Fortinet FCP_FAZ_AN-7.6 Practice Test 48
Question 470
A custom widget has the right metric name but its log source and aggregation do not represent the desired event class. The observed fault is: Misconfigured widgets can present attractive but misleading security metrics. What corrective action restores the target behavior with validation?
- The corrective action is to disable the original event source to make a graph simpler.
- The corrective action is to assume any widget with a security title reads all threat logs automatically.
- The corrective action is to display unrelated WAN utilization and call it an incident trend.
- The corrective action is to correct source and aggregation then compare the widget with an independent log query.
Explanation
Correct Answer
D:A dashboard widget is useful only when its data selection and visualization answer the intended question. Recheck widget configuration, data source, grouping function, effective filter and example events.
Incorrect Answers
A:Disable the original event source to make a graph simpler. Misconfigured widgets can present attractive but misleading security metrics. Instead, correct source and aggregation then compare the widget with an independent log query.
B:Assume any widget with a security title reads all threat logs automatically. Misconfigured widgets can present attractive but misleading security metrics. Instead, correct source and aggregation then compare the widget with an independent log query.
C:Display unrelated WAN utilization and call it an incident trend. Misconfigured widgets can present attractive but misleading security metrics. Instead, correct source and aggregation then compare the widget with an independent log query.
Question 471
A graph shows a sharp peak in outbound sessions and an analyst needs to isolate which policy and destination contributed. Which FortiAnalyzer analyst action is most appropriate?
- Apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs.
- Declare an incident from graph height alone without checking sessions.
- Assume all periodic peaks are malicious even when change calendars explain them.
- Use only a screenshot and omit the raw event references.
Explanation
Correct Answer
A:Verify using peak interval, host and application, policy IDs, byte counters and raw session logs. This is the targeted correction for FortiView session drilldown from anomaly.
Incorrect Answers
B:Without session drilldown a scheduled job can be mistaken for a malware beacon. Use apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs.
C:Assume all periodic peaks are malicious even when change calendars explain them. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Relevant observations are peak interval, host and application, policy IDs, byte counters and raw session logs.
D:Without session drilldown a scheduled job can be mistaken for a malware beacon. The supported correction is apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs.
Question 472
A graph shows a sharp peak in outbound sessions and an analyst needs to isolate which policy and destination contributed. Which collection of records directly tests the suspected mechanism?
- Peak interval, host and application, policy IDs, byte counters and raw session logs.
- A chart title with no underlying dated source records.
- One source IP without source device or session context.
- A pie chart snapshot without filters and drilldown to logs.
Explanation
Correct Answer
A:The planned operation is apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs. These observations directly test FortiView session drilldown from anomaly under the actual system state.
Incorrect Answers
B:A chart title with no underlying dated source records. The relevant evidence is peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
C:One source IP without source device or session context. The relevant evidence is peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
D:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Question 473
A graph shows a sharp peak in outbound sessions and an analyst needs to isolate which policy and destination contributed. Which implementation principle supports the intended approach?
- A traffic volume graph alone proves data exfiltration occurred.
- An event count always equals the number of compromised devices.
- Every UTM detection means a firewall session was blocked.
- Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Explanation
Correct Answer
D:Verification depends on peak interval, host and application, policy IDs, byte counters and raw session logs. This is why apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs.
Incorrect Answers
A:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of FortiView session drilldown from anomaly. The relevant behavior is aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Check peak interval, host and application, policy IDs, byte counters and raw session logs.
B:An event count always equals the number of compromised devices. That generalization is incorrect in the context of FortiView session drilldown from anomaly. The relevant behavior is aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Check peak interval, host and application, policy IDs, byte counters and raw session logs.
C:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of FortiView session drilldown from anomaly. The relevant behavior is aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Check peak interval, host and application, policy IDs, byte counters and raw session logs.
Question 474
A graph shows a sharp peak in outbound sessions and an analyst needs to isolate which policy and destination contributed. An operator instead chooses this incorrect shortcut: Declare an incident from graph height alone without checking sessions. What technical weakness does this incorrect change introduce?
- A controlled analyst investigation itself disconnected every FortiGate.
- Without session drilldown a scheduled job can be mistaken for a malware beacon.
- A legitimate source log lookup caused all earlier IPS events.
- The only fault is an unrelated chart legend spelling error.
Explanation
Correct Answer
B:The intended preventive choice is apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Incorrect Answers
A:This does not account for the actual FortiView session drilldown from anomaly weakness. The more relevant failure is without session drilldown a scheduled job can be mistaken for a malware beacon.
C:This does not account for the actual FortiView session drilldown from anomaly weakness. Confirm with peak interval, host and application, policy IDs, byte counters and raw session logs.
