Fortinet FCP_FAZ_AN-7.6 Practice Test 40
Question 390
A security operations shift wants to close an alert while its affected device continues emitting related threats. The observed fault is: Closing an incident based solely on a playbook launch can hide an ongoing compromise. What corrective action restores the target behavior with validation?
- The corrective action is to assume reassignment automatically neutralizes the threat.
- The corrective action is to set status to resolved whenever an automated action starts.
- The corrective action is to confirm device-level remediation and document remaining risk before closure.
- The corrective action is to remove all incident comments to make the queue appear cleared.
Explanation
Correct Answer
C:This fixes the described operational problem with observable validation. Incident workflow status and actual technical remediation are distinct control points.
Incorrect Answers
A:Assume reassignment automatically neutralizes the threat. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
B:Set status to resolved whenever an automated action starts. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
D:Remove all incident comments to make the queue appear cleared. Closing an incident based solely on a playbook launch can hide an ongoing compromise. Instead, confirm device-level remediation and document remaining risk before closure.
Question 391
A test scanner repeatedly triggers a confirmed benign signature on an approved maintenance target. Which FortiAnalyzer analyst action is most appropriate?
- Use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule.
- Disable every event handler in the ADOM to quiet one test device.
- Treat an analyst's guess as proof all matching alerts are benign.
- Delete original logs when labeling an incident false positive.
Explanation
Correct Answer
A:Verify using raw matching records, approved test scope, event handler logic, exception review and post-change alerts. This is the targeted correction for Incident false-positive disposition with detection tuning.
Incorrect Answers
B:Global suppression of a noisy rule can conceal genuine security activity elsewhere. Use use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule.
C:Treat an analyst's guess as proof all matching alerts are benign. False-positive treatment should preserve detection for other entities and behaviors. Relevant observations are raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
D:Global suppression of a noisy rule can conceal genuine security activity elsewhere. The supported correction is use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule.
Question 392
A test scanner repeatedly triggers a confirmed benign signature on an approved maintenance target. Which collection of records directly tests the suspected mechanism?
- A pie chart snapshot without filters and drilldown to logs.
- A chart title with no underlying dated source records.
- Raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
- An unrelated web page load with no security log evidence.
Explanation
Correct Answer
C:These observations directly test Incident false-positive disposition with detection tuning under the actual system state. False-positive treatment should preserve detection for other entities and behaviors.
Incorrect Answers
A:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
B:A chart title with no underlying dated source records. The relevant evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
D:An unrelated web page load with no security log evidence. The relevant evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
Question 393
A test scanner repeatedly triggers a confirmed benign signature on an approved maintenance target. Which implementation principle supports the intended approach?
- Every UTM detection means a firewall session was blocked.
- Any dashboard widget automatically covers every ADOM and all time.
- An event count always equals the number of compromised devices.
- False-positive treatment should preserve detection for other entities and behaviors.
Explanation
Correct Answer
D:Verification depends on raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
Incorrect Answers
A:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of Incident false-positive disposition with detection tuning. The relevant behavior is false-positive treatment should preserve detection for other entities and behaviors. Check raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
B:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of Incident false-positive disposition with detection tuning. The relevant behavior is false-positive treatment should preserve detection for other entities and behaviors. Check raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
C:An event count always equals the number of compromised devices. That generalization is incorrect in the context of Incident false-positive disposition with detection tuning. The relevant behavior is false-positive treatment should preserve detection for other entities and behaviors. Check raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
Question 394
A test scanner repeatedly triggers a confirmed benign signature on an approved maintenance target. An operator instead chooses this incorrect shortcut: Disable every event handler in the ADOM to quiet one test device. What technical weakness does this incorrect change introduce?
- A valid security event timestamp created the unauthorized login.
- A controlled analyst investigation itself disconnected every FortiGate.
- A legitimate source log lookup caused all earlier IPS events.
- Global suppression of a noisy rule can conceal genuine security activity elsewhere.
Explanation
Correct Answer
D:The intended preventive choice is use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule. False-positive treatment should preserve detection for other entities and behaviors.
Incorrect Answers
A:This does not account for the actual Incident false-positive disposition with detection tuning weakness. The more relevant failure is global suppression of a noisy rule can conceal genuine security activity elsewhere.
B:This does not account for the actual Incident false-positive disposition with detection tuning weakness. Confirm with raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
C:This does not account for the actual Incident false-positive disposition with detection tuning weakness.
Question 395
A test scanner repeatedly triggers a confirmed benign signature on an approved maintenance target. The observed fault is: Global suppression of a noisy rule can conceal genuine security activity elsewhere. What corrective action restores the target behavior with validation?
- Treat an analyst's guess as proof all matching alerts are benign.
- Delete original logs when labeling an incident false positive.
- Restrict the exception and test one benign and one malicious-like scenario safely.
- Disable every event handler in the ADOM to quiet one test device.
