Fortinet FCP_FAZ_AN-7.6 Questions & Answers

This safeguard, “Regression-test report SQL against representative logs after source firmware changes”, reduces a different source-defined risk: A report chart shows null values for source usernames after a FortiGate firmware update changed an optional field's availability. That risk depends on: Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined. The recurring problem here is a report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. The originally selected control “Include multi-device negative tests when validating report filter bindings” is more specific because report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts.

This safeguard, “Audit active cache dependencies and disk usage after removing old reports”, reduces a different source-defined risk: A monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. That risk depends on: Persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need. The recurring problem here is a report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. The originally selected control “Include multi-device negative tests when validating report filter bindings” is more specific because report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts.

This safeguard, “Audit active schedules and recipients after migrations and imports”, reduces a different source-defined risk: A scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. That risk depends on: Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry. The recurring problem here is a report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. The originally selected control “Include multi-device negative tests when validating report filter bindings” is more specific because report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts.

The action “Inspect report layout dependencies and restore the referenced macro or remove the invalid element” addresses a separate source case: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. Its underlying reason is: A missing layout object can break one rendered component without affecting unrelated dataset queries. This question instead describes a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The original answer “Inspect query execution cost, date range, indexing, and suitable auto-cache or aggregation strategy” targets that failure because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The action “Identify both scheduling definitions, retain the intended owner schedule, and disable the redundant one” addresses a separate source case: A scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. Its underlying reason is: Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry. This question instead describes a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The original answer “Inspect query execution cost, date range, indexing, and suitable auto-cache or aggregation strategy” targets that failure because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The action “Review hcache usage and disable unnecessary report auto-cache, using supported cleanup processes where appropriate” addresses a separate source case: A monthly report consumes growing disk because auto-cache stores intermediates for dozens of historical queries that no longer appear in active reports. Its underlying reason is: Persistent hcache tables consume storage; obsolete cached workloads can outlive the immediate report generation need. This question instead describes a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The original answer “Inspect query execution cost, date range, indexing, and suitable auto-cache or aggregation strategy” targets that failure because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The action “A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue” addresses a separate source case: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. Its underlying reason is: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. This question instead describes a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The original answer “Large historical scans can be expensive even when the query is logically valid and recent periods complete” targets that failure because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The action “A presentation-level row limit can suppress displayed detail without removing records from the Analytics database” addresses a separate source case: An analyst exports a report that is truncated at an unexpectedly low row count, despite the underlying dataset containing many more records. Its underlying reason is: A presentation-level row limit can suppress displayed detail without removing records from the Analytics database. This question instead describes a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The original answer “Large historical scans can be expensive even when the query is logically valid and recent periods complete” targets that failure because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The action “Email transport authentication is independent of dataset correctness or report layout” addresses a separate source case: A scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. Its underlying reason is: Email transport authentication is independent of dataset correctness or report layout. This question instead describes a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The original answer “Large historical scans can be expensive even when the query is logically valid and recent periods complete” targets that failure because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The proposed observation “The generated test file arrives at the approved archive and is readable by authorized users” would check a different original case: An externally archived report cannot be retrieved though the generation task shows Completed and the local output file exists. Its mechanism is: Local generation success does not prove external storage upload or retention succeeded. In the present case, a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy; the more direct acceptance evidence is “An optimized or cached year-long test returns correct totals within the approved runtime” because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The proposed observation “The corrected explanation and query cover the intended local-day period with UTC-aligned source logs” would check a different original case: A report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. Its mechanism is: A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records. In the present case, a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy; the more direct acceptance evidence is “An optimized or cached year-long test returns correct totals within the approved runtime” because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The proposed observation “The completed report reaches the approved recipient after profile repair and the data remain unchanged” would check a different original case: A scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. Its mechanism is: Email transport authentication is independent of dataset correctness or report layout. In the present case, a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy; the more direct acceptance evidence is “An optimized or cached year-long test returns correct totals within the approved runtime” because large historical scans can be expensive even when the query is logically valid and recent periods complete.

