Fortinet FCP_FAZ_AN-7.6 Practice Test 60
Question 590
A chart previews no series after an engineer changes the SQL grouping columns. The observed fault is: Broken field bindings can cause empty or failed chart rendering. What corrective action restores the target behavior with validation?
- The corrective action is to use an unrelated log forwarding change to fix a chart schema error.
- The corrective action is to rename the report title and expect missing SQL aliases to return.
- The corrective action is to repair the chart-to-dataset mapping and verify a preview with sample data.
- The corrective action is to delete all chart data fields but claim visualization is repaired.
Explanation
Correct Answer
C:This fixes the described operational problem with observable validation. Recheck dataset query result columns, chart bindings, preview errors and report job logs.
Incorrect Answers
A:Use an unrelated log forwarding change to fix a chart schema error. Broken field bindings can cause empty or failed chart rendering. Instead, repair the chart-to-dataset mapping and verify a preview with sample data.
B:Rename the report title and expect missing SQL aliases to return. Broken field bindings can cause empty or failed chart rendering. Instead, repair the chart-to-dataset mapping and verify a preview with sample data.
D:Delete all chart data fields but claim visualization is repaired. Broken field bindings can cause empty or failed chart rendering. Instead, repair the chart-to-dataset mapping and verify a preview with sample data.
Question 591
An executive report configured for Mondays never arrives at the expected local time. Which FortiAnalyzer analyst action is most appropriate?
- Treat a saved report template as an executed scheduled report.
- Change device log action fields to repair a disabled scheduler.
- Assume local browser clock governs all server report jobs.
- Check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed.
Explanation
Correct Answer
D:Report generation requires a valid scheduler and runnable job separate from data availability. This is the targeted correction for report schedule timezone and job execution.
Incorrect Answers
A:A disabled or mis-timed schedule can prevent delivery despite complete datasets. Use check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed.
B:Change device log action fields to repair a disabled scheduler. Report generation requires a valid scheduler and runnable job separate from data availability. Relevant observations are schedule configuration, time zone, job execution result and delivery attempt.
C:A disabled or mis-timed schedule can prevent delivery despite complete datasets. The supported correction is check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed.
Question 592
An executive report configured for Mondays never arrives at the expected local time. Which collection of records directly tests the suspected mechanism?
- A pie chart snapshot without filters and drilldown to logs.
- A chart title with no underlying dated source records.
- An unrelated web page load with no security log evidence.
- Schedule configuration, time zone, job execution result and delivery attempt.
Explanation
Correct Answer
D:The planned operation is check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed. Report generation requires a valid scheduler and runnable job separate from data availability.
Incorrect Answers
A:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is schedule configuration, time zone, job execution result and delivery attempt. Report generation requires a valid scheduler and runnable job separate from data availability.
B:A chart title with no underlying dated source records. The relevant evidence is schedule configuration, time zone, job execution result and delivery attempt. Report generation requires a valid scheduler and runnable job separate from data availability.
C:An unrelated web page load with no security log evidence. The relevant evidence is schedule configuration, time zone, job execution result and delivery attempt. Report generation requires a valid scheduler and runnable job separate from data availability.
Question 593
An executive report configured for Mondays never arrives at the expected local time. Which implementation principle supports the intended approach?
- Every UTM detection means a firewall session was blocked.
- Any dashboard widget automatically covers every ADOM and all time.
- An event count always equals the number of compromised devices.
- Report generation requires a valid scheduler and runnable job separate from data availability.
Explanation
Correct Answer
D:This is why check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed. Verification depends on schedule configuration, time zone, job execution result and delivery attempt.
Incorrect Answers
A:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of report schedule timezone and job execution. The relevant behavior is report generation requires a valid scheduler and runnable job separate from data availability. Check schedule configuration, time zone, job execution result and delivery attempt.
B:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of report schedule timezone and job execution. The relevant behavior is report generation requires a valid scheduler and runnable job separate from data availability. Check schedule configuration, time zone, job execution result and delivery attempt.
C:An event count always equals the number of compromised devices. That generalization is incorrect in the context of report schedule timezone and job execution. The relevant behavior is report generation requires a valid scheduler and runnable job separate from data availability. Check schedule configuration, time zone, job execution result and delivery attempt.
Question 594
An executive report configured for Mondays never arrives at the expected local time. An operator instead chooses this incorrect shortcut: Treat a saved report template as an executed scheduled report. What technical weakness does this incorrect change introduce?
- A valid security event timestamp created the unauthorized login.
- A disabled or mis-timed schedule can prevent delivery despite complete datasets.
- A controlled analyst investigation itself disconnected every FortiGate.
- A legitimate source log lookup caused all earlier IPS events.
Explanation
Correct Answer
B:The intended preventive choice is check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed. Report generation requires a valid scheduler and runnable job separate from data availability.
Incorrect Answers
A:This does not account for the actual report schedule timezone and job execution weakness. The more relevant failure is a disabled or mis-timed schedule can prevent delivery despite complete datasets.
C:This does not account for the actual report schedule timezone and job execution weakness. Confirm with schedule configuration, time zone, job execution result and delivery attempt.
D:This does not account for the actual report schedule timezone and job execution weakness. A legitimate source log lookup caused all earlier IPS events.
Question 595
An executive report configured for Mondays never arrives at the expected local time. The observed fault is: A disabled or mis-timed schedule can prevent delivery despite complete datasets. What corrective action restores the target behavior with validation?
- Change device log action fields to repair a disabled scheduler.
- Assume local browser clock governs all server report jobs.
- Treat a saved report template as an executed scheduled report.
