Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Use consistent documented analysis windows for comparing security trend widgets”, reduces a different source-defined risk: A threat dashboard ranks one destination highly, but an analyst needs to isolate whether the spike occurred in the previous hour or over the whole week. That risk depends on: Time filtering changes which log samples contribute to an aggregate, so rankings can differ by investigation interval. The recurring problem here is a FortiView widget displaying top attack categories is empty because the connected FortiGate forwards only basic traffic logs, not security-profile events. The originally selected control “Verify source telemetry prerequisites for every new dashboard widget” is more specific because threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections.

This safeguard, “Document map eligibility limits before using the map as sole threat coverage evidence”, reduces a different source-defined risk: The FortiView Threat Map is blank even though internal-to-internal threats are present in logs, and the team concludes the feature is broken. That risk depends on: Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event. The recurring problem here is a FortiView widget displaying top attack categories is empty because the connected FortiGate forwards only basic traffic logs, not security-profile events. The originally selected control “Verify source telemetry prerequisites for every new dashboard widget” is more specific because threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections.

This safeguard, “Use source-specific monitors when investigating origin-side traffic changes”, reduces a different source-defined risk: FortiView displays a sharp rise in source traffic volume, but the analyst wants to identify which internal IPs produced the increase instead of guessing from applications. That risk depends on: A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question. The recurring problem here is a FortiView widget displaying top attack categories is empty because the connected FortiGate forwards only basic traffic logs, not security-profile events. The originally selected control “Verify source telemetry prerequisites for every new dashboard widget” is more specific because threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections.

The action “Add eligible FortiView FortiSandbox and DLP widgets to a custom dashboard with the right security log sources” addresses a separate source case: A custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. Its underlying reason is: Different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses. This question instead describes the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The original answer “Expand the FortiView time range to include the incident period and keep the source device filters consistent” targets that failure because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The action “Save the configured FortiView custom view with its approved device and time filters” addresses a separate source case: A SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. Its underlying reason is: Custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace. This question instead describes the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The original answer “Expand the FortiView time range to include the incident period and keep the source device filters consistent” targets that failure because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The action “Use FortiView Destinations with time, device, and destination filtering before drilling into the suspicious endpoint” addresses a separate source case: A data-exfiltration suspicion concerns one unfamiliar Internet destination, but investigators only inspect the busiest internal hosts. Its underlying reason is: Destination aggregation groups outbound targets and helps locate external communication partners separately from internal sources. This question instead describes the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The original answer “Expand the FortiView time range to include the incident period and keep the source device filters consistent” targets that failure because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The action “Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event” addresses a separate source case: The FortiView Threat Map is blank even though internal-to-internal threats are present in logs, and the team concludes the feature is broken. Its underlying reason is: Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event. This question instead describes the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The original answer “FortiView aggregates records only inside the selected interval; an event outside the window is not counted” targets that failure because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The action “Application Control telemetry can group activity by detected application, not just network address” addresses a separate source case: An employee's laptop consumes unexpected bandwidth through a video-sharing application, but the SOC reports only the destination IP addresses. Its underlying reason is: Application Control telemetry can group activity by detected application, not just network address. This question instead describes the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The original answer “FortiView aggregates records only inside the selected interval; an event outside the window is not counted” targets that failure because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The action “Custom views preserve chosen dashboard widgets and filters without requiring changes to every predefined view” addresses a separate source case: A custom FortiView dashboard is needed for an executive threat summary, but administrators overwrite the default threat view for all analysts. Its underlying reason is: Custom views preserve chosen dashboard widgets and filters without requiring changes to every predefined view. This question instead describes the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The original answer “FortiView aggregates records only inside the selected interval; an event outside the window is not counted” targets that failure because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The proposed observation “Reopening the view restores the cluster-focused filters and charts” would check a different original case: A SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. Its mechanism is: Custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace. In the present case, the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes; the more direct acceptance evidence is “Yesterday's threat detection appears when that day is included in the query scope” because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The proposed observation “The timeline marks the missing data and an independent traffic source confirms the true activity level” would check a different original case: After a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. Its mechanism is: An ingestion gap can make traffic summaries fall even if actual network activity remains constant. In the present case, the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes; the more direct acceptance evidence is “Yesterday's threat detection appears when that day is included in the query scope” because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The proposed observation “The selected destination's data narrows on screen while the base dashboard remains available” would check a different original case: Analysts want to narrow one FortiView chart to a single risky destination while leaving unrelated saved dashboard definitions unchanged. Its mechanism is: Interactive filters refine the visible aggregation without necessarily modifying the original saved dashboard. In the present case, the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes; the more direct acceptance evidence is “Yesterday's threat detection appears when that day is included in the query scope” because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

