Fortinet FCP_FAZ_AN-7.6 Questions & Answers

The sort order determines the displayed ranking, and an inverse ORDER BY can misrepresent a top-N claim. “Validate top-N definitions with seeded sample data before trusting management summaries” would remedy that alternative situation, but it would not correct the present issue: a report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output.

“Capacity-plan Analytics storage to match report lookback requirements separately from archive retention” is the supported response when report datasets query supported Analytics data and cannot necessarily use unindexed raw archive files as equivalent records. Here the decisive response is “Test macro output types and source data independently from the report layout”, so that different intervention does not meet the stated requirement.

A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. “Record ADOM and source selection in recurring report configuration reviews” applies to that other condition. The reported evidence is an executive summary shows an empty placeholder where the top bandwidth user should appear, but the table chart is populated; this alternative would address the wrong dependency.

Seeing one Security Fabric device's logs does not prove all needed mail security products are registered and sending supported events. “Verify the FortiMail log source registration, permissions and event log pipeline into the correct ADOM” would remedy that alternative situation, but it would not correct the present issue: an enabled connector cannot manufacture telemetry that the originating device has stopped generating or forwarding.

“Verify the relevant IOC licensing and FortiGuard content update status before troubleshooting unrelated network policy” is the supported response when indicator matching capabilities that depend on licensed FortiGuard content can stop refreshing even while historical logs continue to arrive. Here the decisive response is “Inspect source-side category settings and the data collection path for the log types required by the chosen SOC feature”, so that different intervention does not meet the stated requirement.

Device serial identity and VDOM identity are distinct dimensions; omitting VDOM context can combine unrelated policy and traffic records. “Filter or group logs by both the originating device and VDOM when reconstructing the specific tenant's traffic” applies to that other condition. The reported evidence is a Security Fabric integration is configured, yet a planned threat hunting view lacks telemetry after a source-side log category was disabled; this alternative would address the wrong dependency.

Queries without appropriate source restrictions can combine multiple devices that share the same private IP addresses. “Constrain the investigation to the intended serials, VDOMs and ADOM before interpreting IP-based correlation” would remedy that alternative situation, but it would not correct the present issue: HA failover changes the active origin of device logs, so filtering by only the former active member can hide valid post-failover activity.

“Analyze source event timestamps and receipt delay separately while retaining the queue and forwarding context” is the supported response when delayed delivery collapses receipt timestamps even when the original event timestamps are spread over an earlier interval. Here the decisive response is “Verify the cluster member identifiers and expand approved searches to the appropriate HA source identity and period”, so that different intervention does not meet the stated requirement.

A completed backup job is not proof that the required stored log files are intact and recoverable for investigation. “Perform a controlled restore of representative log archives into a supported isolated investigation workflow” applies to that other condition. The reported evidence is an active-passive FortiGate pair fails over and logs begin arriving under a different member serial, causing a saved device-specific search to appear empty; this alternative would address the wrong dependency.

The analytics backlog reduces and newly received test traffic appears in FortiView within the expected interval. This is a different failure mechanism from the current case, which concerns the recovered investigation explicitly distinguishes searchable evidence from permanently unavailable periods.

This option instead describes an authorized status lookup succeeds while unnecessary write and administrative API actions remain denied. The present question requires “The recovered investigation explicitly distinguishes searchable evidence from permanently unavailable periods”, not a change to that unrelated behavior.

A known critical test event appears under the expected severity filter without changing unrelated event classes. The stem describes a fraud investigator requests a 60-day historical timeline but the analyzer's retention policy was tuned for only two weeks, so this explanation does not account for the observations.

That intervention addresses automatic incident creation not configured, where An event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled. Here, the relevant failure is instead: A playbook task's dependencies determine when it executes; missing predecessor relationships can expose uninitialized parameters.

That intervention addresses alert delivery mail server failure, where Notification delivery depends on its configured mail transport and credentials separately from event detection. In this question the necessary remedy is “Connect the enrichment task as a predecessor of the decision and blocking task, then validate data passing”, which this alternative does not provide.

That intervention addresses event-triggered playbook filter too broad, where A generic EVENT_TRIGGER without scope conditions can launch on unrelated events and create unsafe automated response. The observed condition is an automated firewall block is attempted before a prerequisite enrichment lookup finishes and the block list contains an empty indicator; this mechanism addresses another problem.

A report executes against its selected ADOM and device scope, which may exclude the intended source even though log collection works. “Select the authorized branch ADOM and relevant device scope before running the report for the incident interval” would remedy that alternative situation, but it would not correct the present issue: charts populate from their referenced datasets; a missing or invalid dataset binding leaves the visual without records.

“Use a supported macro tied to an appropriate query that returns the required summary value” is the supported response when a report macro is intended to render a suitable single dataset value, not an arbitrary full rowset or unrelated chart output. Here the decisive response is “Inspect the chart's dataset reference and attach a compatible tested dataset to the report template”, so that different intervention does not meet the stated requirement.

