Fortinet FCP_FAZ_AN-7.6 Questions & Answers

That intervention addresses multiple event-handler alerts for one incident, where Distinct event handlers may match different features of one underlying host incident, so count of alerts is not count of compromises. Here, the relevant failure is instead: An application-level aggregate alone does not identify individual users or show which endpoints were affected.

That intervention addresses user entity analytics baseline change, where Behavioral baselines can flag new legitimate routines and need current business and change context before incident classification. In this question the necessary remedy is “Filter the signature and action, then pivot to authenticated user, source IP and device records in the selected interval”, which this alternative does not provide.

That intervention addresses fortiview failed transaction due missing raw logs, where A summary, cache or earlier export may survive after the underlying log records required for drilldown have expired. The observed condition is a policy owner asks which users were affected by one newly blocked application signature during a scheduled change; this mechanism addresses another problem.

Successful receipt of raw logs does not ensure that parsing and SQL analytics indexing have already caught up with incoming volume. “Compare receive rate, analytics processing and backlog indicators and scale or tune the supported ingestion pipeline” would remedy that alternative situation, but it would not correct the present issue: archived raw log files and indexed Analytics records serve different retrieval paths and can have distinct retention policies.

“Check traffic-log generation, category selection and Log View filters rather than diagnosing a complete device outage” is the supported response when log categories and subtypes are not interchangeable; system events do not substitute for session traffic telemetry. Here the decisive response is “Verify the required time period in each storage tier and restore or reprocess logs through a supported analytics workflow if needed”, so that different intervention does not meet the stated requirement.

Rollover and storage retention settings determine file availability, while report datasets require suitable Analytics log data. “Check analytics retention, available indexed logs and quota settings before promising historical report coverage” applies to that other condition. The reported evidence is a compliance analyst finds older raw messages in archive storage but cannot use them in a recent SQL-backed report after analytics retention expired; this alternative would address the wrong dependency.

That intervention addresses output pdf versus csv recipient need, where A presentation-oriented report layout is not equivalent to a record-level export needed for data reconciliation. Here, the relevant failure is instead: A macro expects a defined dataset field, and alias changes can break the reference even when the SQL returns data.

That intervention addresses table chart sorts top threats incorrectly, where The sort order determines the displayed ranking, and an inverse ORDER BY can misrepresent a top-N claim. In this question the necessary remedy is “Restore the macro's expected field alias or update the supported macro definition to match the new query”, which this alternative does not provide.

That intervention addresses report cover page displays old dates, where Static layout text and dynamically computed report period fields are different sources of metadata. The observed condition is during a scheduled quarterly report, An embedded report macro returns a blank string after a custom dataset renamed its output alias; this mechanism addresses another problem.

New records populate the intended normalized field while unaffected log categories still parse correctly. This is a different failure mechanism from the current case, which concerns the investigation returns sessions from only the intended virtual domain and policy identifiers map to that VDOM.

This option instead describes a test mail detection and subsequent web event can be located under their respective source types. Testing that independent mechanism would not show whether the reported fault has been resolved.

A known test security event appears in both raw Log View and the appropriate analytic view after restoring generation. The stem describes a multi-VDOM FortiGate appears as one physical device, but the analyst's investigation mixes traffic from two separate virtual domains, so this explanation does not account for the observations.

The recipient can import the approved logic without receiving active production secrets or unintended device access. This is a different failure mechanism from the current case, which concerns the historic case remains auditable and new unrelated indicators continue to generate events.

This option instead describes the case identifies each observed affected endpoint linked to the same indicator and event evidence. Testing that independent mechanism would not show whether the reported fault has been resolved.

A sample external alert appears as a traceable event with its original source identifier. The stem describes a help desk suppresses noisy endpoint events while a confirmed incident still needs the earlier detections for retrospective investigation, so this explanation does not account for the observations.

Overlapping detections may describe one underlying host investigation rather than independent incidents. “Link related events and, where appropriate, consolidate into a single case with separate supporting indicators” would remedy that alternative situation, but it would not correct the present issue: a reassigned incident can lose context when notes, evidence and executed actions are not retained within its audit history.

