Fortinet FCP_FAZ_AN-7.6 Practice Test 35
Question 340
A SOC alert flags risky DNS activity and the analyst must distinguish blocked queries from successful contact. The observed fault is: Treating every DNS alert as exfiltration can overstate the incident. Which remediation best corrects the root cause?
- The corrective action is to assume a DNS answer always proves a web server connection was established.
- The corrective action is to declare data exfiltration solely from one denied DNS lookup.
- The corrective action is to check query handling and verify whether corresponding sessions or endpoint actions occurred.
- The corrective action is to discard all source endpoint IDs during DNS correlation.
Explanation
Correct Answer
C:A DNS query detection does not by itself prove a connection to a malicious destination succeeded. Recheck DNS query name, response action, client identity, resolved IP and follow-on sessions.
Incorrect Answers
A:Assume a DNS answer always proves a web server connection was established. Treating every DNS alert as exfiltration can overstate the incident. Instead, check query handling and verify whether corresponding sessions or endpoint actions occurred.
B:Declare data exfiltration solely from one denied DNS lookup. Treating every DNS alert as exfiltration can overstate the incident. Instead, check query handling and verify whether corresponding sessions or endpoint actions occurred.
D:Discard all source endpoint IDs during DNS correlation. Treating every DNS alert as exfiltration can overstate the incident. Instead, check query handling and verify whether corresponding sessions or endpoint actions occurred.
Question 341
A low-severity device event correlates with repeated failed logins to a critical admin host. Which administrator action meets the documented requirement?
- Assume any critical signature guarantees confirmed host compromise.
- Evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
- Ignore repeated failed authentications because they use a lower event severity.
- Change alert colors instead of documenting priority rationale.
Explanation
Correct Answer
B:Log severity summarizes a detection signal and does not replace incident impact assessment. This is the targeted correction for threat log severity and confidence triage.
Incorrect Answers
A:Prioritizing solely by severity can miss high-impact credential attacks. Use evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
C:Ignore repeated failed authentications because they use a lower event severity. Log severity summarizes a detection signal and does not replace incident impact assessment. Relevant observations are threat signature, severity, event volume, target criticality and corroborating behavior.
D:Prioritizing solely by severity can miss high-impact credential attacks. The supported correction is evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
Question 342
A low-severity device event correlates with repeated failed logins to a critical admin host. Which observations should the engineer inspect before declaring success?
- A pie chart snapshot without filters and drilldown to logs.
- A chart title with no underlying dated source records.
- Threat signature, severity, event volume, target criticality and corroborating behavior.
- An unrelated web page load with no security log evidence.
Explanation
Correct Answer
C:These observations directly test threat log severity and confidence triage under the actual system state. Log severity summarizes a detection signal and does not replace incident impact assessment.
Incorrect Answers
A:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is threat signature, severity, event volume, target criticality and corroborating behavior. Log severity summarizes a detection signal and does not replace incident impact assessment.
B:A chart title with no underlying dated source records. The relevant evidence is threat signature, severity, event volume, target criticality and corroborating behavior. Log severity summarizes a detection signal and does not replace incident impact assessment.
D:An unrelated web page load with no security log evidence. The relevant evidence is threat signature, severity, event volume, target criticality and corroborating behavior. Log severity summarizes a detection signal and does not replace incident impact assessment.
Question 343
A low-severity device event correlates with repeated failed logins to a critical admin host. Which platform statement is MOST accurate for this scenario?
- Every UTM detection means a firewall session was blocked.
- Any dashboard widget automatically covers every ADOM and all time.
- An event count always equals the number of compromised devices.
- Log severity summarizes a detection signal and does not replace incident impact assessment.
Explanation
Correct Answer
D:This is why evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority. Verification depends on threat signature, severity, event volume, target criticality and corroborating behavior.
Incorrect Answers
A:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of threat log severity and confidence triage. The relevant behavior is log severity summarizes a detection signal and does not replace incident impact assessment. Check threat signature, severity, event volume, target criticality and corroborating behavior.
B:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of threat log severity and confidence triage. The relevant behavior is log severity summarizes a detection signal and does not replace incident impact assessment. Check threat signature, severity, event volume, target criticality and corroborating behavior.
C:An event count always equals the number of compromised devices. That generalization is incorrect in the context of threat log severity and confidence triage. The relevant behavior is log severity summarizes a detection signal and does not replace incident impact assessment. Check threat signature, severity, event volume, target criticality and corroborating behavior.
Question 344
A low-severity device event correlates with repeated failed logins to a critical admin host. An operator instead chooses this incorrect shortcut: Assume any critical signature guarantees confirmed host compromise. Which consequence BEST explains the flaw in the proposed change?
- A valid security event timestamp created the unauthorized login.
- Prioritizing solely by severity can miss high-impact credential attacks.
- A controlled analyst investigation itself disconnected every FortiGate.
- A legitimate source log lookup caused all earlier IPS events.
Explanation
Correct Answer
B:The intended preventive choice is evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority. Log severity summarizes a detection signal and does not replace incident impact assessment.
Incorrect Answers
A:This does not account for the actual threat log severity and confidence triage weakness. The more relevant failure is prioritizing solely by severity can miss high-impact credential attacks.
C:This does not account for the actual threat log severity and confidence triage weakness. Confirm with threat signature, severity, event volume, target criticality and corroborating behavior.
D:This does not account for the actual threat log severity and confidence triage weakness. A legitimate source log lookup caused all earlier IPS events.
Question 345
A low-severity device event correlates with repeated failed logins to a critical admin host. The observed fault is: Prioritizing solely by severity can miss high-impact credential attacks. Which remediation best corrects the root cause?
- Re-rank incidents using corroborating logs and documented business impact.
