Fortinet FCP_FAZ_AN-7.6 Practice Test 58
Question 570
A report designer cannot save a shared template because its administrator profile is scoped to the wrong ADOM. The observed fault is: Giving global administration to every report viewer weakens separation of duties. How should the administrator restore and verify the intended state?
- The corrective action is to disable audit logs to make template saves appear successful.
- The corrective action is to assume a report download permission grants template authoring automatically.
- The corrective action is to correct scoped report privileges and verify allowed and denied edits.
- The corrective action is to bypass all ADOM protections by copying a direct report URL.
Explanation
Correct Answer
C:This fixes the described operational problem with observable validation. Recheck admin profile permissions, ADOM selection, template owner and read-write test.
Incorrect Answers
A:Disable audit logs to make template saves appear successful. Giving global administration to every report viewer weakens separation of duties. Instead, correct scoped report privileges and verify allowed and denied edits.
B:Assume a report download permission grants template authoring automatically. Giving global administration to every report viewer weakens separation of duties. Instead, correct scoped report privileges and verify allowed and denied edits.
D:Bypass all ADOM protections by copying a direct report URL. Giving global administration to every report viewer weakens separation of duties. Instead, correct scoped report privileges and verify allowed and denied edits.
Question 571
A monthly report misses IPS blocks because the dataset filters for traffic accept logs. Which configuration decision most directly resolves this situation?
- Inspect dataset table selection, filter predicates and ADOM or device scope against known log samples.
- Change chart ordering while leaving the wrong dataset filter intact.
- Assume the report title determines which device logs are selected.
- Remove every source log because the SQL query returned nothing.
Explanation
Correct Answer
A:Verify using dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. This is the targeted correction for report dataset filter mismatch.
Incorrect Answers
B:Incorrect filters can silently exclude target log types or devices. Use inspect dataset table selection, filter predicates and ADOM or device scope against known log samples.
C:Assume the report title determines which device logs are selected. A report only summarizes the records returned by its configured dataset and filters. Relevant observations are dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
D:Incorrect filters can silently exclude target log types or devices. The supported correction is inspect dataset table selection, filter predicates and ADOM or device scope against known log samples.
Question 572
A monthly report misses IPS blocks because the dataset filters for traffic accept logs. What evidence most strongly confirms the operational condition?
- A chart title with no underlying dated source records.
- One source IP without source device or session context.
- Dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
- A pie chart snapshot without filters and drilldown to logs.
Explanation
Correct Answer
C:The planned operation is inspect dataset table selection, filter predicates and ADOM or device scope against known log samples. These observations directly test report dataset filter mismatch under the actual system state.
Incorrect Answers
A:A chart title with no underlying dated source records. The relevant evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
B:One source IP without source device or session context. The relevant evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
D:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
Question 573
A monthly report misses IPS blocks because the dataset filters for traffic accept logs. What FortiAnalyzer behavior explains the correct decision?
- A traffic volume graph alone proves data exfiltration occurred.
- An event count always equals the number of compromised devices.
- A report only summarizes the records returned by its configured dataset and filters.
- Every UTM detection means a firewall session was blocked.
Explanation
Correct Answer
C:Verification depends on dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. This is why inspect dataset table selection, filter predicates and ADOM or device scope against known log samples.
Incorrect Answers
A:That generalization is incorrect in the context of report dataset filter mismatch. The relevant behavior is a report only summarizes the records returned by its configured dataset and filters.
B:That generalization is incorrect in the context of report dataset filter mismatch. Check dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
D:That generalization is incorrect in the context of report dataset filter mismatch. In this specific situation, a monthly report misses IPS blocks because the dataset filters for traffic accept logs.
Question 574
A monthly report misses IPS blocks because the dataset filters for traffic accept logs. An operator instead chooses this incorrect shortcut: Change chart ordering while leaving the wrong dataset filter intact. Which resulting risk should the reviewer identify?
- Incorrect filters can silently exclude target log types or devices.
- A controlled analyst investigation itself disconnected every FortiGate.
- A legitimate source log lookup caused all earlier IPS events.
- The only fault is an unrelated chart legend spelling error.
Explanation
Correct Answer
A:The intended preventive choice is inspect dataset table selection, filter predicates and ADOM or device scope against known log samples. A report only summarizes the records returned by its configured dataset and filters.
Incorrect Answers
B:A controlled analyst investigation itself disconnected every FortiGate. This does not account for the actual report dataset filter mismatch weakness. The more relevant failure is incorrect filters can silently exclude target log types or devices. Confirm with dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
C:A legitimate source log lookup caused all earlier IPS events. This does not account for the actual report dataset filter mismatch weakness. The more relevant failure is incorrect filters can silently exclude target log types or devices. Confirm with dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
D:The only fault is an unrelated chart legend spelling error. This does not account for the actual report dataset filter mismatch weakness. The more relevant failure is incorrect filters can silently exclude target log types or devices. Confirm with dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
Question 575
A monthly report misses IPS blocks because the dataset filters for traffic accept logs. The observed fault is: Incorrect filters can silently exclude target log types or devices. How should the administrator restore and verify the intended state?
- Assume the report title determines which device logs are selected.
- Correct dataset conditions and test with a known matching sample before rerunning.
