Fortinet FCP_FAZ_AN-7.6 Practice Test 39
Question 380
A SOC operator needs to distinguish initial compromise, lateral movement and exfiltration indicators in one incident. The observed fault is: Relying only on incident creation time can reverse the causal event sequence. Which remediation best corrects the root cause?
- The corrective action is to use unvalidated DNS names as immutable attacker identity.
- The corrective action is to treat the incident title as a complete verified timeline.
- The corrective action is to rebuild the sequence with raw records and mark gaps as unverified rather than assumed.
- The corrective action is to discard log IDs after adding a summary note.
Explanation
Correct Answer
C:An incident aggregate is a container for evidence rather than a replacement for reconstructing individual actions. Recheck Incident events, raw log IDs, event times, host identities and correlated sessions.
Incorrect Answers
A:Use unvalidated DNS names as immutable attacker identity. Relying only on incident creation time can reverse the causal event sequence. Instead, rebuild the sequence with raw records and mark gaps as unverified rather than assumed.
B:Treat the incident title as a complete verified timeline. Relying only on incident creation time can reverse the causal event sequence. Instead, rebuild the sequence with raw records and mark gaps as unverified rather than assumed.
D:Discard log IDs after adding a summary note. Relying only on incident creation time can reverse the causal event sequence. Instead, rebuild the sequence with raw records and mark gaps as unverified rather than assumed.
Question 381
An incident is assigned to one analyst but a containment task has not been confirmed on the endpoint. Which administrator action meets the documented requirement?
- Set status to resolved whenever an automated action starts.
- Remove all incident comments to make the queue appear cleared.
- Record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
- Assume reassignment automatically neutralizes the threat.
Explanation
Correct Answer
C:Verify using assigned analyst, incident state changes, audit comments, response artifacts and new event status. This is the targeted correction for Incident assignment escalation and resolution evidence.
Incorrect Answers
A:Closing an incident based solely on a playbook launch can hide an ongoing compromise. Use record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
B:Remove all incident comments to make the queue appear cleared. Incident workflow status and actual technical remediation are distinct control points. Relevant observations are assigned analyst, incident state changes, audit comments, response artifacts and new event status.
D:Closing an incident based solely on a playbook launch can hide an ongoing compromise. The supported correction is record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
Question 382
An incident is assigned to one analyst but a containment task has not been confirmed on the endpoint. Which observations should the engineer inspect before declaring success?
- An alert label from a different ADOM and time window.
- Assigned analyst, incident state changes, audit comments, response artifacts and new event status.
- An unrelated web page load with no security log evidence.
- One source IP without source device or session context.
Explanation
Correct Answer
B:These observations directly test Incident assignment escalation and resolution evidence under the actual system state. Incident workflow status and actual technical remediation are distinct control points.
Incorrect Answers
A:An alert label from a different ADOM and time window. The relevant evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
C:An unrelated web page load with no security log evidence. The relevant evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
D:One source IP without source device or session context. The relevant evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
Question 383
An incident is assigned to one analyst but a containment task has not been confirmed on the endpoint. Which platform statement is MOST accurate for this scenario?
- Any dashboard widget automatically covers every ADOM and all time.
- A traffic volume graph alone proves data exfiltration occurred.
- A public NAT address always identifies one unique internal endpoint.
- Incident workflow status and actual technical remediation are distinct control points.
Explanation
Correct Answer
D:Verification depends on assigned analyst, incident state changes, audit comments, response artifacts and new event status. This is why record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
Incorrect Answers
A:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of Incident assignment escalation and resolution evidence. The relevant behavior is Incident workflow status and actual technical remediation are distinct control points. Check assigned analyst, incident state changes, audit comments, response artifacts and new event status.
B:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of Incident assignment escalation and resolution evidence. The relevant behavior is Incident workflow status and actual technical remediation are distinct control points. Check assigned analyst, incident state changes, audit comments, response artifacts and new event status.
C:A public NAT address always identifies one unique internal endpoint. That generalization is incorrect in the context of Incident assignment escalation and resolution evidence. The relevant behavior is Incident workflow status and actual technical remediation are distinct control points. Check assigned analyst, incident state changes, audit comments, response artifacts and new event status.
Question 384
An incident is assigned to one analyst but a containment task has not been confirmed on the endpoint. An operator instead chooses this incorrect shortcut: Set status to resolved whenever an automated action starts. Which consequence BEST explains the flaw in the proposed change?
- The only fault is an unrelated chart legend spelling error.
- Closing an incident based solely on a playbook launch can hide an ongoing compromise.
- Correctly preserving session ID caused the original traffic denial.
- A valid security event timestamp created the unauthorized login.
Explanation
Correct Answer
B:The intended preventive choice is record investigation ownership, escalation reason and verified remediation evidence before resolving the incident. Incident workflow status and actual technical remediation are distinct control points.
Incorrect Answers
A:This does not account for the actual Incident assignment escalation and resolution evidence weakness. The more relevant failure is closing an incident based solely on a playbook launch can hide an ongoing compromise.
C:This does not account for the actual Incident assignment escalation and resolution evidence weakness. Confirm with assigned analyst, incident state changes, audit comments, response artifacts and new event status.
D:This does not account for the actual Incident assignment escalation and resolution evidence weakness.