This safeguard, “Retain approved destination baselines for unusual outbound traffic review”, reduces a different source-defined risk: A data-exfiltration suspicion concerns one unfamiliar Internet destination, but investigators only inspect the busiest internal hosts. That risk depends on: Destination aggregation groups outbound targets and helps locate external communication partners separately from internal sources. The recurring problem here is the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The originally selected control “Use explicit date ranges when investigating older threat spikes” is more specific because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

This safeguard, “Manage custom dashboard ownership and review changes before distributing them”, reduces a different source-defined risk: A custom FortiView dashboard is needed for an executive threat summary, but administrators overwrite the default threat view for all analysts. That risk depends on: Custom views preserve chosen dashboard widgets and filters without requiring changes to every predefined view. The recurring problem here is the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The originally selected control “Use explicit date ranges when investigating older threat spikes” is more specific because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

This safeguard, “Review dashboard display density on the SOC's operating screen sizes”, reduces a different source-defined risk: A supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. That risk depends on: Dashboard layout controls presentation size and placement, not the underlying event aggregation. The recurring problem here is the SOC has a valid alert list, yet the FortiView Threats panel does not display yesterday's events after an administrator set the view to Last 15 minutes. The originally selected control “Use explicit date ranges when investigating older threat spikes” is more specific because fortiView aggregates records only inside the selected interval; an event outside the window is not counted.

The action “Change the FortiView time period and compare the same destination across equivalent shorter windows” addresses a separate source case: A threat dashboard ranks one destination highly, but an analyst needs to isolate whether the spike occurred in the previous hour or over the whole week. Its underlying reason is: Time filtering changes which log samples contribute to an aggregate, so rankings can differ by investigation interval. This question instead describes a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The original answer “Add eligible FortiView FortiSandbox and DLP widgets to a custom dashboard with the right security log sources” targets that failure because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The action “Save the configured FortiView custom view with its approved device and time filters” addresses a separate source case: A SOC needs to keep a stable dashboard showing one FortiGate cluster for morning handover, but the current widget resets to all devices on every visit. Its underlying reason is: Custom View can retain device selection, widget choices, and time period as a repeatable analysis workspace. This question instead describes a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The original answer “Add eligible FortiView FortiSandbox and DLP widgets to a custom dashboard with the right security log sources” targets that failure because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The action “Open a relevant FortiView Sources monitor, narrow time and devices, and drill into top source addresses” addresses a separate source case: FortiView displays a sharp rise in source traffic volume, but the analyst wants to identify which internal IPs produced the increase instead of guessing from applications. Its underlying reason is: A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question. This question instead describes a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The original answer “Add eligible FortiView FortiSandbox and DLP widgets to a custom dashboard with the right security log sources” targets that failure because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The action “Dashboard layout controls presentation size and placement, not the underlying event aggregation” addresses a separate source case: A supervisor needs to compare the top five security threats and top affected destinations side by side, but a widget occupies nearly the entire dashboard. Its underlying reason is: Dashboard layout controls presentation size and placement, not the underlying event aggregation. This question instead describes a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The original answer “Different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses” targets that failure because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The action “A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question” addresses a separate source case: FortiView displays a sharp rise in source traffic volume, but the analyst wants to identify which internal IPs produced the increase instead of guessing from applications. Its underlying reason is: A source-oriented FortiView aggregation groups traffic by origin; application summaries answer a different question. This question instead describes a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The original answer “Different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses” targets that failure because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The action “Website request counts can include blocked attempts; aggregation alone does not establish successful page delivery” addresses a separate source case: The SOC's Top Websites widget reports a blocked phishing domain as the most visited site, but executives infer that users successfully accessed it. Its underlying reason is: Website request counts can include blocked attempts; aggregation alone does not establish successful page delivery. This question instead describes a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The original answer “Different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses” targets that failure because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The proposed observation “The selected destination's data narrows on screen while the base dashboard remains available” would check a different original case: Analysts want to narrow one FortiView chart to a single risky destination while leaving unrelated saved dashboard definitions unchanged. Its mechanism is: Interactive filters refine the visible aggregation without necessarily modifying the original saved dashboard. In the present case, a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart; the more direct acceptance evidence is “The custom view shows both malware and DLP sample events under their respective widgets” because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The proposed observation “The changed policy shows the expected traffic trend and matching individual log records” would check a different original case: A firewall change is suspected of increasing traffic through policy 41, and the team wants policy-specific evidence rather than a network-wide bandwidth total. Its mechanism is: Policy-focused aggregation reveals which rules handle observed sessions and bytes. In the present case, a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart; the more direct acceptance evidence is “The custom view shows both malware and DLP sample events under their respective widgets” because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The proposed observation “An eligible public-IP test detection appears while private-only records remain available in other views” would check a different original case: The FortiView Threat Map is blank even though internal-to-internal threats are present in logs, and the team concludes the feature is broken. Its mechanism is: Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event. In the present case, a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart; the more direct acceptance evidence is “The custom view shows both malware and DLP sample events under their respective widgets” because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

