Fortinet FCP_FAZ_AN-7.6 Questions & Answers

A controlled matching security log produces the expected Event Monitor entry under the host view. This is a different failure mechanism from the current case, which concerns normal scanner activity stops generating duplicate cases while the same pattern from an unapproved host still alerts.

This option instead describes a branch test message generates the desired event without leaking unrelated tenant data. Testing that independent mechanism would not show whether the reported fault has been resolved.

The incident stays active with clear ownership until an independent test verifies mitigation. The stem describes an approved internal vulnerability scanner repeatedly triggers intrusion alerts, and analysts consider disabling IPS events for all hosts, so this explanation does not account for the observations.

Firewall session policy acceptance and downstream security profile enforcement refer to different decisions in the traffic path. “Use profile-specific actions rather than relying on one generic action field for all outcomes” would remedy that alternative situation, but it would not correct the present issue: the selected Log View column layout can hide fields that are present in underlying record details.

“Test Boolean filters against positive and negative fixtures before using them in production hunts” is the supported response when combining mutually exclusive predicates with AND can eliminate matches that would satisfy a properly grouped OR condition. Here the decisive response is “Save investigation-specific column layouts and verify field existence before changing parsing rules”, so that different intervention does not meet the stated requirement.

Changes in log collection or security profile configuration can alter observed detection counts independently of real attack frequency. “Annotate security dashboard baselines with logging and signature change events” applies to that other condition. The reported evidence is an investigator receives a log containing an important application field, but the standard visible columns do not show it in the message list; this alternative would address the wrong dependency.

A shared signature ID is not proof that every alert targets the same asset or represents the same attacker session. “Use multi-field correlation rather than single-signature counts for campaign escalation” would remedy that alternative situation, but it would not correct the present issue: many short low-volume sessions can outnumber fewer high-volume sessions, so count and byte volume are distinct metrics.

“Require corroboration for claims of successful exploitation and preserve the original IPS log record” is the supported response when an IPS signature detection shows matched suspicious traffic but does not alone prove payload execution or compromise on the target. Here the decisive response is “Specify whether each anomaly rule measures connections, bytes, duration or security events”, so that different intervention does not meet the stated requirement.

An antivirus detection identifies a suspicious object, but the configured security action determines whether delivery was blocked or allowed. “Record the response action and endpoint evidence for every significant malware detection” applies to that other condition. The reported evidence is a dashboard ranks a host highest by session count, and a team assumes it also transferred the most data in the interval; this alternative would address the wrong dependency.

A suspicious sequence requires joining authentication, user identity and session activity rather than inspecting a single event category. “Correlate VPN success, assigned internal address, mapped user, destination and transferred bytes over the same timeframe” would remedy that alternative situation, but it would not correct the present issue: policy identifiers and configuration context must be interpreted against the configuration effective when the event was logged.

“Correlate the session's original source fields, NAT translation details, ports and timestamp with the relevant firewall logs” is the supported response when an external translated address alone may represent many internal sources and cannot uniquely identify one initiating host. Here the decisive response is “Confirm the historical policy identity and change timestamp before attributing a saved traffic event to the current rule text”, so that different intervention does not meet the stated requirement.

A shared CDN endpoint can serve many unrelated legitimate web services, so destination frequency alone cannot establish malicious purpose. “Inspect resolved domains, applications, web-filter categories, security actions and affected user behavior” applies to that other condition. The reported evidence is an investigator concludes policy 27 caused an event today using the current firewall rule list, although administrators reordered policies yesterday; this alternative would address the wrong dependency.

That intervention addresses failure to distinguish receive time from event time, where Delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. Here, the relevant failure is instead: A completed backup job is not proof that the required stored log files are intact and recoverable for investigation.

That intervention addresses adom log role access versus global login, where Successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. In this question the necessary remedy is “Perform a controlled restore of representative log archives into a supported isolated investigation workflow”, which this alternative does not provide.

That intervention addresses logging health with clustered fortigate devices, where HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity. The observed condition is the security team schedules a daily backup of analytics evidence but never validates that an archived log set can actually be read; this mechanism addresses another problem.

