Fortinet FCP_FAZ_AN-7.6 Practice Test 30
Question 290
A tenant SOC analyst needs Log View permissions without permission to reconfigure device reception. The observed fault is: Excessive administrator rights allow unreviewed changes to detection and automation. How should the administrator restore and verify the intended state?
- The corrective action is to disable ADOM scoping so every user sees every customer's incidents.
- The corrective action is to correct profile permissions and verify both an allowed analytic task and blocked configuration edit.
- The corrective action is to make all SOC users global super administrators to resolve one missing read permission.
- The corrective action is to use a saved dashboard link to bypass authorization checks.
Explanation
Correct Answer
B:Recheck admin profile rights, ADOM scope, visible modules and attempted allowed and denied operations.
Incorrect Answers
A:Disable ADOM scoping so every user sees every customer's incidents. Excessive administrator rights allow unreviewed changes to detection and automation. Instead, correct profile permissions and verify both an allowed analytic task and blocked configuration edit.
C:Make all SOC users global super administrators to resolve one missing read permission. Excessive administrator rights allow unreviewed changes to detection and automation. Instead, correct profile permissions and verify both an allowed analytic task and blocked configuration edit.
D:Use a saved dashboard link to bypass authorization checks. Excessive administrator rights allow unreviewed changes to detection and automation. Instead, correct profile permissions and verify both an allowed analytic task and blocked configuration edit.
Question 291
A network threat event is present but the team cannot determine whether the involved endpoint was isolated. Which configuration decision most directly resolves this situation?
- Quarantine the first host matching a reused DHCP address without verification.
- Assume endpoint isolation occurred merely because a playbook was queued.
- Correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
- Replace all endpoint identifiers with DNS names from an old inventory.
Explanation
Correct Answer
C:This is the targeted correction for Security Fabric investigation across endpoint and network sensors. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Incorrect Answers
A:Attribution based on one recycled IP address can target the wrong host. Use correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
B:Assume endpoint isolation occurred merely because a playbook was queued. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity. Relevant observations are FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
D:Attribution based on one recycled IP address can target the wrong host. The supported correction is correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
Question 292
A network threat event is present but the team cannot determine whether the involved endpoint was isolated. What evidence most strongly confirms the operational condition?
- An old inventory list without original event time and device attribution.
- A Fabric dashboard screenshot from a different ADOM with no source records.
- FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
- A single unrelated ping to the management interface.
Explanation
Correct Answer
C:These observations directly test Security Fabric investigation across endpoint and network sensors under the actual system state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Incorrect Answers
A:An old inventory list without original event time and device attribution. The relevant evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
B:A Fabric dashboard screenshot from a different ADOM with no source records. The relevant evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
D:A single unrelated ping to the management interface. The relevant evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Question 293
A network threat event is present but the team cannot determine whether the involved endpoint was isolated. What FortiAnalyzer behavior explains the correct decision?
- Fabric supervisor visibility proves it can edit every member and launch all member playbooks.
- Any FortiAI suggestion is confirmed without source log evidence.
- A visible device inventory object guarantees current threat log delivery.
- Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Explanation
Correct Answer
D:Verification depends on FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. This is why correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
Incorrect Answers
A:That generalization is incorrect in the context of Security Fabric investigation across endpoint and network sensors. The relevant behavior is Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
B:That generalization is incorrect in the context of Security Fabric investigation across endpoint and network sensors. Check FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
C:That generalization is incorrect in the context of Security Fabric investigation across endpoint and network sensors.
Question 294
A network threat event is present but the team cannot determine whether the involved endpoint was isolated. An operator instead chooses this incorrect shortcut: Quarantine the first host matching a reused DHCP address without verification. Which resulting risk should the reviewer identify?
- Maintaining source device provenance itself destroyed the archived log.
- An authorized review of ADOM permissions caused every unrelated FortiGate failure.
- Reading the Fabric member inventory caused the original log ingestion outage.
- Attribution based on one recycled IP address can target the wrong host.
Explanation
Correct Answer
D:The intended preventive choice is correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Incorrect Answers
A:This does not account for the actual Security Fabric investigation across endpoint and network sensors weakness. The more relevant failure is attribution based on one recycled IP address can target the wrong host.
B:This does not account for the actual Security Fabric investigation across endpoint and network sensors weakness. Confirm with FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
C:This does not account for the actual Security Fabric investigation across endpoint and network sensors weakness.
Question 295
A network threat event is present but the team cannot determine whether the involved endpoint was isolated. The observed fault is: Attribution based on one recycled IP address can target the wrong host. How should the administrator restore and verify the intended state?
- Resolve the actual endpoint and confirm containment state using independent device-side evidence.
- Assume endpoint isolation occurred merely because a playbook was queued.
- Replace all endpoint identifiers with DNS names from an old inventory.
- Quarantine the first host matching a reused DHCP address without verification.
Explanation
Correct Answer
A:Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Incorrect Answers
B:Assume endpoint isolation occurred merely because a playbook was queued. Attribution based on one recycled IP address can target the wrong host. Instead, resolve the actual endpoint and confirm containment state using independent device-side evidence.
C:Replace all endpoint identifiers with DNS names from an old inventory. Attribution based on one recycled IP address can target the wrong host. Instead, resolve the actual endpoint and confirm containment state using independent device-side evidence.
