Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Retain approved destination baselines for unusual outbound traffic review”, reduces a different source-defined risk: A data-exfiltration suspicion concerns one unfamiliar Internet destination, but investigators only inspect the busiest internal hosts. That risk depends on: Destination aggregation groups outbound targets and helps locate external communication partners separately from internal sources. The recurring problem here is a SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. The originally selected control “Test stored custom-view scope whenever monitored devices are renamed or replaced” is more specific because custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace.

This safeguard, “Check policy-specific traffic baselines after major rule changes”, reduces a different source-defined risk: A firewall change is suspected of increasing traffic through policy 41, and the team wants policy-specific evidence rather than a network-wide bandwidth total. That risk depends on: Policy-focused aggregation reveals which rules handle observed sessions and bytes. The recurring problem here is a SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. The originally selected control “Test stored custom-view scope whenever monitored devices are renamed or replaced” is more specific because custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace.

This safeguard, “Attach IoC supporting records before recommending endpoint quarantine”, reduces a different source-defined risk: An IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. That risk depends on: A visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions. The recurring problem here is a SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. The originally selected control “Test stored custom-view scope whenever monitored devices are renamed or replaced” is more specific because custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace.

The action “Save the configured FortiView custom view with its approved device and time filters” addresses a separate source case: A SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. Its underlying reason is: Custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace. This question instead describes an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The original answer “Drill down from the compromised-host/IoC view to the contributing logs and indicator details” targets that failure because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The action “Change the FortiView time period and compare the same destination across equivalent shorter windows” addresses a separate source case: A threat dashboard ranks one destination highly, but an analyst needs to isolate whether the spike occurred in the previous hour or over the whole week. Its underlying reason is: Time filtering changes which log samples contribute to an aggregate, so rankings can differ by investigation interval. This question instead describes an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The original answer “Drill down from the compromised-host/IoC view to the contributing logs and indicator details” targets that failure because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The action “Add eligible FortiView FortiSandbox and DLP widgets to a custom dashboard with the right security log sources” addresses a separate source case: A custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. Its underlying reason is: Different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses. This question instead describes an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The original answer “Drill down from the compromised-host/IoC view to the contributing logs and indicator details” targets that failure because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The action “Threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections” addresses a separate source case: A FortiView widget displaying top attack categories is empty because the connected FortiGate forwards only basic traffic logs, not security-profile events. Its underlying reason is: Threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections. This question instead describes an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The original answer “A visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions” targets that failure because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The action “Application Control telemetry can group activity by detected application, not just network address” addresses a separate source case: An employee's laptop consumes unexpected bandwidth through a video-sharing application, but the SOC reports only the destination IP addresses. Its underlying reason is: Application Control telemetry can group activity by detected application, not just network address. This question instead describes an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The original answer “A visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions” targets that failure because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The action “A drill-down is meaningful only when the same authorized data scope governs both summary and detail” addresses a separate source case: A drill-down from a traffic dashboard seems to lead to unrelated sessions because the analyst changed ADOMs after the initial summary. Its underlying reason is: A drill-down is meaningful only when the same authorized data scope governs both summary and detail. This question instead describes an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The original answer “A visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions” targets that failure because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The proposed observation “The external address appears as a destination with associated internal sources and session details” would check a different original case: A data-exfiltration suspicion concerns one unfamiliar Internet destination, but investigators only inspect the busiest internal hosts. Its mechanism is: Destination aggregation groups outbound targets and helps locate external communication partners separately from internal sources. In the present case, an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive; the more direct acceptance evidence is “The candidate host's suspicious web destinations and matched indicators appear with timestamps” because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The proposed observation “The selected destination's data narrows on screen while the base dashboard remains available” would check a different original case: Analysts want to narrow one FortiView chart to a single risky destination while leaving unrelated saved dashboard definitions unchanged. Its mechanism is: Interactive filters refine the visible aggregation without necessarily modifying the original saved dashboard. In the present case, an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive; the more direct acceptance evidence is “The candidate host's suspicious web destinations and matched indicators appear with timestamps” because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The proposed observation “The changed policy shows the expected traffic trend and matching individual log records” would check a different original case: A firewall change is suspected of increasing traffic through policy 41, and the team wants policy-specific evidence rather than a network-wide bandwidth total. Its mechanism is: Policy-focused aggregation reveals which rules handle observed sessions and bytes. In the present case, an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive; the more direct acceptance evidence is “The candidate host's suspicious web destinations and matched indicators appear with timestamps” because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

