Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses playbook task branch unreachable, where Disconnected or incorrectly configured task routes can make a branch unreachable regardless of the input event. Here, the relevant failure is instead: Predefined event handlers can restrict direct editing of their original configuration and are intended as reusable templates.

That intervention addresses basic event rule wrong log category, where A rule cannot match required authentication fields when its selected log source or subtype does not contain them. In this question the necessary remedy is “Clone the appropriate built-in handler and edit the supported rules, scope and thresholds in the custom copy”, which this alternative does not provide.

That intervention addresses predefined event handler disabled, where A predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. The observed condition is a team needs to customize an existing malware event handler for its regulated servers, but several protected built-in fields cannot be edited; this mechanism addresses another problem.

Task completion in the automation engine does not by itself prove the desired enforcement or downstream configuration state. “Require destination-state verification for high-impact automation rather than relying on a green job icon alone” would remedy that alternative situation, but it would not correct the present issue: a rule cannot match required authentication fields when its selected log source or subtype does not contain them.

“Monitor disabled built-in handlers and record which views depend on each detection rule” is the supported response when a predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. Here the decisive response is “Test event handlers using authentic sample log types instead of assumptions about similar field names”, so that different intervention does not meet the stated requirement.

A single denied connection is insufficient evidence for a multi-attempt scan and yields excessive false-positive events. “Review alert volume and baseline traffic before changing scan detection sensitivity” applies to that other condition. The reported evidence is a custom rule looks for VPN authentication failures, but its data selector targets general traffic sessions rather than VPN events; this alternative would address the wrong dependency.

The analyst explains why network policy allowed a session while a prohibited URL request was blocked. This is a different failure mechanism from the current case, which concerns a single observed attempt retains both supporting detections without being counted as two independent compromises.

This option instead describes the reconstructed transfer shows consistent sent and received measures for the relevant vantage point. Testing that independent mechanism would not show whether the reported fault has been resolved.

The timeline establishes whether a policy deployment coincides with the observed change in blocked traffic. The stem describes the same malicious destination generates IPS and web-filter alerts on one firewall, and the incident count doubles when the SOC treats them as separate attacks, so this explanation does not account for the observations.

That intervention addresses playbook task output type is null, where Downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds. Here, the relevant failure is instead: Receiving external alert logs may require a suitable enabled event-collector handler to transform the ingested alert into an event.

That intervention addresses incident evidence preserved during event suppression, where Suppressing future duplicate alerts does not replace the need to retain source logs and prior event evidence. In this question the necessary remedy is “Review the external event source and enable or tune the supported ingested-event handler and its scope”, which this alternative does not provide.

That intervention addresses playbook export includes sensitive connector references, where Exporting automation definitions can expose integration details and requires review of embedded connectors or credential references. The observed condition is a third-party security system forwards an external alert successfully, but the SOC does not see a corresponding Event Monitor record; this mechanism addresses another problem.

An alert dependent on parsed fields can stop matching when the parser schema or producer keys change. “Compare the current raw payload, parsed fields and alert query and repair the supported mapping or condition” would remedy that alternative situation, but it would not correct the present issue: product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade.

“Record the underlying event timestamp and timezone conversion in the evidence package and verify it against raw records” is the supported response when the same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata. Here the decisive response is “Check current Fortinet release documentation and supported upgrade paths, then test critical analytics and connectors”, so that different intervention does not meet the stated requirement.

A disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. “Check the feature's enablement, deployment mode and required indexed logs separately from raw ingestion” applies to that other condition. The reported evidence is before upgrading a FortiAnalyzer in production, the team assumes that every connected FortiGate and integration will remain supported unchanged; this alternative would address the wrong dependency.

That intervention addresses logging health with clustered fortigate devices, where HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity. Here, the relevant failure is instead: Historical threat hunts require suitable retained records, and discarding indexed logs reduces the evidence available to future searches.

That intervention addresses adom log role access versus global login, where Successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. In this question the necessary remedy is “Estimate required retrospective hunt windows and adjust retention with approved archival or capacity measures first”, which this alternative does not provide.

That intervention addresses central log backup verification, where A completed backup job is not proof that the required stored log files are intact and recoverable for investigation. The observed condition is the SOC is about to shorten analytics retention for an emergency disk cleanup while relying on threat hunting to investigate older campaigns; this mechanism addresses another problem.