This safeguard, “Specify and test maximum row counts for evidence-bearing reports”, reduces a different source-defined risk: An analyst exports a report that is truncated at an unexpectedly low row count, despite the underlying dataset containing many more records. That risk depends on: A presentation-level row limit can suppress displayed detail without removing records from the Analytics database. The recurring problem here is a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The originally selected control “Benchmark report queries against maximum required lookback periods” is more specific because large historical scans can be expensive even when the query is logically valid and recent periods complete.

This safeguard, “Include multi-device negative tests when validating report filter bindings”, reduces a different source-defined risk: A report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. That risk depends on: Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts. The recurring problem here is a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The originally selected control “Benchmark report queries against maximum required lookback periods” is more specific because large historical scans can be expensive even when the query is logically valid and recent periods complete.

This safeguard, “Document feature availability by FortiAnalyzer operation mode”, reduces a different source-defined risk: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. That risk depends on: Collector mode does not provide the full Reports feature set offered in Analyzer mode. The recurring problem here is a custom chart query times out only for a year-long period; one-week queries finish quickly and data ingestion is healthy. The originally selected control “Benchmark report queries against maximum required lookback periods” is more specific because large historical scans can be expensive even when the query is logically valid and recent periods complete.

The action “Open the dataset validator or task error, correct the faulty SQL expression, and retest the query” addresses a separate source case: A FortiAnalyzer report task fails with SQL syntax error after a custom dataset edit, and the administrator immediately increases disk quota. Its underlying reason is: A SQL parsing or validation failure is a query-definition problem, not inherently a storage capacity issue. This question instead describes a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The original answer “Check report timezone and daylight-saving boundary semantics against UTC event times” targets that failure because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The action “Inspect chart properties and remove or correct the stale severity filter while retaining the dataset” addresses a separate source case: A report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. Its underlying reason is: Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings. This question instead describes a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The original answer “Check report timezone and daylight-saving boundary semantics against UTC event times” targets that failure because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The action “Correct the dataset's supported device-scope handling and retest reports with distinct source serials” addresses a separate source case: A report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. Its underlying reason is: Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts. This question instead describes a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The original answer “Check report timezone and daylight-saving boundary semantics against UTC event times” targets that failure because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The action “Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts” addresses a separate source case: A report returns identical threat totals for two different branches because the custom SQL dataset ignores the report's selected-device filter variable. Its underlying reason is: Report-level filters must be passed into applicable dataset queries; a query that ignores device context can produce misleading shared counts. This question instead describes a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The original answer “A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records” targets that failure because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The action “Many-to-many joins multiply counts and can produce invalid ratios even when the underlying log records are correct” addresses a separate source case: A report calculates percentages above one hundred after joining event and endpoint inventories where endpoints have multiple asset records. Its underlying reason is: Many-to-many joins multiply counts and can produce invalid ratios even when the underlying log records are correct. This question instead describes a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The original answer “A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records” targets that failure because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The action “Collector mode does not provide the full Reports feature set offered in Analyzer mode” addresses a separate source case: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. Its underlying reason is: Collector mode does not provide the full Reports feature set offered in Analyzer mode. This question instead describes a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The original answer “A local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records” targets that failure because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The proposed observation “The restored macro displays a valid test value in a new export” would check a different original case: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. Its mechanism is: A missing layout object can break one rendered component without affecting unrelated dataset queries. In the present case, a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss; the more direct acceptance evidence is “The corrected explanation and query cover the intended local-day period with UTC-aligned source logs” because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The proposed observation “Old and new sample log formats map to the expected categories and total event count is conserved” would check a different original case: A threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. Its mechanism is: Changing normalized severity representation alters grouping even when the number of raw detections has not changed. In the present case, a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss; the more direct acceptance evidence is “The corrected explanation and query cover the intended local-day period with UTC-aligned source logs” because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The proposed observation “The completed report reaches the approved recipient after profile repair and the data remain unchanged” would check a different original case: A scheduled report output profile fails to authenticate to an external mail relay after the account password rotates. Its mechanism is: Email transport authentication is independent of dataset correctness or report layout. In the present case, a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss; the more direct acceptance evidence is “The corrected explanation and query cover the intended local-day period with UTC-aligned source logs” because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

