Fortinet FCP_FAZ_AN-7.6 Exam - Topic 4 Question 18 Discussion

Study Guide p.105-p.106: incident analysis includes audit history, and incident settings/status should be kept up to date.

Technical Deep Dive: The correct answer is A. When an analyst changes an incident status to Closed: False Positive, FortiAnalyzer records the action in the incident audit history. That preserves accountability and allows other analysts to see what changed and why. The corresponding event is not automatically reclassified as mitigated. The incident is not deleted just because it is closed. The incident number remains stable because it is the identifier used to track the case through its lifecycle.