Explanation
Correct Answer
C:Recheck raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
Incorrect Answers
A:Treat an analyst's guess as proof all matching alerts are benign. Global suppression of a noisy rule can conceal genuine security activity elsewhere. Instead, restrict the exception and test one benign and one malicious-like scenario safely.
B:Delete original logs when labeling an incident false positive. Global suppression of a noisy rule can conceal genuine security activity elsewhere. Instead, restrict the exception and test one benign and one malicious-like scenario safely.
D:Disable every event handler in the ADOM to quiet one test device. Global suppression of a noisy rule can conceal genuine security activity elsewhere. Instead, restrict the exception and test one benign and one malicious-like scenario safely.
Question 396
A SOC receives noisy alerts for one monitored subnet but broad suppression would hide other threats. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, treat an analyst's guess as proof all matching alerts are benign.
- For this FortiAnalyzer investigation, delete original logs when labeling an incident false positive.
- For this FortiAnalyzer investigation, use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule.
- For this FortiAnalyzer investigation, disable every event handler in the ADOM to quiet one test device.
Explanation
Correct Answer
C:Verify using raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
Incorrect Answers
A:Treat an analyst's guess as proof all matching alerts are benign. False-positive treatment should preserve detection for other entities and behaviors. Relevant observations are raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
B:Global suppression of a noisy rule can conceal genuine security activity elsewhere. In this specific situation, a SOC receives noisy alerts for one monitored subnet but broad suppression would hide other threats.
D:Global suppression of a noisy rule can conceal genuine security activity elsewhere. This change does not provide the specified control.
Question 397
A SOC receives noisy alerts for one monitored subnet but broad suppression would hide other threats. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is one source IP without source device or session context.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
- The supporting evidence is a chart title with no underlying dated source records.
Explanation
Correct Answer
C:These observations directly test Incident false-positive disposition with detection tuning under the actual system state. The planned operation is use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule.
Incorrect Answers
A:One source IP without source device or session context. The relevant evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
D:A chart title with no underlying dated source records. The relevant evidence is raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
Question 398
A SOC receives noisy alerts for one monitored subnet but broad suppression would hide other threats. Which technical principle BEST explains this result?
- The governing concept is that false-positive treatment should preserve detection for other entities and behaviors.
- The governing concept is that an event count always equals the number of compromised devices.
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
Explanation
Correct Answer
A:Verification depends on raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
Incorrect Answers
B:An event count always equals the number of compromised devices. That generalization is incorrect in the context of Incident false-positive disposition with detection tuning. The relevant behavior is false-positive treatment should preserve detection for other entities and behaviors. Check raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
C:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of Incident false-positive disposition with detection tuning. The relevant behavior is false-positive treatment should preserve detection for other entities and behaviors. Check raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
D:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of Incident false-positive disposition with detection tuning. The relevant behavior is false-positive treatment should preserve detection for other entities and behaviors. Check raw matching records, approved test scope, event handler logic, exception review and post-change alerts.
Question 399
A SOC receives noisy alerts for one monitored subnet but broad suppression would hide other threats. An operator instead chooses this incorrect shortcut: Disable every event handler in the ADOM to quiet one test device. What material failure follows from the mistaken shortcut?
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that global suppression of a noisy rule can conceal genuine security activity elsewhere.
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
Explanation
Correct Answer
B:The intended preventive choice is use scoped event evidence and approved exception criteria to classify false positives and tune the precise rule.
Incorrect Answers
A:This does not account for the actual Incident false-positive disposition with detection tuning weakness.
C:This does not account for the actual Incident false-positive disposition with detection tuning weakness. The only fault is an unrelated chart legend spelling error.
D:The more relevant failure is global suppression of a noisy rule can conceal genuine security activity elsewhere.
Question 400
A SOC receives noisy alerts for one monitored subnet but broad suppression would hide other threats. The observed fault is: Global suppression of a noisy rule can conceal genuine security activity elsewhere. Which controlled recovery BEST addresses this failure?
- The corrective action is to restrict the exception and test one benign and one malicious-like scenario safely.
- The corrective action is to delete original logs when labeling an incident false positive.
- The corrective action is to disable every event handler in the ADOM to quiet one test device.
- The corrective action is to treat an analyst's guess as proof all matching alerts are benign.
Explanation
Correct Answer
A:Recheck raw matching records, approved test scope, event handler logic, exception review and post-change alerts. False-positive treatment should preserve detection for other entities and behaviors.
Incorrect Answers
B:Delete original logs when labeling an incident false positive. Global suppression of a noisy rule can conceal genuine security activity elsewhere. Instead, restrict the exception and test one benign and one malicious-like scenario safely.
C:Disable every event handler in the ADOM to quiet one test device. Global suppression of a noisy rule can conceal genuine security activity elsewhere. Instead, restrict the exception and test one benign and one malicious-like scenario safely.
D:Treat an analyst's guess as proof all matching alerts are benign. Global suppression of a noisy rule can conceal genuine security activity elsewhere. Instead, restrict the exception and test one benign and one malicious-like scenario safely.