This safeguard, “Bundle referenced datasets and charts during report imports”, reduces a different source-defined risk: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. That risk depends on: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. The recurring problem here is a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The originally selected control “Document time-zone and DST behavior for calendar-based scheduled reports” is more specific because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

This safeguard, “Validate all report layout references after removing charts, macros, or templates”, reduces a different source-defined risk: An export has a blank chart because the report's layout references a deleted macro, while other charts load correctly. That risk depends on: A missing layout object can break one rendered component without affecting unrelated dataset queries. The recurring problem here is a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The originally selected control “Document time-zone and DST behavior for calendar-based scheduled reports” is more specific because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

This safeguard, “Document feature availability by FortiAnalyzer operation mode”, reduces a different source-defined risk: The reports pane is missing entirely for an operator using a FortiAnalyzer configured as Collector, although raw archives are present. That risk depends on: Collector mode does not provide the full Reports feature set offered in Analyzer mode. The recurring problem here is a report generated for a supposed 24-hour window contains 23 hours of data during a daylight-saving change, and the operator calls it a database loss. The originally selected control “Document time-zone and DST behavior for calendar-based scheduled reports” is more specific because a local calendar day can differ from exactly 24 hours during daylight-saving transitions without missing records.

The action “Identify both scheduling definitions, retain the intended owner schedule, and disable the redundant one” addresses a separate source case: A scheduled email report becomes duplicated after a migration because two identical report definitions with independent schedules are active in different ADOMs. Its underlying reason is: Separate report definitions can each generate and notify recipients; duplicate delivery need not indicate a transport retry. This question instead describes a threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. The original answer “Inspect parser normalization and update the dataset's severity mapping to the current documented field semantics” targets that failure because changing normalized severity representation alters grouping even when the number of raw detections has not changed.

The action “Compare requested lookback to available Analytics partitions and revise retention or reporting expectations accordingly” addresses a separate source case: A report job fails when an ADOM's Analytics retention is shorter than the requested reporting period but the administrator searches only archive files. Its underlying reason is: Archive-only historical data may not be immediately queryable by Analytics-backed report datasets. This question instead describes a threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. The original answer “Inspect parser normalization and update the dataset's severity mapping to the current documented field semantics” targets that failure because changing normalized severity representation alters grouping even when the number of raw detections has not changed.

The action “Inspect chart properties and remove or correct the stale severity filter while retaining the dataset” addresses a separate source case: A report intended to compare incident severities includes only one category because an old chart-level filter still restricts results to Critical. Its underlying reason is: Chart-level filters can narrow otherwise valid dataset rows independently of the report-wide settings. This question instead describes a threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. The original answer “Inspect parser normalization and update the dataset's severity mapping to the current documented field semantics” targets that failure because changing normalized severity representation alters grouping even when the number of raw detections has not changed.

The action “Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined” addresses a separate source case: A report chart shows null values for source usernames after a FortiGate firmware update changed an optional field's availability. Its underlying reason is: Missing or changed raw fields propagate as null through report SQL unless a supported fallback is defined. This question instead describes a threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. The original answer “Changing normalized severity representation alters grouping even when the number of raw detections has not changed” targets that failure because changing normalized severity representation alters grouping even when the number of raw detections has not changed.

The action “Archive-only historical data may not be immediately queryable by Analytics-backed report datasets” addresses a separate source case: A report job fails when an ADOM's Analytics retention is shorter than the requested reporting period but the administrator searches only archive files. Its underlying reason is: Archive-only historical data may not be immediately queryable by Analytics-backed report datasets. This question instead describes a threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. The original answer “Changing normalized severity representation alters grouping even when the number of raw detections has not changed” targets that failure because changing normalized severity representation alters grouping even when the number of raw detections has not changed.

The action “Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere” addresses a separate source case: A report was imported to another ADOM but a chart references a dataset name that does not exist there, producing an object-not-found error. Its underlying reason is: Report charts depend on datasets within a specific ADOM context, not on identically named objects elsewhere. This question instead describes a threat chart's numeric counts change after a parser update because the normalized severity field now stores values in a different scale. The original answer “Changing normalized severity representation alters grouping even when the number of raw detections has not changed” targets that failure because changing normalized severity representation alters grouping even when the number of raw detections has not changed.