Question 385
An incident is assigned to one analyst but a containment task has not been confirmed on the endpoint. The observed fault is: Closing an incident based solely on a playbook launch can hide an ongoing compromise. Which remediation best corrects the root cause?
- Remove all incident comments to make the queue appear cleared.
- Assume reassignment automatically neutralizes the threat.
- Confirm device-level remediation and document remaining risk before closure.
- Set status to resolved whenever an automated action starts.
Explanation
Correct Answer
C:Recheck assigned analyst, incident state changes, audit comments, response artifacts and new event status.
Incorrect Answers
A:Remove all incident comments to make the queue appear cleared. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
B:Assume reassignment automatically neutralizes the threat. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
D:Set status to resolved whenever an automated action starts. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
Question 386
A security operations shift wants to close an alert while its affected device continues emitting related threats. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, remove all incident comments to make the queue appear cleared.
- For this FortiAnalyzer investigation, assume reassignment automatically neutralizes the threat.
- For this FortiAnalyzer investigation, record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
- For this FortiAnalyzer investigation, set status to resolved whenever an automated action starts.
Explanation
Correct Answer
C:Verify using assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
Incorrect Answers
A:Remove all incident comments to make the queue appear cleared. Incident workflow status and actual technical remediation are distinct control points. Relevant observations are assigned analyst, incident state changes, audit comments, response artifacts and new event status.
B:Closing an incident based solely on a playbook launch can hide an ongoing compromise. In this specific situation, a security operations shift wants to close an alert while its affected device continues emitting related threats.
D:Closing an incident based solely on a playbook launch can hide an ongoing compromise. This change does not provide the specified control.
Question 387
A security operations shift wants to close an alert while its affected device continues emitting related threats. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status.
- The supporting evidence is an alert label from a different ADOM and time window.
- The supporting evidence is an unrelated web page load with no security log evidence.
Explanation
Correct Answer
B:These observations directly test Incident assignment escalation and resolution evidence under the actual system state. The planned operation is record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
Incorrect Answers
A:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
C:An alert label from a different ADOM and time window. The relevant evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
D:An unrelated web page load with no security log evidence. The relevant evidence is assigned analyst, incident state changes, audit comments, response artifacts and new event status. Incident workflow status and actual technical remediation are distinct control points.
Question 388
A security operations shift wants to close an alert while its affected device continues emitting related threats. Which implementation principle supports the intended approach?
- The governing concept is that Incident workflow status and actual technical remediation are distinct control points.
- The governing concept is that a public NAT address always identifies one unique internal endpoint.
- The governing concept is that any dashboard widget automatically covers every ADOM and all time.
- The governing concept is that an event count always equals the number of compromised devices.
Explanation
Correct Answer
A:Verification depends on assigned analyst, incident state changes, audit comments, response artifacts and new event status.
Incorrect Answers
B:A public NAT address always identifies one unique internal endpoint. That generalization is incorrect in the context of Incident assignment escalation and resolution evidence. The relevant behavior is Incident workflow status and actual technical remediation are distinct control points. Check assigned analyst, incident state changes, audit comments, response artifacts and new event status.
C:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of Incident assignment escalation and resolution evidence. The relevant behavior is Incident workflow status and actual technical remediation are distinct control points. Check assigned analyst, incident state changes, audit comments, response artifacts and new event status.
D:An event count always equals the number of compromised devices. That generalization is incorrect in the context of Incident assignment escalation and resolution evidence. The relevant behavior is Incident workflow status and actual technical remediation are distinct control points. Check assigned analyst, incident state changes, audit comments, response artifacts and new event status.
Question 389
A security operations shift wants to close an alert while its affected device continues emitting related threats. An operator instead chooses this incorrect shortcut: Set status to resolved whenever an automated action starts. What technical weakness does this incorrect change introduce?
- The material failure is that a valid security event timestamp created the unauthorized login.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
- The material failure is that correctly preserving session ID caused the original traffic denial.
- The material failure is that closing an incident based solely on a playbook launch can hide an ongoing compromise.
Explanation
Correct Answer
D:The intended preventive choice is record investigation ownership, escalation reason and verified remediation evidence before resolving the incident.
Incorrect Answers
A:This does not account for the actual Incident assignment escalation and resolution evidence weakness.
B:The more relevant failure is closing an incident based solely on a playbook launch can hide an ongoing compromise.
C:This does not account for the actual Incident assignment escalation and resolution evidence weakness. Correctly preserving session ID caused the original traffic denial.
Question 390
A security operations shift wants to close an alert while its affected device continues emitting related threats. The observed fault is: Closing an incident based solely on a playbook launch can hide an ongoing compromise. What corrective action restores the target behavior with validation?
- The corrective action is to assume reassignment automatically neutralizes the threat.
- The corrective action is to set status to resolved whenever an automated action starts.
- The corrective action is to confirm device-level remediation and document remaining risk before closure.
- The corrective action is to remove all incident comments to make the queue appear cleared.
Explanation
Correct Answer
C:This fixes the described operational problem with observable validation. Incident workflow status and actual technical remediation are distinct control points.
Incorrect Answers
A:Assume reassignment automatically neutralizes the threat. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
B:Set status to resolved whenever an automated action starts. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
D:Remove all incident comments to make the queue appear cleared. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