- Remove every source log because the SQL query returned nothing.
- Change chart ordering while leaving the wrong dataset filter intact.
Explanation
Correct Answer
B:Recheck dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
Incorrect Answers
A:Assume the report title determines which device logs are selected. Incorrect filters can silently exclude target log types or devices. Instead, correct dataset conditions and test with a known matching sample before rerunning.
C:Remove every source log because the SQL query returned nothing. Incorrect filters can silently exclude target log types or devices. Instead, correct dataset conditions and test with a known matching sample before rerunning.
D:Change chart ordering while leaving the wrong dataset filter intact. Incorrect filters can silently exclude target log types or devices. Instead, correct dataset conditions and test with a known matching sample before rerunning.
Question 576
An incident report shows only one device despite selecting an ADOM with multiple security sources. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, assume the report title determines which device logs are selected.
- For this FortiAnalyzer investigation, inspect dataset table selection, filter predicates and ADOM or device scope against known log samples.
- For this FortiAnalyzer investigation, remove every source log because the SQL query returned nothing.
- For this FortiAnalyzer investigation, change chart ordering while leaving the wrong dataset filter intact.
Explanation
Correct Answer
B:Verify using dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
Incorrect Answers
A:Assume the report title determines which device logs are selected. A report only summarizes the records returned by its configured dataset and filters. Relevant observations are dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
C:Incorrect filters can silently exclude target log types or devices. Remove every source log because the SQL query returned nothing.
D:Incorrect filters can silently exclude target log types or devices. Change chart ordering while leaving the wrong dataset filter intact.
Question 577
An incident report shows only one device despite selecting an ADOM with multiple security sources. Which observations should the engineer inspect before declaring success?
- The supporting evidence is an alert label from a different ADOM and time window.
- The supporting evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
- The supporting evidence is a chart title with no underlying dated source records.
- The supporting evidence is one source IP without source device or session context.
Explanation
Correct Answer
B:The planned operation is inspect dataset table selection, filter predicates and ADOM or device scope against known log samples. A report only summarizes the records returned by its configured dataset and filters.
Incorrect Answers
A:An alert label from a different ADOM and time window. The relevant evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
C:A chart title with no underlying dated source records. The relevant evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
D:One source IP without source device or session context. The relevant evidence is dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
Question 578
An incident report shows only one device despite selecting an ADOM with multiple security sources. Which platform statement is MOST accurate for this scenario?
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that a report only summarizes the records returned by its configured dataset and filters.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
- The governing concept is that a public NAT address always identifies one unique internal endpoint.
Explanation
Correct Answer
B:Verification depends on dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
Incorrect Answers
A:That generalization is incorrect in the context of report dataset filter mismatch. In this specific situation, an incident report shows only one device despite selecting an ADOM with multiple security sources.
C:That generalization is incorrect in the context of report dataset filter mismatch. A traffic volume graph alone proves data exfiltration occurred.
D:That generalization is incorrect in the context of report dataset filter mismatch. A public NAT address always identifies one unique internal endpoint.
Question 579
An incident report shows only one device despite selecting an ADOM with multiple security sources. An operator instead chooses this incorrect shortcut: Change chart ordering while leaving the wrong dataset filter intact. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that incorrect filters can silently exclude target log types or devices.
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that correctly preserving session ID caused the original traffic denial.
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
Explanation
Correct Answer
A:The intended preventive choice is inspect dataset table selection, filter predicates and ADOM or device scope against known log samples.
Incorrect Answers
B:The only fault is an unrelated chart legend spelling error. This does not account for the actual report dataset filter mismatch weakness. The more relevant failure is incorrect filters can silently exclude target log types or devices. Confirm with dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
C:Correctly preserving session ID caused the original traffic denial. This does not account for the actual report dataset filter mismatch weakness. The more relevant failure is incorrect filters can silently exclude target log types or devices. Confirm with dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
D:A legitimate source log lookup caused all earlier IPS events. This does not account for the actual report dataset filter mismatch weakness. The more relevant failure is incorrect filters can silently exclude target log types or devices. Confirm with dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count.
Question 580
An incident report shows only one device despite selecting an ADOM with multiple security sources. The observed fault is: Incorrect filters can silently exclude target log types or devices. Which remediation best corrects the root cause?
- The corrective action is to remove every source log because the SQL query returned nothing.
- The corrective action is to correct dataset conditions and test with a known matching sample before rerunning.
- The corrective action is to change chart ordering while leaving the wrong dataset filter intact.
- The corrective action is to assume the report title determines which device logs are selected.
Explanation
Correct Answer
B:Recheck dataset SQL or query filter, logtype, ADOM, device ID, expected sample and result row count. A report only summarizes the records returned by its configured dataset and filters.
Incorrect Answers
A:Remove every source log because the SQL query returned nothing. Incorrect filters can silently exclude target log types or devices. Instead, correct dataset conditions and test with a known matching sample before rerunning.
C:Change chart ordering while leaving the wrong dataset filter intact. Incorrect filters can silently exclude target log types or devices. Instead, correct dataset conditions and test with a known matching sample before rerunning.
D:Assume the report title determines which device logs are selected. Incorrect filters can silently exclude target log types or devices. Instead, correct dataset conditions and test with a known matching sample before rerunning.