This safeguard, “Annotate enforcement outcome when presenting website risk summaries”, reduces a different source-defined risk: The SOC's Top Websites widget reports a blocked phishing domain as the most visited site, but executives infer that users successfully accessed it. That risk depends on: Website request counts can include blocked attempts; aggregation alone does not establish successful page delivery. The recurring problem here is an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The originally selected control “Attach IoC supporting records before recommending endpoint quarantine” is more specific because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

This safeguard, “Use explicit date ranges when investigating older threat spikes”, reduces a different source-defined risk: The SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. That risk depends on: FortiView aggregates records only inside the selected interval; an event outside the window is not counted. The recurring problem here is an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The originally selected control “Attach IoC supporting records before recommending endpoint quarantine” is more specific because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

This safeguard, “Review dashboard display density on the SOC's operating screen sizes”, reduces a different source-defined risk: A supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. That risk depends on: Dashboard layout controls presentation size and placement, not the underlying event aggregation. The recurring problem here is an IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. The originally selected control “Attach IoC supporting records before recommending endpoint quarantine” is more specific because a visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions.

The action “Save the configured FortiView custom view with its approved device and time filters” addresses a separate source case: A SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. Its underlying reason is: Custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace. This question instead describes a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The original answer “Check the FortiSandbox detection action and associated delivery logs before treating the verdict as enforcement” targets that failure because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The action “Enable and validate the required security-profile logging upstream rather than merely changing graph colors” addresses a separate source case: A FortiView widget displaying top attack categories is empty because the connected FortiGate forwards only basic traffic logs, not security-profile events. Its underlying reason is: Threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections. This question instead describes a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The original answer “Check the FortiSandbox detection action and associated delivery logs before treating the verdict as enforcement” targets that failure because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The action “Resize and reorganize the supported FortiView widgets in a custom dashboard without changing their data sources” addresses a separate source case: A supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. Its underlying reason is: Dashboard layout controls presentation size and placement, not the underlying event aggregation. This question instead describes a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The original answer “Check the FortiSandbox detection action and associated delivery logs before treating the verdict as enforcement” targets that failure because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The action “Application Control telemetry can group activity by detected application, not just network address” addresses a separate source case: An employee's laptop consumes unexpected bandwidth through a video-sharing application, but the SOC reports only the destination IP addresses. Its underlying reason is: Application Control telemetry can group activity by detected application, not just network address. This question instead describes a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The original answer “A malicious analysis verdict and the action applied to the file are separate recorded attributes” targets that failure because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The action “A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question” addresses a separate source case: FortiView displays a sharp rise in source traffic volume, but the analyst wants to identify which internal IPs produced the increase instead of guessing from applications. Its underlying reason is: A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question. This question instead describes a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The original answer “A malicious analysis verdict and the action applied to the file are separate recorded attributes” targets that failure because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The action “Website request counts can include blocked attempts; aggregation alone does not establish successful page delivery” addresses a separate source case: The SOC's Top Websites widget reports a blocked phishing domain as the most visited site, but executives infer that users successfully accessed it. Its underlying reason is: Website request counts can include blocked attempts; aggregation alone does not establish successful page delivery. This question instead describes a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The original answer “A malicious analysis verdict and the action applied to the file are separate recorded attributes” targets that failure because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The proposed observation “The top source list identifies the high-volume endpoint and underlying traffic logs corroborate its bytes” would check a different original case: FortiView displays a sharp rise in source traffic volume, but the analyst wants to identify which internal IPs produced the increase instead of guessing from applications. Its mechanism is: A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question. In the present case, a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked; the more direct acceptance evidence is “The incident note identifies the verdict and actual Passthrough action without claiming a block occurred” because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The proposed observation “The domain's event list separates denied attempts from allowed requests and reconciles the widget count” would check a different original case: The SOC's Top Websites widget reports a blocked phishing domain as the most visited site, but executives infer that users successfully accessed it. Its mechanism is: Website request counts can include blocked attempts; aggregation alone does not establish successful page delivery. In the present case, a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked; the more direct acceptance evidence is “The incident note identifies the verdict and actual Passthrough action without claiming a block occurred” because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The proposed observation “The external address appears as a destination with associated internal sources and session details” would check a different original case: A data-exfiltration suspicion concerns one unfamiliar Internet destination, but investigators only inspect the busiest internal hosts. Its mechanism is: Destination aggregation groups outbound targets and helps locate external communication partners separately from internal sources. In the present case, a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked; the more direct acceptance evidence is “The incident note identifies the verdict and actual Passthrough action without claiming a block occurred” because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