“Enable the supported Automatically Create Incident option for the appropriate high-confidence event handler” is the supported response when an event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled. Here the decisive response is “Attach the source logs, timeline, prior decisions and playbook action results to the incident before reassignment”, so that different intervention does not meet the stated requirement.

Absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily. “Review linked evidence, containment actions and independent remediation checks before moving the incident to closed state” applies to that other condition. The reported evidence is an analyst transfers a malware case to the endpoint team without preserving the investigations and tools already run; this alternative would address the wrong dependency.

Traffic session totals and security threat detections count different records, each requiring its own log subtype and metric. “Select a threats-focused dashboard and validate detections against underlying IPS, antivirus or other security logs” would remedy that alternative situation, but it would not correct the present issue: high bandwidth volume alone does not prove malicious behavior and measures a different dimension from detections and security actions.

“Use an application-oriented FortiView view or related application-control logs with source and time filters” is the supported response when destination IP totals do not reliably identify a detected application, especially when multiple services share hosting addresses. Here the decisive response is “Drill down on the host's sessions, applications and threat logs and compare its traffic with expected business workloads”, so that different intervention does not meet the stated requirement.

FortiView widgets obey their selected time ranges and filters; a narrow current interval can omit legitimate historical records. “Set the correct incident interval, ADOM and device filters and then drill down from the affected widget” applies to that other condition. The reported evidence is the operations team claims a workstation is the largest threat simply because it leads the FortiView traffic sources chart by transmitted bytes; this alternative would address the wrong dependency.

The proposed response is tied to the correct live asset with documented supporting evidence. This is a different failure mechanism from the current case, which concerns the resulting timeline distinguishes a regular heartbeat from an evidenced malicious beacon pattern.

This option instead describes the case records whether the same authenticated identity initiated the subsequent transfer and whether policy permitted it. Testing that independent mechanism would not show whether the reported fault has been resolved.

The spike is classified against the planned migration without ignoring genuine detection logs. The stem describes an analyst suspects beaconing after seeing repeated small HTTPS sessions to the same external host at regular intervals, so this explanation does not account for the observations.

That intervention addresses user and endpoint correlation after dhcp lease, where Endpoint addresses can change while host and user identities remain consistent, so an IP-only pivot can truncate a case timeline. Here, the relevant failure is instead: An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction.

That intervention addresses malware hash matching across hosts, where Hash equality identifies matching file content but does not alone establish when or how each endpoint obtained it. In this question the necessary remedy is “Review the IOC type, confidence, original connection and any relevant DNS or URL information”, which this alternative does not provide.

That intervention addresses fortiview source filter on reused rfc1918 ranges, where The same private IP can exist in multiple isolated networks, so source IP without ADOM, device or VDOM is ambiguous. The observed condition is an IOC service flags traffic to an IP associated with malicious activity, but the IP belongs to widely shared cloud infrastructure; this mechanism addresses another problem.

Historical raw evidence remains accessible while a properly indexed test interval can populate a report query. This is a different failure mechanism from the current case, which concerns a controlled traffic session appears in the correct traffic subtype while device event records remain separately available.

This option instead describes test events from both devices display a coherent sequence after clock and timezone corrections. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analytics backlog reduces and newly received test traffic appears in FortiView within the expected interval. The stem describes a SOC dashboard appears to lack firewall policy traffic while system event messages from the same FortiGate continue to arrive, so this explanation does not account for the observations.

That intervention addresses traffic bytes versus session count, where Many short low-volume sessions can outnumber fewer high-volume sessions, so count and byte volume are distinct metrics. Here, the relevant failure is instead: A shared signature ID is not proof that every alert targets the same asset or represents the same attacker session.

That intervention addresses long-lived sessions and graph continuity, where Long-lived flows can contribute usage across report windows, and time aggregation does not necessarily correspond to new session creation. In this question the necessary remedy is “Group events by signature, target, source, action and time before comparing campaign characteristics”, which this alternative does not provide.

That intervention addresses ips signature versus exploitation evidence, where An IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target. The observed condition is the SOC sees repeated IPS logs for one signature from dozens of public source IPs and needs to determine if a coordinated campaign is under way; this mechanism addresses another problem.