Fortinet FCP_FAZ_AN-7.6 Questions & Answers

Absence of new alerts is not equivalent to verified recovery when logging or malicious activity may have stopped temporarily. “Review linked evidence, containment actions and independent remediation checks before moving the incident to closed state” would remedy that alternative situation, but it would not correct the present issue: an event generated by an event handler does not automatically become an incident unless the relevant incident-creation setting or workflow is enabled.

“Link related events and, where appropriate, consolidate into a single case with separate supporting indicators” is the supported response when overlapping detections may describe one underlying host investigation rather than independent incidents. Here the decisive response is “Enable the supported Automatically Create Incident option for the appropriate high-confidence event handler”, so that different intervention does not meet the stated requirement.

A case without evidence-backed affected-asset context cannot be reliably routed or validated during response. “Populate the incident with linked event evidence and the identified affected host or identity before assignment” applies to that other condition. The reported evidence is a high-confidence detection appears in Event Monitor, but the incident queue remains empty despite the team expecting a new case; this alternative would address the wrong dependency.

Simultaneous heavy report jobs can compete for analytics CPU and I/O even when the underlying queries are valid. “Stagger schedules or reduce duplicate jobs and tune supported caching or dataset scope within reporting needs” would remedy that alternative situation, but it would not correct the present issue: device-group scope determines which logs enter the dataset and can distort totals if unrelated sources are included.

“Update the output profile to the approved distribution group and retest authorized recipient delivery” is the supported response when report output profile recipients can remain stale even when generated content and filters are correct. Here the decisive response is “Restrict report source selection to the authorized region and rerun with the same time window”, so that different intervention does not meet the stated requirement.

An untested SQL dataset can silently count unrelated records or miss expected fields despite producing a valid-looking chart. “Run the dataset test against representative source devices and verify counts and filters before using Chart Builder” applies to that other condition. The reported evidence is a regional compliance report includes remote branches from another country because the source device group was too broad; this alternative would address the wrong dependency.

That intervention addresses overly narrow security-log severity filter, where Severity thresholds exclude all events below the chosen level regardless of their contextual investigative importance. Here, the relevant failure is instead: A denied traffic action records a blocked attempt rather than confirmation of successful permitted access or compromise.

That intervention addresses top destination anomaly with cdn, where A shared CDN endpoint can serve many unrelated legitimate web services, so destination frequency alone cannot establish malicious purpose. In this question the necessary remedy is “Separate deny from accept actions and correlate with subsequent allowed sessions and endpoint or server evidence”, which this alternative does not provide.

That intervention addresses session policy lookup after rule reorder, where Policy identifiers and configuration context must be interpreted against the configuration effective when the event was logged. The observed condition is a junior analyst counts firewall deny records as proof that attackers successfully entered protected servers during a scanning campaign; this mechanism addresses another problem.

That intervention addresses report task monitor versus blank output, where Generation success does not prove the dataset query returned the expected source records or that the content is substantively correct. Here, the relevant failure is instead: Expensive broad SQL queries and report concurrency can exceed the available analytics processing resources.

That intervention addresses report template editing after clone, where Editing a shared baseline template can alter multiple reports or remove a known-good rollback point. In this question the necessary remedy is “Inspect report diagnostic and task logs, then narrow or optimize dataset queries and schedule supported workloads”, which this alternative does not provide.

That intervention addresses report auto-cache stale after query change, where Report caching can reuse prepared results rather than recomputing every query immediately under all conditions. The observed condition is a large monthly dataset repeatedly times out during generation while smaller reports still complete normally; this mechanism addresses another problem.

That intervention addresses security fabric connector wrong device target, where Even a valid response action fails to protect the intended path if it targets a device unrelated to the originating event. Here, the relevant failure is instead: A single denied connection is insufficient evidence for a multi-attempt scan and yields excessive false-positive events.

That intervention addresses basic event source filter too broad, where Without an explicit device, group or ADOM selection, the handler can evaluate events from unrelated sources in its data scope. In this question the necessary remedy is “Configure an appropriate occurrence threshold and time window grouped by source and target as supported”, which this alternative does not provide.

That intervention addresses basic event rule wrong log category, where A rule cannot match required authentication fields when its selected log source or subtype does not contain them. The observed condition is a port-scan handler creates hundreds of low-value events each hour because it fires on one ordinary denied SYN packet; this mechanism addresses another problem.

