Fortinet FCP_FAZ_AN-7.6 Practice Test 28
Question 270
An analyst sees a user account in an incident and needs to validate the timeline across traffic and UTM records. The observed fault is: A top-threat widget alone can hide whether the event is old or comes from another tenant. What corrective action restores the target behavior with validation?
- The corrective action is to use only a pie-chart percentage to reconstruct an individual session.
- The corrective action is to refine the pivot to source logs and preserve the evidence supporting the finding.
- The corrective action is to treat the top-ranked entity as compromised regardless of its underlying events.
- The corrective action is to erase filters when moving to Log View and claim provenance stays fixed.
Explanation
Correct Answer
B:Recheck entity value, linked sessions, UTM log records, timestamps, device attribution and event identifiers.
Incorrect Answers
A:Use only a pie-chart percentage to reconstruct an individual session. A top-threat widget alone can hide whether the event is old or comes from another tenant. Instead, refine the pivot to source logs and preserve the evidence supporting the finding.
C:Treat the top-ranked entity as compromised regardless of its underlying events. A top-threat widget alone can hide whether the event is old or comes from another tenant. Instead, refine the pivot to source logs and preserve the evidence supporting the finding.
D:Erase filters when moving to Log View and claim provenance stays fixed. A top-threat widget alone can hide whether the event is old or comes from another tenant. Instead, refine the pivot to source logs and preserve the evidence supporting the finding.
Question 271
A high-severity generated event has low business impact while a lower-scored event affects a sensitive asset. Which FortiAnalyzer analyst action is most appropriate?
- Treat every critical label as proof of the same actual impact.
- Prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
- Ignore the protected asset identity and incident scope entirely.
- Change the alert text to a lower severity instead of investigating it.
Explanation
Correct Answer
B:Detection severity is an input to triage, not a complete description of incident business priority. This is the targeted correction for SOC triage priority versus incident severity.
Incorrect Answers
A:Responding only by numeric severity can misallocate effort to low-impact false positives. Use prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
C:Detection severity is an input to triage, not a complete description of incident business priority.
D:Responding only by numeric severity can misallocate effort to low-impact false positives. The supported correction is prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
Question 272
A high-severity generated event has low business impact while a lower-scored event affects a sensitive asset. Which collection of records directly tests the suspected mechanism?
- A Fabric dashboard screenshot from a different ADOM with no source records.
- Event severity, affected asset, confidence, impact, assigned priority and response SLA.
- An appliance name without any current log delivery or synchronization state.
- An old inventory list without original event time and device attribution.
Explanation
Correct Answer
B:These observations directly test SOC triage priority versus incident severity under the actual system state. Detection severity is an input to triage, not a complete description of incident business priority.
Incorrect Answers
A:A Fabric dashboard screenshot from a different ADOM with no source records. The relevant evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA. Detection severity is an input to triage, not a complete description of incident business priority.
C:An appliance name without any current log delivery or synchronization state. The relevant evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA. Detection severity is an input to triage, not a complete description of incident business priority.
D:An old inventory list without original event time and device attribution. The relevant evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA. Detection severity is an input to triage, not a complete description of incident business priority.
Question 273
A high-severity generated event has low business impact while a lower-scored event affects a sensitive asset. Which implementation principle supports the intended approach?
- Every raw log record is already normalized with identical fields across all sources.
- A visible device inventory object guarantees current threat log delivery.
- Fabric supervisor visibility proves it can edit every member and launch all member playbooks.
- Detection severity is an input to triage, not a complete description of incident business priority.
Explanation
Correct Answer
D:This is why prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria. Verification depends on event severity, affected asset, confidence, impact, assigned priority and response SLA.
Incorrect Answers
A:That generalization is incorrect in the context of SOC triage priority versus incident severity. The relevant behavior is detection severity is an input to triage, not a complete description of incident business priority.
B:That generalization is incorrect in the context of SOC triage priority versus incident severity. Check event severity, affected asset, confidence, impact, assigned priority and response SLA.
C:That generalization is incorrect in the context of SOC triage priority versus incident severity. Fabric supervisor visibility proves it can edit every member and launch all member playbooks.
Question 274
A high-severity generated event has low business impact while a lower-scored event affects a sensitive asset. An operator instead chooses this incorrect shortcut: Treat every critical label as proof of the same actual impact. What technical weakness does this incorrect change introduce?
- An authorized review of ADOM permissions caused every unrelated FortiGate failure.
- Responding only by numeric severity can misallocate effort to low-impact false positives.
- Reading the Fabric member inventory caused the original log ingestion outage.
- The only impact is a harmless dashboard background color.
Explanation
Correct Answer
B:Detection severity is an input to triage, not a complete description of incident business priority. The intended preventive choice is prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
Incorrect Answers
A:This does not account for the actual SOC triage priority versus incident severity weakness. The more relevant failure is responding only by numeric severity can misallocate effort to low-impact false positives.
C:This does not account for the actual SOC triage priority versus incident severity weakness. Confirm with event severity, affected asset, confidence, impact, assigned priority and response SLA.
D:This does not account for the actual SOC triage priority versus incident severity weakness. The only impact is a harmless dashboard background color.
Question 275
A high-severity generated event has low business impact while a lower-scored event affects a sensitive asset. The observed fault is: Responding only by numeric severity can misallocate effort to low-impact false positives. What corrective action restores the target behavior with validation?
- Ignore the protected asset identity and incident scope entirely.
- Reassess priority with contextual evidence and document the rationale and escalation.
- Change the alert text to a lower severity instead of investigating it.
- Treat every critical label as proof of the same actual impact.
Explanation
Correct Answer
B:Detection severity is an input to triage, not a complete description of incident business priority.
