Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses no visible logs from disabled analytic module, where A disabled or unsupported analytics module can hide its own dashboard while underlying raw collection continues normally. Here, the relevant failure is instead: Successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume.

That intervention addresses time synchronization for multi-device events, where Clock drift or mismatched time-zone handling can distort apparent event order across devices despite valid received messages. In this question the necessary remedy is “Compare receive rate, analytics processing and backlog indicators and scale or tune the supported ingestion pipeline”, which this alternative does not provide.

That intervention addresses archive and analytics log purpose, where Archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies. The observed condition is fresh log packets appear in receiver statistics but FortiView graphs remain behind during a burst of traffic from several devices; this mechanism addresses another problem.

Counting log rows is different from counting distinct affected assets, especially when multiple detections involve the same host. “Modify the supported SQL dataset to group by the relevant host identifier and apply the appropriate distinct-count logic” would remedy that alternative situation, but it would not correct the present issue: a report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works.

“Verify Analytics log retention for the needed period and use a supported data reprocessing workflow if available” is the supported response when report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. Here the decisive response is “Select the authorized branch ADOM and relevant device scope before running the report for the incident interval”, so that different intervention does not meet the stated requirement.

A report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. “Use a supported macro tied to an appropriate query that returns the required summary value” applies to that other condition. The reported evidence is a SOC manager runs a predefined threat summary and finds zero detections for a branch whose logs are visible to analysts under a different ADOM; this alternative would address the wrong dependency.

Predefined event handlers can restrict direct editing of their original configuration and are intended as reusable templates. “Retain the original handler as a reference and review custom rule drift after product updates” would remedy that alternative situation, but it would not correct the present issue: without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope.

“Test event handlers using authentic sample log types instead of assumptions about similar field names” is the supported response when a rule cannot match required authentication fields when its selected log source or subtype does not contain them. Here the decisive response is “Version the intended source coverage in all custom detection definitions”, so that different intervention does not meet the stated requirement.

A predefined Event Monitor view depends on its associated event handlers being enabled, not simply on log collection. “Monitor disabled built-in handlers and record which views depend on each detection rule” applies to that other condition. The reported evidence is a branch-only login alert begins firing for every firewall because the event handler lacks the intended device source constraint; this alternative would address the wrong dependency.

That intervention addresses table chart sorts top threats incorrectly, where The sort order determines the displayed ranking, and an inverse ORDER BY can misrepresent a top-N claim. Here, the relevant failure is instead: A new report run can reflect current query and group definitions rather than the exact scope used for the earlier issued report.

That intervention addresses report raw logs differ from aggregated counts, where Distinct asset counts and individual event message totals measure different populations and cannot be compared as equal. In this question the necessary remedy is “Retain versioned report definitions, dataset queries, source group membership and report output hashes for that period”, which this alternative does not provide.

That intervention addresses report generation diagnostics for empty chart, where A blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect. The observed condition is a compliance officer wants to reproduce a report from last quarter after its dataset and device group were modified recently; this mechanism addresses another problem.

A qualifying log generates an event that carries the intended classification metadata. This is a different failure mechanism from the current case, which concerns the incident stays active with clear ownership until an independent test verifies mitigation.

This option instead describes normal scanner activity stops generating duplicate cases while the same pattern from an unapproved host still alerts. Testing that independent mechanism would not show whether the reported fault has been resolved.

A branch test message generates the desired event without leaking unrelated tenant data. The stem describes an analyst launches automated containment, but the connector reports failure and the incident remains assigned to a low-priority queue, so this explanation does not account for the observations.

Suppression criteria without precise identity and event scope can hide unrelated true-positive detections. “Narrow the suppression to the investigated user, matching handler and time interval rather than a global filter” would remedy that alternative situation, but it would not correct the present issue: a playbook task's dependencies determine when it executes; missing predecessor relationships can expose uninitialized parameters.

“Select the supported incident-based trigger with the intended incident attributes and approval boundary” is the supported response when an event trigger runs on matching individual events, which may precede incident creation and analyst classification. Here the decisive response is “Connect the enrichment task as a predecessor of the decision and blocking task, then validate data passing”, so that different intervention does not meet the stated requirement.