Queries without appropriate source restrictions can combine multiple devices that share the same private IP addresses. “Include explicit source scope in shared hunt queries and review assumptions about overlapping RFC1918 addresses” would remedy that alternative situation, but it would not correct the present issue: firewall session telemetry is not the same evidence as administrative changes made directly on the analyzer appliance.

“Prohibit shared privileged accounts and review administrative changes in routine SOC governance” is the supported response when a shared administrative identity prevents dependable change attribution and cannot enforce individual access privileges. Here the decisive response is “Retain protected administrative audit logs and validate their collection alongside ordinary device events”, so that different intervention does not meet the stated requirement.

Stored searches and parsers built for an older subtype schema may exclude the new message values. “Version control schema-sensitive searches and rerun sample data tests on product upgrades” applies to that other condition. The reported evidence is a compliance review requires evidence of configuration changes, but analysts search firewall traffic logs instead of FortiAnalyzer's administrative events; this alternative would address the wrong dependency.

An IP intelligence match is a lead for investigation and may not identify the specific hosted domain or malicious transaction. “Review the IOC type, confidence, original connection and any relevant DNS or URL information” would remedy that alternative situation, but it would not correct the present issue: identical usernames do not prove both sessions originated from the same approved management path.

“Correlate the session with application performance telemetry or suitable timing fields instead of using duration as latency” is the supported response when connection duration alone may include idle time and is not identical to end-user application response latency. Here the decisive response is “Correlate login events by source IP, time, authentication method and administrative action history”, so that different intervention does not meet the stated requirement.

One endpoint can generate many related DNS and HTTP observations for the same indicator across a short period. “Group events by endpoint identity, domain and time and retain both detection types as supporting observations” applies to that other condition. The reported evidence is an authorized administrator signs in from a management subnet, but another login from a nonapproved public source appears in appliance audit logs; this alternative would address the wrong dependency.

That intervention addresses event monitor tag view misclassification, where Event handlers apply classification tags used to group events into Event Monitor views; a rule can fire with incorrect tags. Here, the relevant failure is instead: A simple event count does not establish the order or relationship of multiple steps required for an attack pattern.

That intervention addresses incorrect event severity assignment, where Alert severity configured without business impact or enforcement outcome may distort incident response priorities. In this question the necessary remedy is “Use a supported correlation handler with ordered event conditions, user grouping and a bounded time window”, which this alternative does not provide.

That intervention addresses correlation rule with overlong observation window, where An excessive correlation window can connect unrelated events that happen to share a hostname or indicator. The observed condition is an SOC rule must detect a failed login burst followed by one successful login rather than simply any two authentication events; this mechanism addresses another problem.

An investigation can identify the exact originating serial regardless of the device's human-readable label. This is a different failure mechanism from the current case, which concerns the connector reports healthy access and new enrichment appears against the related incident records.

This option instead describes known test messages fall into their intended search windows with consistent raw and parsed event time. Testing that independent mechanism would not show whether the reported fault has been resolved.

The test log exposes the intended normalized source-user field in analytic searches instead of only in raw text. The stem describes a SOC team rotates a service token on an integrated product and FortiAnalyzer stops enriching related findings despite continuing to receive firewall logs, so this explanation does not account for the observations.

Viewing incidents and managing or running automation are separate privileged functions controlled by the assigned admin profile. “Grant only the supported Incidents & Events privileges to an authorized responder after approval and test the role” would remedy that alternative situation, but it would not correct the present issue: disconnected or incorrectly configured task routes can make a branch unreachable regardless of the input event.

“Inspect the supported connector actions and select a compatible authorized response workflow for the target” is the supported response when connector action availability depends on the integration type, target support and permissions rather than the analyst's desired outcome. Here the decisive response is “Inspect the playbook task links and branching conditions, then repair the supported workflow graph”, so that different intervention does not meet the stated requirement.

Playbook task execution requires an authorized remote connector credential, not just a configured action name. “Update the connector's approved authentication and verify its permitted action scope through a test job” applies to that other condition. The reported evidence is a detection playbook has a notification branch that never runs even when the decision condition should route events to it; this alternative would address the wrong dependency.

A second responder can trace the IOC to a specific original event instead of relying on a bare copied string. This is a different failure mechanism from the current case, which concerns the incident contains useful error evidence without revealing the credential, and the old token no longer works.

This option instead describes the incident explicitly records the feed version, freshness and supporting present-day evidence. Testing that independent mechanism would not show whether the reported fault has been resolved.

The resolved case remains auditable and unrelated or future security events still appear normally. The stem describes a responder pastes full connector API credentials into an incident comment while documenting a failed automation run, so this explanation does not account for the observations.