- Correct the schedule and trigger a controlled test job to verify delivery.
Explanation
Correct Answer
D:Report generation requires a valid scheduler and runnable job separate from data availability.
Incorrect Answers
A:Change device log action fields to repair a disabled scheduler. A disabled or mis-timed schedule can prevent delivery despite complete datasets. Instead, correct the schedule and trigger a controlled test job to verify delivery.
B:Assume local browser clock governs all server report jobs. A disabled or mis-timed schedule can prevent delivery despite complete datasets. Instead, correct the schedule and trigger a controlled test job to verify delivery.
C:Treat a saved report template as an executed scheduled report. A disabled or mis-timed schedule can prevent delivery despite complete datasets. Instead, correct the schedule and trigger a controlled test job to verify delivery.
Question 596
A scheduled compliance PDF did not run because its automation schedule was disabled after maintenance. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, change device log action fields to repair a disabled scheduler.
- For this FortiAnalyzer investigation, check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed.
- For this FortiAnalyzer investigation, assume local browser clock governs all server report jobs.
- For this FortiAnalyzer investigation, treat a saved report template as an executed scheduled report.
Explanation
Correct Answer
B:Report generation requires a valid scheduler and runnable job separate from data availability. Verify using schedule configuration, time zone, job execution result and delivery attempt.
Incorrect Answers
A:Change device log action fields to repair a disabled scheduler. Report generation requires a valid scheduler and runnable job separate from data availability. Relevant observations are schedule configuration, time zone, job execution result and delivery attempt.
C:A disabled or mis-timed schedule can prevent delivery despite complete datasets. Assume local browser clock governs all server report jobs.
D:A disabled or mis-timed schedule can prevent delivery despite complete datasets. This change does not provide the specified control.
Question 597
A scheduled compliance PDF did not run because its automation schedule was disabled after maintenance. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is one source IP without source device or session context.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is schedule configuration, time zone, job execution result and delivery attempt.
- The supporting evidence is a chart title with no underlying dated source records.
Explanation
Correct Answer
C:The planned operation is check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed. These observations directly test report schedule timezone and job execution under the actual system state.
Incorrect Answers
A:One source IP without source device or session context. The relevant evidence is schedule configuration, time zone, job execution result and delivery attempt. Report generation requires a valid scheduler and runnable job separate from data availability.
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is schedule configuration, time zone, job execution result and delivery attempt. Report generation requires a valid scheduler and runnable job separate from data availability.
D:A chart title with no underlying dated source records. The relevant evidence is schedule configuration, time zone, job execution result and delivery attempt. Report generation requires a valid scheduler and runnable job separate from data availability.
Question 598
A scheduled compliance PDF did not run because its automation schedule was disabled after maintenance. Which technical principle BEST explains this result?
- The governing concept is that an event count always equals the number of compromised devices.
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that report generation requires a valid scheduler and runnable job separate from data availability.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
Explanation
Correct Answer
C:This is why check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed.
Incorrect Answers
A:An event count always equals the number of compromised devices. That generalization is incorrect in the context of report schedule timezone and job execution. The relevant behavior is report generation requires a valid scheduler and runnable job separate from data availability. Check schedule configuration, time zone, job execution result and delivery attempt.
B:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of report schedule timezone and job execution. The relevant behavior is report generation requires a valid scheduler and runnable job separate from data availability. Check schedule configuration, time zone, job execution result and delivery attempt.
D:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of report schedule timezone and job execution. The relevant behavior is report generation requires a valid scheduler and runnable job separate from data availability. Check schedule configuration, time zone, job execution result and delivery attempt.
Question 599
A scheduled compliance PDF did not run because its automation schedule was disabled after maintenance. An operator instead chooses this incorrect shortcut: Treat a saved report template as an executed scheduled report. What material failure follows from the mistaken shortcut?
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that a disabled or mis-timed schedule can prevent delivery despite complete datasets.
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
Explanation
Correct Answer
B:The intended preventive choice is check scheduler enablement, timezone, job history and output destination rather than assuming no logs existed.
Incorrect Answers
A:This does not account for the actual report schedule timezone and job execution weakness. In this specific situation, a scheduled compliance PDF did not run because its automation schedule was disabled after maintenance.
C:This does not account for the actual report schedule timezone and job execution weakness. The only fault is an unrelated chart legend spelling error.
D:The more relevant failure is a disabled or mis-timed schedule can prevent delivery despite complete datasets.
Question 600
A scheduled compliance PDF did not run because its automation schedule was disabled after maintenance. The observed fault is: A disabled or mis-timed schedule can prevent delivery despite complete datasets. Which controlled recovery BEST addresses this failure?
- The corrective action is to assume local browser clock governs all server report jobs.
- The corrective action is to treat a saved report template as an executed scheduled report.
- The corrective action is to change device log action fields to repair a disabled scheduler.
- The corrective action is to correct the schedule and trigger a controlled test job to verify delivery.
Explanation
Correct Answer
D:This fixes the described operational problem with observable validation. Recheck schedule configuration, time zone, job execution result and delivery attempt.
Incorrect Answers
A:Assume local browser clock governs all server report jobs. A disabled or mis-timed schedule can prevent delivery despite complete datasets. Instead, correct the schedule and trigger a controlled test job to verify delivery.
B:Treat a saved report template as an executed scheduled report. A disabled or mis-timed schedule can prevent delivery despite complete datasets. Instead, correct the schedule and trigger a controlled test job to verify delivery.
C:Change device log action fields to repair a disabled scheduler. A disabled or mis-timed schedule can prevent delivery despite complete datasets. Instead, correct the schedule and trigger a controlled test job to verify delivery.