D:This does not account for the actual FortiView session drilldown from anomaly weakness. The only fault is an unrelated chart legend spelling error.
Question 475
A graph shows a sharp peak in outbound sessions and an analyst needs to isolate which policy and destination contributed. The observed fault is: Without session drilldown a scheduled job can be mistaken for a malware beacon. What corrective action restores the target behavior with validation?
- Assume all periodic peaks are malicious even when change calendars explain them.
- Use only a screenshot and omit the raw event references.
- Declare an incident from graph height alone without checking sessions.
- Correlate the peak with known jobs and suspicious behavior before escalation.
Explanation
Correct Answer
D:This fixes the described operational problem with observable validation. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Incorrect Answers
A:Assume all periodic peaks are malicious even when change calendars explain them. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
B:Use only a screenshot and omit the raw event references. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
C:Declare an incident from graph height alone without checking sessions. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
Question 476
A host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, assume all periodic peaks are malicious even when change calendars explain them.
- For this FortiAnalyzer investigation, use only a screenshot and omit the raw event references.
- For this FortiAnalyzer investigation, declare an incident from graph height alone without checking sessions.
- For this FortiAnalyzer investigation, apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs.
Explanation
Correct Answer
D:Verify using peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Incorrect Answers
A:Assume all periodic peaks are malicious even when change calendars explain them. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Relevant observations are peak interval, host and application, policy IDs, byte counters and raw session logs.
B:Without session drilldown a scheduled job can be mistaken for a malware beacon. Use only a screenshot and omit the raw event references.
C:Without session drilldown a scheduled job can be mistaken for a malware beacon. Declare an incident from graph height alone without checking sessions.
Question 477
A host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is peak interval, host and application, policy IDs, byte counters and raw session logs.
- The supporting evidence is an alert label from a different ADOM and time window.
- The supporting evidence is a chart title with no underlying dated source records.
- The supporting evidence is one source IP without source device or session context.
Explanation
Correct Answer
A:The planned operation is apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Incorrect Answers
B:An alert label from a different ADOM and time window. The relevant evidence is peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
C:A chart title with no underlying dated source records. The relevant evidence is peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
D:One source IP without source device or session context. The relevant evidence is peak interval, host and application, policy IDs, byte counters and raw session logs. Aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
Question 478
A host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them. Which technical principle BEST explains this result?
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
- The governing concept is that aggregated time-series anomalies require granular context to distinguish benign automation from abuse.
- The governing concept is that a public NAT address always identifies one unique internal endpoint.
Explanation
Correct Answer
C:Verification depends on peak interval, host and application, policy IDs, byte counters and raw session logs.
Incorrect Answers
A:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of FortiView session drilldown from anomaly. The relevant behavior is aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Check peak interval, host and application, policy IDs, byte counters and raw session logs.
B:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of FortiView session drilldown from anomaly. The relevant behavior is aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Check peak interval, host and application, policy IDs, byte counters and raw session logs.
D:A public NAT address always identifies one unique internal endpoint. That generalization is incorrect in the context of FortiView session drilldown from anomaly. The relevant behavior is aggregated time-series anomalies require granular context to distinguish benign automation from abuse. Check peak interval, host and application, policy IDs, byte counters and raw session logs.
Question 479
A host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them. An operator instead chooses this incorrect shortcut: Declare an incident from graph height alone without checking sessions. What material failure follows from the mistaken shortcut?
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that correctly preserving session ID caused the original traffic denial.
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that without session drilldown a scheduled job can be mistaken for a malware beacon.
Explanation
Correct Answer
D:The intended preventive choice is apply precise time and device filters to the FortiView peak then drill into source traffic sessions and policy IDs.
Incorrect Answers
A:This does not account for the actual FortiView session drilldown from anomaly weakness. In this specific situation, a host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them.
B:This does not account for the actual FortiView session drilldown from anomaly weakness. Correctly preserving session ID caused the original traffic denial.
C:This does not account for the actual FortiView session drilldown from anomaly weakness. A legitimate source log lookup caused all earlier IPS events.
Question 480
A host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them. The observed fault is: Without session drilldown a scheduled job can be mistaken for a malware beacon. Which controlled recovery BEST addresses this failure?
- The corrective action is to correlate the peak with known jobs and suspicious behavior before escalation.
- The corrective action is to use only a screenshot and omit the raw event references.
- The corrective action is to declare an incident from graph height alone without checking sessions.
- The corrective action is to assume all periodic peaks are malicious even when change calendars explain them.
Explanation
Correct Answer
A:Recheck peak interval, host and application, policy IDs, byte counters and raw session logs.
Incorrect Answers
B:Use only a screenshot and omit the raw event references. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
C:Declare an incident from graph height alone without checking sessions. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
D:Assume all periodic peaks are malicious even when change calendars explain them. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