- Ignore repeated failed authentications because they use a lower event severity.
- Change alert colors instead of documenting priority rationale.
- Assume any critical signature guarantees confirmed host compromise.
Explanation
Correct Answer
A:Log severity summarizes a detection signal and does not replace incident impact assessment.
Incorrect Answers
B:Ignore repeated failed authentications because they use a lower event severity. Prioritizing solely by severity can miss high-impact credential attacks. Instead, re-rank incidents using corroborating logs and documented business impact.
C:Change alert colors instead of documenting priority rationale. Prioritizing solely by severity can miss high-impact credential attacks. Instead, re-rank incidents using corroborating logs and documented business impact.
D:Assume any critical signature guarantees confirmed host compromise. Prioritizing solely by severity can miss high-impact credential attacks. Instead, re-rank incidents using corroborating logs and documented business impact.
Question 346
A high-severity signature fires on a test lab asset without evidence of exploitation. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, ignore repeated failed authentications because they use a lower event severity.
- For this FortiAnalyzer investigation, evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
- For this FortiAnalyzer investigation, change alert colors instead of documenting priority rationale.
- For this FortiAnalyzer investigation, assume any critical signature guarantees confirmed host compromise.
Explanation
Correct Answer
B:Log severity summarizes a detection signal and does not replace incident impact assessment. Verify using threat signature, severity, event volume, target criticality and corroborating behavior.
Incorrect Answers
A:Ignore repeated failed authentications because they use a lower event severity. Log severity summarizes a detection signal and does not replace incident impact assessment. Relevant observations are threat signature, severity, event volume, target criticality and corroborating behavior.
C:Prioritizing solely by severity can miss high-impact credential attacks. In this specific situation, a high-severity signature fires on a test lab asset without evidence of exploitation.
D:Prioritizing solely by severity can miss high-impact credential attacks. This change does not provide the specified control.
Question 347
A high-severity signature fires on a test lab asset without evidence of exploitation. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is one source IP without source device or session context.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is threat signature, severity, event volume, target criticality and corroborating behavior.
- The supporting evidence is a chart title with no underlying dated source records.
Explanation
Correct Answer
C:These observations directly test threat log severity and confidence triage under the actual system state. The planned operation is evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
Incorrect Answers
A:One source IP without source device or session context. The relevant evidence is threat signature, severity, event volume, target criticality and corroborating behavior. Log severity summarizes a detection signal and does not replace incident impact assessment.
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is threat signature, severity, event volume, target criticality and corroborating behavior. Log severity summarizes a detection signal and does not replace incident impact assessment.
D:A chart title with no underlying dated source records. The relevant evidence is threat signature, severity, event volume, target criticality and corroborating behavior. Log severity summarizes a detection signal and does not replace incident impact assessment.
Question 348
A high-severity signature fires on a test lab asset without evidence of exploitation. Which implementation principle supports the intended approach?
- The governing concept is that an event count always equals the number of compromised devices.
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
- The governing concept is that log severity summarizes a detection signal and does not replace incident impact assessment.
Explanation
Correct Answer
D:This is why evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
Incorrect Answers
A:An event count always equals the number of compromised devices. That generalization is incorrect in the context of threat log severity and confidence triage. The relevant behavior is log severity summarizes a detection signal and does not replace incident impact assessment. Check threat signature, severity, event volume, target criticality and corroborating behavior.
B:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of threat log severity and confidence triage. The relevant behavior is log severity summarizes a detection signal and does not replace incident impact assessment. Check threat signature, severity, event volume, target criticality and corroborating behavior.
C:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of threat log severity and confidence triage. The relevant behavior is log severity summarizes a detection signal and does not replace incident impact assessment. Check threat signature, severity, event volume, target criticality and corroborating behavior.
Question 349
A high-severity signature fires on a test lab asset without evidence of exploitation. An operator instead chooses this incorrect shortcut: Assume any critical signature guarantees confirmed host compromise. What technical weakness does this incorrect change introduce?
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
- The material failure is that prioritizing solely by severity can miss high-impact credential attacks.
Explanation
Correct Answer
D:The intended preventive choice is evaluate signature context, detection confidence, repetition and asset criticality before determining incident priority.
Incorrect Answers
A:This does not account for the actual threat log severity and confidence triage weakness. In this specific situation, a high-severity signature fires on a test lab asset without evidence of exploitation.
B:This does not account for the actual threat log severity and confidence triage weakness. The only fault is an unrelated chart legend spelling error.
C:The more relevant failure is prioritizing solely by severity can miss high-impact credential attacks.
Question 350
A high-severity signature fires on a test lab asset without evidence of exploitation. The observed fault is: Prioritizing solely by severity can miss high-impact credential attacks. What corrective action restores the target behavior with validation?
- The corrective action is to change alert colors instead of documenting priority rationale.
- The corrective action is to assume any critical signature guarantees confirmed host compromise.
- The corrective action is to ignore repeated failed authentications because they use a lower event severity.
- The corrective action is to re-rank incidents using corroborating logs and documented business impact.
Explanation
Correct Answer
D:This fixes the described operational problem with observable validation. Recheck threat signature, severity, event volume, target criticality and corroborating behavior.
Incorrect Answers
A:Change alert colors instead of documenting priority rationale. Prioritizing solely by severity can miss high-impact credential attacks. Instead, re-rank incidents using corroborating logs and documented business impact.
B:Assume any critical signature guarantees confirmed host compromise. Prioritizing solely by severity can miss high-impact credential attacks. Instead, re-rank incidents using corroborating logs and documented business impact.
C:Ignore repeated failed authentications because they use a lower event severity. Prioritizing solely by severity can miss high-impact credential attacks. Instead, re-rank incidents using corroborating logs and documented business impact.