An ON_DEMAND trigger requires deliberate execution and does not behave like an event-triggered workflow. “Run the on-demand playbook from the authorized incident or automation interface or select an appropriate event trigger for approved automation” applies to that other condition. The reported evidence is an automated firewall block is attempted before a prerequisite enrichment lookup finishes and the block list contains an empty indicator; this alternative would address the wrong dependency.

A source-ranked failure total does not reveal the identities targeted or whether any session later succeeded. “Build combined source- and account-centric authentication detections to avoid missing distributed guessing” would remedy that alternative situation, but it would not correct the present issue: DNS filtering or sinkhole behavior can alter a lookup result; a detected query does not necessarily mean the endpoint connected to the original attacker IP.

“Use geolocation anomalies as one factor in a privileged access review rather than a standalone compromise verdict” is the supported response when IP-based geolocation can reflect VPN egress or cloud proxies, so an unusual country is a risk signal rather than absolute identity proof. Here the decisive response is “Correlate DNS filter results with traffic and endpoint evidence before concluding beacon success”, so that different intervention does not meet the stated requirement.

A high failure rate followed by success can suggest credential guessing but requires careful review of source and authentication method. “Build account-centric authentication alerts with success-after-failures logic and contextual enrichment” applies to that other condition. The reported evidence is a workstation repeatedly resolves a suspected command-and-control domain and FortiAnalyzer receives DNS filter detections with replacement responses; this alternative would address the wrong dependency.

Overlapping rules and notification routing can produce duplicated escalation for one underlying source event. “Review alert deduplication and on-call assignments whenever adding or cloning event handlers” would remedy that alternative situation, but it would not correct the present issue: a timeout does not prove the remote action failed, so blindly repeating non-idempotent tasks can cause inconsistent state.

“Track incident-to-confirmed-issue ratios and adjust only evidence-backed detection thresholds” is the supported response when automatic incident creation magnifies low-confidence event noise unless handlers include meaningful thresholds and scope. Here the decisive response is “Test retry paths under partial failures and log action identifiers for reconciliation”, so that different intervention does not meet the stated requirement.

Log collection and automated response are separate capabilities, and workflow suspension can create a response gap. “Include automation validation in maintenance recovery alongside log ingestion checks” applies to that other condition. The reported evidence is a network connector occasionally times out after sending a block command, and repeated blind retries create duplicate configuration entries; this alternative would address the wrong dependency.

A new qualifying test event creates a related incident with traceable event evidence. This is a different failure mechanism from the current case, which concerns the noisy case subsides while controlled events for the remaining rules continue generating alerts.

This option instead describes a new test notification reaches the current assignee and the previous owner is not the only recipient. Testing that independent mechanism would not show whether the reported fault has been resolved.

The case documents the actor, time and recorded action for the investigated workflow changes. The stem describes an operator disables an entire predefined event handler to silence one noisy subrule, unexpectedly removing several other useful detections, so this explanation does not account for the observations.

A shared signature ID is not proof that every alert targets the same asset or represents the same attacker session. “Group events by signature, target, source, action and time before comparing campaign characteristics” would remedy that alternative situation, but it would not correct the present issue: different endpoint classes have different expected network behavior, so unsegmented comparisons can produce misleading anomalies.

“Review destination host, application identifiers, change tickets and relevant threat profile outcomes” is the supported response when destination concentration can result from legitimate DNS or routing changes, not necessarily a newly targeted malicious server. Here the decisive response is “Filter or group supported endpoint records by known asset category and evaluate each against its appropriate baseline”, so that different intervention does not meet the stated requirement.

A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. “Correlate VPN success, assigned internal address, mapped user, destination and transferred bytes over the same timeframe” applies to that other condition. The reported evidence is a SOC investigation includes employees and kiosk devices but applies the same risk expectation to both device categories; this alternative would address the wrong dependency.

A controlled matching security log produces the expected Event Monitor entry under the host view. This is a different failure mechanism from the current case, which concerns normal scanner activity stops generating duplicate cases while the same pattern from an unapproved host still alerts.

This option instead describes a branch test message generates the desired event without leaking unrelated tenant data. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident stays active with clear ownership until an independent test verifies mitigation. The stem describes an approved internal vulnerability scanner repeatedly triggers intrusion alerts, and analysts consider disabling IPS events for all hosts, so this explanation does not account for the observations.