A basic predefined query returns representative records from the same device and time range used by the report. This is a different failure mechanism from the current case, which concerns the reconstructed timeline matches the firewall's actual event order rather than the later batch delivery time.

This option instead describes the available search range still covers the policy's required investigation interval and storage utilization stays controlled. Testing that independent mechanism would not show whether the reported fault has been resolved.

The analyst can search the authorized ADOM without gaining access to unrelated tenant data. The stem describes during a link outage, buffered firewall logs arrive in a single burst, making a receive-time graph suggest all suspicious sessions happened at once, so this explanation does not account for the observations.

A playbook definition can reference integrations that are absent or have different credentials in the destination environment. “Import the needed connector definitions where allowed and remap their credentials and permissions to the target ADOM” would remedy that alternative situation, but it would not correct the present issue: playbook task execution requires an authorized remote connector credential, not just a configured action name.

“Inspect the supported connector actions and select a compatible authorized response workflow for the target” is the supported response when connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome. Here the decisive response is “Update the connector's approved authentication and verify its permitted action scope through a test job”, so that different intervention does not meet the stated requirement.

Viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile. “Grant only the supported Incidents & Events privileges to an authorized responder after approval and test the role” applies to that other condition. The reported evidence is a FortiOS connector is online in the UI but a configured quarantine action fails immediately after its API credential was revoked; this alternative would address the wrong dependency.

The revised department report changes while other reports retain their previous validated results. This is a different failure mechanism from the current case, which concerns a test fixture demonstrates the correct distinct host count and higher number of related messages.

This option instead describes the required daily reports finish successfully without interfering with time-sensitive incident searches. Testing that independent mechanism would not show whether the reported fault has been resolved.

An independent rerun under the archived definitions yields consistent figures where the underlying data remains available. The stem describes an analyst expects a chart's ten unique hosts to equal 300 related raw IDS log messages and calls the chart inaccurate, so this explanation does not account for the observations.

That intervention addresses device log forwarding encryption expectations, where Destination configuration alone does not prove negotiated transport security or trusted endpoint identity. Here, the relevant failure is instead: Retention and disk limits can constrain what logs can be stored or retained under high ingestion pressure.

That intervention addresses log device registration after rma, where The replacement is a separate physical source identity, so device authorization and inventory associations can require updating. In this question the necessary remedy is “Inspect disk quota and data policy status, then correct capacity, retention or priority settings within supported limits”, which this alternative does not provide.

That intervention addresses high eps ingestion capacity planning, where The sustained events-per-second and storage/indexing demand can exceed the platform's supported sizing even when initial connectivity works. The observed condition is fortiAnalyzer storage reaches its quota during a busy inspection week and the SOC finds gaps even though the edge firewall still sends logs; this mechanism addresses another problem.

A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. “Record ADOM and source selection in recurring report configuration reviews” would remedy that alternative situation, but it would not correct the present issue: dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields.

“Capacity-plan Analytics storage to match report lookback requirements separately from archive retention” is the supported response when report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. Here the decisive response is “Validate source log types against report metrics before modifying visual layout or scheduling”, so that different intervention does not meet the stated requirement.

A report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. “Test macro output types and source data independently from the report layout” applies to that other condition. The reported evidence is a custom FortiAnalyzer report chart shows no IPS detections because the underlying dataset queries traffic rather than security event logs; this alternative would address the wrong dependency.

A matching test from the branch triggers but the same pattern from an out-of-scope device does not. This is a different failure mechanism from the current case, which concerns a controlled matching security log produces the expected Event Monitor entry under the host view.

This option instead describes a failed VPN login creates a matching event, and unrelated traffic sessions do not trigger it. Testing that independent mechanism would not show whether the reported fault has been resolved.

A harmless single probe does not fire while a sustained controlled scan crosses the rule threshold. The stem describes a SOC dashboard's compromised-host view stops updating even though Log View still shows fresh botnet-related traffic records from the same FortiGate, so this explanation does not account for the observations.