Dataset log type determines which underlying records can be queried, and ordinary traffic data may lack the required IPS fields. “Edit or clone the dataset for the appropriate security log type and test the query against known IPS events” applies to that other condition. The reported evidence is a copied report template contains a chart placeholder but the plot remains blank after generation even though the ADOM has recent data; this alternative would address the wrong dependency.

Successful login does not automatically confer authorized log-view rights or an assignment to the affected administrative domain. “Test representative read-only analyst profiles after administrator and ADOM permissions are changed” would remedy that alternative situation, but it would not correct the present issue: deleting a raw archive is not an equivalent remedy for every analytics database or retention problem and risks destroying evidence.

“Retain representative parser fixtures and flag newly introduced unparseable timestamp patterns” is the supported response when incorrect parser time extraction can misplace otherwise ingested messages outside the investigator's selected event interval. Here the decisive response is “Document which storage tier each cleanup action affects and require approval for evidence-destroying changes”, so that different intervention does not meet the stated requirement.

Hostname changes do not necessarily change underlying device serial identity but can make name-only searches incomplete. “Keep a device rename history and favor immutable identifiers in incident correlation and evidence export” applies to that other condition. The reported evidence is a spike in traffic causes storage pressure and an operator wants to delete raw archive logs without understanding policy for analytics and reports; this alternative would address the wrong dependency.

A known test security event appears in both raw Log View and the appropriate analytic view after restoring generation. This is a different failure mechanism from the current case, which concerns new records populate the intended normalized field while unaffected log categories still parse correctly.

This option instead describes a test mail detection and subsequent web event can be located under their respective source types. Testing that independent mechanism would not show whether the reported fault has been resolved.

Current threat intelligence updates resume and supported log indicators can be inspected with the new definitions. The stem describes after enabling a new firmware log field, a custom SOC query produces empty values even though the raw log contains the updated key, so this explanation does not account for the observations.

Expensive broad SQL queries and report concurrency can exceed the available analytics processing resources. “Profile expensive datasets and monitor scheduled report concurrency before monthly deadlines” would remedy that alternative situation, but it would not correct the present issue: distinct asset counts and individual event message totals measure different populations and cannot be compared as equal.

“Use data-source and query diagnostics as the first troubleshooting step for empty report visuals” is the supported response when a blank chart may result from query failure, missing Analytics logs or incorrect filtering rather than a visual layout defect. Here the decisive response is “Define units and aggregation keys explicitly in report chart captions and explanatory notes”, so that different intervention does not meet the stated requirement.

Simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. “Review report schedule concurrency and workload sizing after every major device-source increase” applies to that other condition. The reported evidence is an analyst expects a chart's ten unique hosts to equal 300 related raw IDS log messages and calls the chart inaccurate; this alternative would address the wrong dependency.

Administrative domains isolate device inventory and associated log visibility, so the analyst's selected ADOM can exclude the logging source. “Verify the source serial and correct ADOM membership or authorized ADOM selection without weakening tenant separation” would remedy that alternative situation, but it would not correct the present issue: receiving a connection is not equivalent to authorizing the device and assigning its logs to the expected administrative domain.

“Configure the supported FortiGate remote-logging destination and the appropriate logging policies and categories” is the supported response when a healthy transport path does not create telemetry unless the originating FortiGate is configured to generate and send the required logs. Here the decisive response is “Inspect Device Manager, authorize the correct FortiGate serial and place it in the intended ADOM before validating ingestion”, so that different intervention does not meet the stated requirement.

Traffic can match and be forwarded by a firewall policy even when session logging is disabled on that specific rule. “Enable the approved traffic logging option on the matching firewall policy and retest the intended session type” applies to that other condition. The reported evidence is a newly installed branch FortiGate sends its first logging connection toward a central FortiAnalyzer, but the SOC cannot find the branch in its approved device inventory; this alternative would address the wrong dependency.

Absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily. “Review linked evidence, containment actions and independent remediation checks before moving the incident to closed state” would remedy that alternative situation, but it would not correct the present issue: an event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled.

“Link related events and, where appropriate, consolidate into a single case with separate supporting indicators” is the supported response when overlapping detections may describe one underlying host investigation rather than independent incidents. Here the decisive response is “Enable the supported Automatically Create Incident option for the appropriate high-confidence event handler”, so that different intervention does not meet the stated requirement.

A case without evidence-backed affected-asset context cannot be reliably routed or validated during response. “Populate the incident with linked event evidence and the identified affected host or identity before assignment” applies to that other condition. The reported evidence is a high-confidence detection appears in Event Monitor, but the incident queue remains empty despite the team expecting a new case; this alternative would address the wrong dependency.