Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses sql filter on action mismatches stored values, where A query predicate using an incorrect field name or value representation can exclude all matches. Here, the relevant failure is instead: Report output cannot contain detections from log categories the originating devices did not generate or forward.

That intervention addresses multiple chart templates share one dataset, where A shared dataset is a dependency for multiple charts, so editing it affects every consumer referencing the same query. In this question the necessary remedy is “Confirm the antivirus log source and category are enabled and verify fresh test data before retrying the report”, which this alternative does not provide.

That intervention addresses report group-by user with unknown identities, where Grouping by user field collapses sessions lacking identity enrichment and cannot reconstruct names from an empty log attribute. The observed condition is a weekly antivirus report generates successfully but is empty because endpoint security log generation was disabled upstream during maintenance; this mechanism addresses another problem.

Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. “Assign the appropriate event view tags to the custom handler and verify its output classification” would remedy that alternative situation, but it would not correct the present issue: event generation does not itself prove a notification action is configured and connected to the correct handler.

“Review handler severity and asset criticality and adjust the rule or triage policy using documented evidence” is the supported response when alert severity configured without business impact or enforcement outcome may distort incident response priorities. Here the decisive response is “Configure and associate an authorized notification profile with the event handler and test delivery”, so that different intervention does not meet the stated requirement.

An excessive correlation window can connect unrelated events that happen to share a hostname or indicator. “Tighten the temporal window and grouping to the actual attacker behavior and test historical false positives” applies to that other condition. The reported evidence is a serious event is visible in Event Monitor but the on-call team receives no email despite expecting notification; this alternative would address the wrong dependency.

That intervention addresses report macro expects one scalar value, where A report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. Here, the relevant failure is instead: Report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records.

That intervention addresses report chart missing its dataset, where Charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records. In this question the necessary remedy is “Verify Analytics log retention for the needed period and use a supported data reprocessing workflow if available”, which this alternative does not provide.

That intervention addresses predefined report scope wrong adom, where A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. The observed condition is a monthly malware report returns no chart data although archived raw log files exist for the same period; this mechanism addresses another problem.

That intervention addresses fortianalyzer local report prerequisites, where Raw log retention and indexed analytical data are different prerequisites, and reports require queryable records of the correct type. Here, the relevant failure is instead: An alert dependent on parsed fields can stop matching when the parser schema or producer keys change.

That intervention addresses device group membership stale after relocation, where Log group membership is a reporting scope setting and may outlive a physical branch's inventory relocation. In this question the necessary remedy is “Compare the current raw payload, parsed fields and alert query and repair the supported mapping or condition”, which this alternative does not provide.

That intervention addresses analytics data timezone in exported evidence, where The same event can be rendered in different time zones, making an exported sequence ambiguous without time-base metadata. The observed condition is an alert rule compares normalized destination names, but after a parser update that field becomes empty for one incoming log subtype; this mechanism addresses another problem.

Email detection and subsequent web access must be correlated across distinct products using consistent user and time context. “Exercise multi-product phishing investigation with controlled sample events and source-aware searches” would remedy that alternative situation, but it would not correct the present issue: a suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category.

“Maintain a planned change calendar when baselining network and application flow anomalies” is the supported response when destination concentration can result from legitimate DNS or routing changes, not necessarily a newly targeted malicious server. Here the decisive response is “Use multi-stage timeline correlation to investigate unusual authentication followed by data movement”, so that different intervention does not meet the stated requirement.

Different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies. “Maintain accurate asset classification and use it when interpreting user and entity analytics” applies to that other condition. The reported evidence is one account logs in through VPN from a new location and later transfers an atypically large volume of data to an external service; this alternative would address the wrong dependency.

An event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled. “Apply automatic case creation selectively to avoid turning low-value noise into a backlog of incidents” would remedy that alternative situation, but it would not correct the present issue: overlapping rules and notification routing can produce duplicated escalation for one underlying source event.