This safeguard, “Maintain critical-server inventories for high-priority threat-destination triage”, reduces a different source-defined risk: An analyst sees many threat alerts but needs to know the most frequently targeted servers rather than which detection signatures are globally common. That risk depends on: Threat-destination views aggregate the targets of security events, differing from signature-frequency charts. The recurring problem here is a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The originally selected control “Require verdict-versus-action interpretation in sandbox detection triage” is more specific because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

This safeguard, “Distinguish temporary investigative filters from persistent shared-view configuration”, reduces a different source-defined risk: Analysts want to narrow one FortiView chart to a single risky destination while leaving unrelated saved dashboard definitions unchanged. That risk depends on: Interactive filters refine the visible aggregation without necessarily modifying the original saved dashboard. The recurring problem here is a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The originally selected control “Require verdict-versus-action interpretation in sandbox detection triage” is more specific because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

This safeguard, “Pair volume widgets with collection-health indicators for operational decisions”, reduces a different source-defined risk: After a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. That risk depends on: An ingestion gap can make traffic summaries fall even if actual network activity remains constant. The recurring problem here is a FortiSandbox detections widget includes a malicious file but lists the action as Passthrough, and a responder assumes it must already have been blocked. The originally selected control “Require verdict-versus-action interpretation in sandbox detection triage” is more specific because a malicious analysis verdict and the action applied to the file are separate recorded attributes.

The action “Add eligible FortiView FortiSandbox and DLP widgets to a custom dashboard with the right security log sources” addresses a separate source case: A custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. Its underlying reason is: Different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses. This question instead describes a supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. The original answer “Resize and reorganize the supported FortiView widgets in a custom dashboard without changing their data sources” targets that failure because dashboard layout controls presentation size and placement, not the underlying event aggregation.

The action “Expand the FortiView time range to include the incident period and keep the source device filters consistent” addresses a separate source case: The SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. Its underlying reason is: FortiView aggregates records only inside the selected interval; an event outside the window is not counted. This question instead describes a supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. The original answer “Resize and reorganize the supported FortiView widgets in a custom dashboard without changing their data sources” targets that failure because dashboard layout controls presentation size and placement, not the underlying event aggregation.

The action “Inspect FortiView Applications for the user or source and examine classified application usage” addresses a separate source case: An employee's laptop consumes unexpected bandwidth through a video-sharing application, but the SOC reports only the destination IP addresses. Its underlying reason is: Application Control telemetry can group activity by detected application, not just network address. This question instead describes a supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. The original answer “Resize and reorganize the supported FortiView widgets in a custom dashboard without changing their data sources” targets that failure because dashboard layout controls presentation size and placement, not the underlying event aggregation.

The action “Application Control telemetry can group activity by detected application, not just network address” addresses a separate source case: An employee's laptop consumes unexpected bandwidth through a video-sharing application, but the SOC reports only the destination IP addresses. Its underlying reason is: Application Control telemetry can group activity by detected application, not just network address. This question instead describes a supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. The original answer “Dashboard layout controls presentation size and placement, not the underlying event aggregation” targets that failure because dashboard layout controls presentation size and placement, not the underlying event aggregation.

The action “Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event” addresses a separate source case: The FortiView Threat Map is blank even though internal-to-internal threats are present in logs, and the team concludes the feature is broken. Its underlying reason is: Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event. This question instead describes a supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. The original answer “Dashboard layout controls presentation size and placement, not the underlying event aggregation” targets that failure because dashboard layout controls presentation size and placement, not the underlying event aggregation.

The action “Interactive filters refine the visible aggregation without necessarily modifying the original saved dashboard” addresses a separate source case: Analysts want to narrow one FortiView chart to a single risky destination while leaving unrelated saved dashboard definitions unchanged. Its underlying reason is: Interactive filters refine the visible aggregation without necessarily modifying the original saved dashboard. This question instead describes a supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. The original answer “Dashboard layout controls presentation size and placement, not the underlying event aggregation” targets that failure because dashboard layout controls presentation size and placement, not the underlying event aggregation.