D:Quarantine the first host matching a reused DHCP address without verification. Attribution based on one recycled IP address can target the wrong host. Instead, resolve the actual endpoint and confirm containment state using independent device-side evidence.
Question 296
A suspicious device IP maps to several DHCP leases and a Fabric investigation needs current host identity. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, assume endpoint isolation occurred merely because a playbook was queued.
- For this FortiAnalyzer investigation, replace all endpoint identifiers with DNS names from an old inventory.
- For this FortiAnalyzer investigation, correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
- For this FortiAnalyzer investigation, quarantine the first host matching a reused DHCP address without verification.
Explanation
Correct Answer
C:This is the targeted correction for Security Fabric investigation across endpoint and network sensors. Verify using FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
Incorrect Answers
A:Assume endpoint isolation occurred merely because a playbook was queued. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity. Relevant observations are FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
B:Attribution based on one recycled IP address can target the wrong host. In this specific situation, a suspicious device IP maps to several DHCP leases and a Fabric investigation needs current host identity.
D:Attribution based on one recycled IP address can target the wrong host. Quarantine the first host matching a reused DHCP address without verification.
Question 297
A suspicious device IP maps to several DHCP leases and a Fabric investigation needs current host identity. Which observations should the engineer inspect before declaring success?
- The supporting evidence is an appliance name without any current log delivery or synchronization state.
- The supporting evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
- The supporting evidence is an old inventory list without original event time and device attribution.
- The supporting evidence is a Fabric dashboard screenshot from a different ADOM with no source records.
Explanation
Correct Answer
B:These observations directly test Security Fabric investigation across endpoint and network sensors under the actual system state. The planned operation is correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
Incorrect Answers
A:An appliance name without any current log delivery or synchronization state. The relevant evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
C:An old inventory list without original event time and device attribution. The relevant evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
D:A Fabric dashboard screenshot from a different ADOM with no source records. The relevant evidence is FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state. Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Question 298
A suspicious device IP maps to several DHCP leases and a Fabric investigation needs current host identity. Which platform statement is MOST accurate for this scenario?
- The governing concept is that a visible device inventory object guarantees current threat log delivery.
- The governing concept is that Fabric supervisor visibility proves it can edit every member and launch all member playbooks.
- The governing concept is that every raw log record is already normalized with identical fields across all sources.
- The governing concept is that Security Fabric correlation is stronger when multiple trustworthy data sources identify the same entity.
Explanation
Correct Answer
D:Verification depends on FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
Incorrect Answers
A:That generalization is incorrect in the context of Security Fabric investigation across endpoint and network sensors.
B:That generalization is incorrect in the context of Security Fabric investigation across endpoint and network sensors. Fabric supervisor visibility proves it can edit every member and launch all member playbooks.
C:That generalization is incorrect in the context of Security Fabric investigation across endpoint and network sensors. Every raw log record is already normalized with identical fields across all sources.
Question 299
A suspicious device IP maps to several DHCP leases and a Fabric investigation needs current host identity. An operator instead chooses this incorrect shortcut: Quarantine the first host matching a reused DHCP address without verification. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that reading the Fabric member inventory caused the original log ingestion outage.
- The material failure is that attribution based on one recycled IP address can target the wrong host.
- The material failure is that the only impact is a harmless dashboard background color.
- The material failure is that an authorized review of ADOM permissions caused every unrelated FortiGate failure.
Explanation
Correct Answer
B:The intended preventive choice is correlate FortiGate, endpoint and available asset telemetry by time and stable identity before initiating response.
Incorrect Answers
A:This does not account for the actual Security Fabric investigation across endpoint and network sensors weakness.
C:This does not account for the actual Security Fabric investigation across endpoint and network sensors weakness. The only impact is a harmless dashboard background color.
D:This does not account for the actual Security Fabric investigation across endpoint and network sensors weakness. An authorized review of ADOM permissions caused every unrelated FortiGate failure.
Question 300
A suspicious device IP maps to several DHCP leases and a Fabric investigation needs current host identity. The observed fault is: Attribution based on one recycled IP address can target the wrong host. Which remediation best corrects the root cause?
- The corrective action is to resolve the actual endpoint and confirm containment state using independent device-side evidence.
- The corrective action is to replace all endpoint identifiers with DNS names from an old inventory.
- The corrective action is to quarantine the first host matching a reused DHCP address without verification.
- The corrective action is to assume endpoint isolation occurred merely because a playbook was queued.
Explanation
Correct Answer
A:Recheck FortiGate session, endpoint ID, current IP mapping, sensor timestamp and response state.
Incorrect Answers
B:Replace all endpoint identifiers with DNS names from an old inventory. Attribution based on one recycled IP address can target the wrong host. Instead, resolve the actual endpoint and confirm containment state using independent device-side evidence.
C:Quarantine the first host matching a reused DHCP address without verification. Attribution based on one recycled IP address can target the wrong host. Instead, resolve the actual endpoint and confirm containment state using independent device-side evidence.
D:Assume endpoint isolation occurred merely because a playbook was queued. Attribution based on one recycled IP address can target the wrong host. Instead, resolve the actual endpoint and confirm containment state using independent device-side evidence.