Incorrect Answers
A:Ignore the protected asset identity and incident scope entirely. Responding only by numeric severity can misallocate effort to low-impact false positives. Instead, reassess priority with contextual evidence and document the rationale and escalation.
C:Change the alert text to a lower severity instead of investigating it. Responding only by numeric severity can misallocate effort to low-impact false positives. Instead, reassess priority with contextual evidence and document the rationale and escalation.
D:Treat every critical label as proof of the same actual impact. Responding only by numeric severity can misallocate effort to low-impact false positives. Instead, reassess priority with contextual evidence and document the rationale and escalation.
Question 276
An incident queue needs consistent triage priority based on confidence, asset criticality and observed impact. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, ignore the protected asset identity and incident scope entirely.
- For this FortiAnalyzer investigation, change the alert text to a lower severity instead of investigating it.
- For this FortiAnalyzer investigation, prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
- For this FortiAnalyzer investigation, treat every critical label as proof of the same actual impact.
Explanation
Correct Answer
C:Detection severity is an input to triage, not a complete description of incident business priority. Verify using event severity, affected asset, confidence, impact, assigned priority and response SLA.
Incorrect Answers
A:Detection severity is an input to triage, not a complete description of incident business priority. Relevant observations are event severity, affected asset, confidence, impact, assigned priority and response SLA.
B:Responding only by numeric severity can misallocate effort to low-impact false positives. Change the alert text to a lower severity instead of investigating it.
D:Responding only by numeric severity can misallocate effort to low-impact false positives. This change does not provide the specified control.
Question 277
An incident queue needs consistent triage priority based on confidence, asset criticality and observed impact. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is a marketing diagram with no member API or device log evidence.
- The supporting evidence is a Fabric dashboard screenshot from a different ADOM with no source records.
- The supporting evidence is an appliance name without any current log delivery or synchronization state.
- The supporting evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA.
Explanation
Correct Answer
D:These observations directly test SOC triage priority versus incident severity under the actual system state. The planned operation is prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
Incorrect Answers
A:A marketing diagram with no member API or device log evidence. The relevant evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA. Detection severity is an input to triage, not a complete description of incident business priority.
B:A Fabric dashboard screenshot from a different ADOM with no source records. The relevant evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA. Detection severity is an input to triage, not a complete description of incident business priority.
C:An appliance name without any current log delivery or synchronization state. The relevant evidence is event severity, affected asset, confidence, impact, assigned priority and response SLA. Detection severity is an input to triage, not a complete description of incident business priority.
Question 278
An incident queue needs consistent triage priority based on confidence, asset criticality and observed impact. Which technical principle BEST explains this result?
- The governing concept is that Fabric supervisor visibility proves it can edit every member and launch all member playbooks.
- The governing concept is that detection severity is an input to triage, not a complete description of incident business priority.
- The governing concept is that every raw log record is already normalized with identical fields across all sources.
- The governing concept is that an ADOM display name alone enforces all necessary tenant permissions.
Explanation
Correct Answer
B:This is why prioritize analyst work using verified alert evidence plus the protected asset context and documented SOC criteria.
Incorrect Answers
A:That generalization is incorrect in the context of SOC triage priority versus incident severity.
C:That generalization is incorrect in the context of SOC triage priority versus incident severity. Every raw log record is already normalized with identical fields across all sources.
D:That generalization is incorrect in the context of SOC triage priority versus incident severity. An ADOM display name alone enforces all necessary tenant permissions.
Question 279
An incident queue needs consistent triage priority based on confidence, asset criticality and observed impact. An operator instead chooses this incorrect shortcut: Treat every critical label as proof of the same actual impact. What material failure follows from the mistaken shortcut?
- The material failure is that the only impact is a harmless dashboard background color.
- The material failure is that an accurate timestamp created all synchronization errors in the member.
- The material failure is that reading the Fabric member inventory caused the original log ingestion outage.
- The material failure is that responding only by numeric severity can misallocate effort to low-impact false positives.
Explanation
Correct Answer
D:Detection severity is an input to triage, not a complete description of incident business priority.
Incorrect Answers
A:This does not account for the actual SOC triage priority versus incident severity weakness.
B:This does not account for the actual SOC triage priority versus incident severity weakness. An accurate timestamp created all synchronization errors in the member.
C:This does not account for the actual SOC triage priority versus incident severity weakness. Reading the Fabric member inventory caused the original log ingestion outage.
Question 280
An incident queue needs consistent triage priority based on confidence, asset criticality and observed impact. The observed fault is: Responding only by numeric severity can misallocate effort to low-impact false positives. Which controlled recovery BEST addresses this failure?
- The corrective action is to change the alert text to a lower severity instead of investigating it.
- The corrective action is to reassess priority with contextual evidence and document the rationale and escalation.
- The corrective action is to treat every critical label as proof of the same actual impact.
- The corrective action is to ignore the protected asset identity and incident scope entirely.
Explanation
Correct Answer
B:Detection severity is an input to triage, not a complete description of incident business priority. Recheck event severity, affected asset, confidence, impact, assigned priority and response SLA.
Incorrect Answers
A:Change the alert text to a lower severity instead of investigating it. Responding only by numeric severity can misallocate effort to low-impact false positives. Instead, reassess priority with contextual evidence and document the rationale and escalation.
C:Treat every critical label as proof of the same actual impact. Responding only by numeric severity can misallocate effort to low-impact false positives. Instead, reassess priority with contextual evidence and document the rationale and escalation.
D:Ignore the protected asset identity and incident scope entirely. Responding only by numeric severity can misallocate effort to low-impact false positives. Instead, reassess priority with contextual evidence and document the rationale and escalation.
