FCP_FAZ_AN-7.6 · Question #8
As part of your analysis, you discover that an incident is a false positive. You change the incident status to Closed: False Positive. Which statement about your update is true?
The correct answer is A. The audit history log will be updated. When an incident is closed as a false positive in FortiAnalyzer, it is not deleted or renumbered. Instead, the closure action is recorded in the audit history, preserving a traceable record of analyst actions for accountability and compliance.
Question
As part of your analysis, you discover that an incident is a false positive. You change the incident status to Closed: False Positive. Which statement about your update is true?
Options
- AThe audit history log will be updated.
- BThe corresponding event will be marked as mitigated.
- CThe incident will be deleted.
- DThe incident number will be changed
How the community answered
(42 responses)- A95% (40)
- C2% (1)
- D2% (1)
Explanation
When an incident is closed as a false positive in FortiAnalyzer, it is not deleted or renumbered. Instead, the closure action is recorded in the audit history, preserving a traceable record of analyst actions for accountability and compliance.
Topics
Community Discussion
No community discussion yet for this question.