Question 29 - FCP_FAZ_AN-7.4 discussion

When an incident in FortiAnalyzer is identified as a false positive and its status is updated to 'Closed: False Positive,' certain records and logs are updated to reflect this change.

Option A - The Audit History Log Will Be Updated:

FortiAnalyzer maintains an audit history log that records changes to incidents, including updates to their status. When an incident status is marked as 'Closed: False Positive,' this action is logged in the audit history to ensure traceability of changes. This log provides accountability and a record of how incidents have been handled over time.

Conclusion: Correct.

Option B - The Corresponding Event Will Be Marked as Mitigated:

Changing an incident to 'Closed: False Positive' does not affect the status of the original event itself. Marking an incident as a false positive signifies that it does not represent a real threat, but it does not imply that the event has been mitigated.

Conclusion: Incorrect.

Option C - The Incident Will Be Deleted:

Marking an incident as 'Closed: False Positive' does not delete the incident from FortiAnalyzer. Instead, it updates the status to reflect that it is not a real threat, allowing for historical analysis and preventing similar false positives in the future. Deletion would typically only occur manually or by a different administrative action.

Conclusion: Incorrect.

Option D - The Incident Number Will Be Changed:

The incident number is a unique identifier and does not change when the status of the incident is updated. This identifier remains constant throughout the incident's lifecycle for tracking and reference purposes.

Conclusion: Incorrect.

Conclusion:

Correct Answe r : A. The audit history log will be updated.

This is the most accurate answer, as the update to 'Closed: False Positive' is recorded in FortiAnalyzer's audit history log for accountability and tracking purposes.

FortiAnalyzer 7.4.1 documentation on incident management and audit history logging.