs and does not offer the full local analysis functions available in Analyzer mode. Here the decisive response is “Use an eligible Fabric ADOM and onboard the required supported source data under the appropriate organizational boundary”, so that different intervention does not meet the stated requirement.

An overly broad ADOM assignment breaks the logical security boundary even when device logging and database storage are otherwise functioning. “Restrict the administrator's ADOM assignments and privileges to the authorized tenant and test effective access” applies to that other condition. The reported evidence is an analyst tries to open a Fabric-specific threat hunting workflow within an ordinary device ADOM and the relevant SOC feature is missing; this alternative would address the wrong dependency.

That intervention addresses playbook task timeout and retry controls, where A timeout does not prove the remote action failed, so blindly repeating non-idempotent tasks can cause inconsistent state. Here, the relevant failure is instead: Threat-centric and endpoint-centric views group the same underlying detections differently and serve distinct investigation pivots.

That intervention addresses playbook export includes sensitive connector references, where Exporting automation definitions can expose integration details and requires review of embedded connectors or credential references. In this question the necessary remedy is “Use the relevant endpoint-oriented event view or pivot by source host while retaining the threat indicator context”, which this alternative does not provide.

That intervention addresses playbook sequence after successful approval, where Trigger conditions alone do not provide the required independent approval boundary for a disruptive change. The observed condition is an analyst sees botnet alerts in a threat view but cannot quickly identify all endpoints associated with that command server; this mechanism addresses another problem.

Historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. “Compare original indicator definition time with the current feed and retain the case evidence provenance” would remedy that alternative situation, but it would not correct the present issue: unnormalized timestamps from distinct devices can create false event order or apparent gaps when investigators compare displays.

“Record the scoped Log View filter conditions and export metadata alongside the preserved rows” is the supported response when exported rows without their query context are insufficient to reproduce the exact event population. Here the decisive response is “Normalize source timestamps to one standard and check the device clock and daylight saving settings”, so that different intervention does not meet the stated requirement.

A case summary without traceable underlying log records lacks sufficient evidence to validate the asserted chain of activity. “Open related logs from the incident and examine host, account, source, destination and precise timing for each stage” applies to that other condition. The reported evidence is an incident dashboard displays two detections an hour apart, but one device records UTC and the other local summertime; this alternative would address the wrong dependency.

Stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. “Check the current FortiGuard IOC update age and corroborate with recent observations before authorizing response” would remedy that alternative situation, but it would not correct the present issue: a historical IP address may no longer identify the affected endpoint at the moment of automated containment.

“Validate indicator type and map the appropriate field to a supported connector action before executing” is the supported response when connector actions require correctly typed parameters; URL, domain and IP indicators are not interchangeable inputs. Here the decisive response is “Revalidate current identity and address ownership before applying a reversible block on the proper enforcement device”, so that different intervention does not meet the stated requirement.

A small Boolean condition change can greatly alter automation scope and must be treated as a privileged response-policy change. “Review the saved trigger filters, restore the approved logic and examine administrative audit events for the modification” applies to that other condition. The reported evidence is a delayed incident playbook blocks the IP address once used by a compromised laptop even though DHCP has reassigned it to an unrelated server; this alternative would address the wrong dependency.

A controlled connection test confirms the intended protected log channel without relying on an unverified default. This is a different failure mechanism from the current case, which concerns fresh sessions matching that policy produce entries carrying the expected policy identifier and action.

This option instead describes a known permitted and denied test flow produces the expected records on FortiAnalyzer with the right device identity. Testing that independent mechanism would not show whether the reported fault has been resolved.

A permitted analyst sees new device logs in the intended ADOM while an unrelated tenant remains isolated. The stem describes a critical FortiGate policy forwards Internet traffic but sends no session entries to FortiAnalyzer while other policies produce records normally, so this explanation does not account for the observations.

A new qualifying test event creates a related incident with traceable event evidence. This is a different failure mechanism from the current case, which concerns a branch test message generates the desired event without leaking unrelated tenant data.

This option instead describes normal scanner activity stops generating duplicate cases while the same pattern from an unapproved host still alerts. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident stays active with clear ownership until an independent test verifies mitigation. The stem describes a cloned handler is enabled in the headquarters ADOM but expected branch log messages are present only under the regional ADOM, so this explanation does not account for the observations.

The report charts show the branch's known detection records without importing unrelated tenant logs. This is a different failure mechanism from the current case, which concerns a known sample interval produces consistent dataset rows and chart totals after validation.

This option instead describes the correct audience receives the test document and unauthorized recipients do not. Testing that independent mechanism would not show whether the reported fault has been resolved.

The generated chart shows the day of the spike and agrees with the underlying counts. The stem describes a newly created chart displays plausible values, but the dataset query has not been tested against the intended ADOM and device logs, so this explanation does not account for the observations.