Traffic session totals and security threat detections count different records, each requiring its own log subtype and metric. “Select a threats-focused dashboard and validate detections against underlying IPS, antivirus or other security logs” would remedy that alternative situation, but it would not correct the present issue: hash equality identifies matching file content but does not alone establish when or how each endpoint obtained it.

“Compare original indicator definition time with the current feed and retain the case evidence provenance” is the supported response when historical indicator matches and current intelligence status can differ as feeds evolve; neither should silently replace the other. Here the decisive response is “Group supported malware or endpoint logs by hash and correlate host, user, time and delivery method”, so that different intervention does not meet the stated requirement.

The same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous. “Restrict events by tenant ADOM, device and VDOM before pivoting on the private source address” applies to that other condition. The reported evidence is the SOC finds an identical suspicious file hash on several endpoints and wants to know whether it represents a shared incident; this alternative would address the wrong dependency.

Broad internal management-port scanning can suggest lateral movement, but accepted sessions need distinct identity and server context. “Monitor unusual east-west administration patterns and require supporting login evidence before claiming compromise” would remedy that alternative situation, but it would not correct the present issue: changes in log collection or security profile configuration can alter observed detection counts independently of real attack frequency.

“Use profile-specific actions rather than relying on one generic action field for all outcomes” is the supported response when firewall session policy acceptance and downstream security profile enforcement refer to different decisions in the traffic path. Here the decisive response is “Annotate security dashboard baselines with logging and signature change events”, so that different intervention does not meet the stated requirement.

Combining mutually exclusive predicates with AND can eliminate matches that would satisfy a properly grouped OR condition. “Test Boolean filters against positive and negative fixtures before using them in production hunts” applies to that other condition. The reported evidence is a dashboard shows a sharp spike in blocked threat events, but the SOC assumes the attackers increased without checking whether device logging recently changed; this alternative would address the wrong dependency.

A query predicate using an incorrect field name or value representation can exclude all matches. “Inspect raw and normalized action values and adjust the dataset's supported SQL predicate accordingly” would remedy that alternative situation, but it would not correct the present issue: report caching can reuse prepared results rather than recomputing every query immediately under all conditions.

“Inspect report diagnostic and task logs, then narrow or optimize dataset queries and schedule supported workloads” is the supported response when expensive broad SQL queries and report concurrency can exceed the available analytics processing resources. Here the decisive response is “Review auto-cache behavior and regenerate the report or refresh data appropriately for the new dataset definition”, so that different intervention does not meet the stated requirement.

Editing a shared baseline template can alter multiple reports or remove a known-good rollback point. “Clone the appropriate report or template and change the cloned layout for the specific audience” applies to that other condition. The reported evidence is a chart continues to show old values after its dataset query was changed and the analyst suspects the revision did not save; this alternative would address the wrong dependency.

Raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type. “Verify the Analytics log availability, ADOM scope and relevant indexed log subtype before debugging the report template” would remedy that alternative situation, but it would not correct the present issue: a disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally.

“Update the approved log group or device selection and recompute the regional analysis for the affected period” is the supported response when log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation. Here the decisive response is “Check the feature's enablement, deployment mode and required indexed logs separately from raw ingestion”, so that different intervention does not meet the stated requirement.

Product-version compatibility, schema transitions and required upgrade paths can affect log ingestion and SOC features after an upgrade. “Check current Fortinet release documentation and supported upgrade paths, then test critical analytics and connectors” applies to that other condition. The reported evidence is an operator assumes missing FortiView data proves the FortiGate has stopped logging, but Log View still shows current raw records; this alternative would address the wrong dependency.

That intervention addresses sql filter on action mismatches stored values, where A query predicate using an incorrect field name or value representation can exclude all matches. Here, the relevant failure is instead: Report output cannot contain detections from log categories the originating devices did not generate or forward.

That intervention addresses multiple chart templates share one dataset, where A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. In this question the necessary remedy is “Confirm the antivirus log source and category are enabled and verify fresh test data before retrying the report”, which this alternative does not provide.

That intervention addresses report group-by user with unknown identities, where Grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute. The observed condition is a weekly antivirus report generates successfully but is empty because endpoint security log generation was disabled upstream during maintenance; this mechanism addresses another problem.