This safeguard, “Attach IoC supporting records before recommending endpoint quarantine”, reduces a different source-defined risk: An IoC monitor flags a suspicious host, but the analyst wants to see associated web-filter detections and threat ratings rather than treat the icon as conclusive. That risk depends on: A visual threat rating summarizes evidence; the underlying events are needed for incident-level conclusions. The recurring problem here is a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The originally selected control “Validate widget data-source requirements during dashboard design review” is more specific because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

This safeguard, “Verify source telemetry prerequisites for every new dashboard widget”, reduces a different source-defined risk: A FortiView widget displaying top attack categories is empty because the connected FortiGate forwards only basic traffic logs, not security-profile events. That risk depends on: Threat widgets require eligible threat/security log data; ordinary traffic logs need not contain IPS or antivirus detections. The recurring problem here is a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The originally selected control “Validate widget data-source requirements during dashboard design review” is more specific because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

This safeguard, “Record ADOM/device/time context when sharing dashboard screenshots or links”, reduces a different source-defined risk: A drill-down from a traffic dashboard seems to lead to unrelated sessions because the analyst changed ADOMs after the initial summary. That risk depends on: A drill-down is meaningful only when the same authorized data scope governs both summary and detail. The recurring problem here is a custom FortiView view must combine malware detections and data-loss indicators, but the author uses only a general traffic-volume chart. The originally selected control “Validate widget data-source requirements during dashboard design review” is more specific because different widget types summarize different security-profile streams; one traffic chart cannot substitute for DLP or sandbox analyses.

The action “Check the map's public-address and positive threat-score display conditions together with the selected filters” addresses a separate source case: The FortiView Threat Map is blank even though internal-to-internal threats are present in logs, and the team concludes the feature is broken. Its underlying reason is: Threat Map geographic lines depend on eligible public-IP threat context and threat scoring, not every private-network event. This question instead describes after a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. The original answer “Compare the FortiView period with log ingestion and source availability before interpreting session changes” targets that failure because an ingestion gap can make traffic summaries fall even if actual network activity remains constant.

The action “Change the FortiView time period and compare the same destination across equivalent shorter windows” addresses a separate source case: A threat dashboard ranks one destination highly, but an analyst needs to isolate whether the spike occurred in the previous hour or over the whole week. Its underlying reason is: Time filtering changes which log samples contribute to an aggregate, so rankings can differ by investigation interval. This question instead describes after a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. The original answer “Compare the FortiView period with log ingestion and source availability before interpreting session changes” targets that failure because an ingestion gap can make traffic summaries fall even if actual network activity remains constant.

The action “Confirm the active ADOM, selected device, and time filters match between the aggregate and detailed Log View” addresses a separate source case: A drill-down from a traffic dashboard seems to lead to unrelated sessions because the analyst changed ADOMs after the initial summary. Its underlying reason is: A drill-down is meaningful only when the same authorized data scope governs both summary and detail. This question instead describes after a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. The original answer “Compare the FortiView period with log ingestion and source availability before interpreting session changes” targets that failure because an ingestion gap can make traffic summaries fall even if actual network activity remains constant.

The action “Time filtering changes which log samples contribute to an aggregate, so rankings can differ by investigation interval” addresses a separate source case: A threat dashboard ranks one destination highly, but an analyst needs to isolate whether the spike occurred in the previous hour or over the whole week. Its underlying reason is: Time filtering changes which log samples contribute to an aggregate, so rankings can differ by investigation interval. This question instead describes after a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. The original answer “An ingestion gap can make traffic summaries fall even if actual network activity remains constant” targets that failure because an ingestion gap can make traffic summaries fall even if actual network activity remains constant.

The action “Policy-focused aggregation reveals which rules handle observed sessions and bytes” addresses a separate source case: A firewall change is suspected of increasing traffic through policy 41, and the team wants policy-specific evidence rather than a network-wide bandwidth total. Its underlying reason is: Policy-focused aggregation reveals which rules handle observed sessions and bytes. This question instead describes after a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. The original answer “An ingestion gap can make traffic summaries fall even if actual network activity remains constant” targets that failure because an ingestion gap can make traffic summaries fall even if actual network activity remains constant.

The action “Threat-destination views aggregate the targets of security events, differing from signature-frequency charts” addresses a separate source case: An analyst sees many threat alerts but needs to know the most frequently targeted servers rather than which detection signatures are globally common. Its underlying reason is: Threat-destination views aggregate the targets of security events, differing from signature-frequency charts. This question instead describes after a logging outage, FortiView reports a sudden reduction in sessions and managers call it successful traffic reduction. The original answer “An ingestion gap can make traffic summaries fall even if actual network activity remains constant” targets that failure because an ingestion gap can make traffic summaries fall even if actual network activity remains constant.