“Track incident-to-confirmed-issue ratios and adjust only evidence-backed detection thresholds” is the supported response when automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. Here the decisive response is “Review alert deduplication and on-call assignments whenever adding or cloning event handlers”, so that different intervention does not meet the stated requirement.

Log collection and automated response are separate capabilities, and workflow suspension can create a response gap. “Include automation validation in maintenance recovery alongside log ingestion checks” applies to that other condition. The reported evidence is two notification profiles are attached through overlapping handler rules, causing one detection to page two teams with contradictory severity labels; this alternative would address the wrong dependency.

A predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. “Identify the relevant built-in detection handler and enable it with an appropriate rule and event scope” would remedy that alternative situation, but it would not correct the present issue: a single denied connection is insufficient evidence for a multi-attempt scan and yields excessive false-positive events.

“Constrain the handler to the approved source devices and relevant authentication logs” is the supported response when without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope. Here the decisive response is “Configure an appropriate occurrence threshold and time window grouped by source and target as supported”, so that different intervention does not meet the stated requirement.

Predefined event handlers can restrict direct editing of their original configuration and are intended as reusable templates. “Clone the appropriate built-in handler and edit the supported rules, scope and thresholds in the custom copy” applies to that other condition. The reported evidence is a port-scan handler creates hundreds of low-value events each hour because it fires on one ordinary denied SYN packet; this alternative would address the wrong dependency.

An event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled. “Apply automatic case creation selectively to avoid turning low-value noise into a backlog of incidents” would remedy that alternative situation, but it would not correct the present issue: automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope.

“Review alert deduplication and on-call assignments whenever adding or cloning event handlers” is the supported response when overlapping rules and notification routing can produce duplicated escalation for one underlying source event. Here the decisive response is “Track incident-to-confirmed-issue ratios and adjust only evidence-backed detection thresholds”, so that different intervention does not meet the stated requirement.

Downstream actions must account for missing or malformed enrichment output instead of assuming every lookup succeeds. “Add mandatory-field and type checks before all connector actions with side effects” applies to that other condition. The reported evidence is an automated incident workflow creates a critical case on every weak reputation hit and leaves responders with an unmanageable queue; this alternative would address the wrong dependency.

That intervention addresses suspended automation during maintenance, where Log collection and automated response are separate capabilities, and workflow suspension can create a response gap. Here, the relevant failure is instead: Incident notes can be visible to multiple analysts and are not a safe substitute for a managed secret store.

That intervention addresses runbook tests without safe sandbox target, where Live test actions can disrupt legitimate traffic when connector targets and indicators have not been validated. In this question the necessary remedy is “Remove exposed credential material from the case, rotate the affected secret and replace it with redacted diagnostic context”, which this alternative does not provide.

That intervention addresses ioc feed update during active investigation, where Stale intelligence can reduce confidence in a detection, even when the historical match remains an important investigative lead. The observed condition is a responder pastes full connector API credentials into an incident comment while documenting a failed automation run; this mechanism addresses another problem.

The investigation classifies the login with supporting identity evidence and tracks any associated administrative changes. This is a different failure mechanism from the current case, which concerns the administrator can explain the block and evaluate a narrow approved exception against the real policy.

This option instead describes the analyst identifies the actual successful session and distinguishes failed probes from legitimate user attempts. Testing that independent mechanism would not show whether the reported fault has been resolved.

The application shows an allowed session over the correct tunnel, not merely a healthy control-plane exchange. The stem describes a user reports that a legitimate research website is inaccessible and FortiAnalyzer shows several blocked web filter messages for that domain, so this explanation does not account for the observations.

That intervention addresses no visible logs from disabled analytic module, where A disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. Here, the relevant failure is instead: Successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume.

That intervention addresses time synchronization for multi-device events, where Clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages. In this question the necessary remedy is “Compare receive rate, analytics processing and backlog indicators and scale or tune the supported ingestion pipeline”, which this alternative does not provide.

That intervention addresses archive and analytics log purpose, where Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. The observed condition is fresh log packets appear in receiver statistics but FortiView graphs remain behind during a burst of traffic from several devices; this mechanism addresses another problem.