Fortinet FCP_FAZ_AN-7.6 Practice Test 49
Question 480
A host has repeated spikes every hour and the SOC must identify whether a scheduled backup explains them. The observed fault is: Without session drilldown a scheduled job can be mistaken for a malware beacon. Which controlled recovery BEST addresses this failure?
- The corrective action is to correlate the peak with known jobs and suspicious behavior before escalation.
- The corrective action is to use only a screenshot and omit the raw event references.
- The corrective action is to declare an incident from graph height alone without checking sessions.
- The corrective action is to assume all periodic peaks are malicious even when change calendars explain them.
Explanation
Correct Answer
A:Recheck peak interval, host and application, policy IDs, byte counters and raw session logs.
Incorrect Answers
B:Use only a screenshot and omit the raw event references. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
C:Declare an incident from graph height alone without checking sessions. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
D:Assume all periodic peaks are malicious even when change calendars explain them. Without session drilldown a scheduled job can be mistaken for a malware beacon. Instead, correlate the peak with known jobs and suspicious behavior before escalation.
Question 481
One compromised client opens short-lived connections to many destination ports in a brief window. What is the BEST supported implementation or corrective action?
- Assume every device with more than ten sessions is scanning maliciously.
- Ignore destination diversity when evaluating scan patterns.
- Analyze destination-port and unique-target distribution with process and approved-scanner context.
- Replace forensic session samples with one aggregate user count.
Explanation
Correct Answer
C:Scan-like patterns depend on destination diversity and timing rather than only session count. This is the targeted correction for threat hunting source-port distribution widget.
Incorrect Answers
A:A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Use analyze destination-port and unique-target distribution with process and approved-scanner context.
B:Ignore destination diversity when evaluating scan patterns. Scan-like patterns depend on destination diversity and timing rather than only session count. Relevant observations are per-host destination port counts, unique targets, policy outcomes and scanner authorization.
D:A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. The supported correction is analyze destination-port and unique-target distribution with process and approved-scanner context.
Question 482
One compromised client opens short-lived connections to many destination ports in a brief window. Which diagnostic evidence BEST verifies the intended outcome?
- Per-host destination port counts, unique targets, policy outcomes and scanner authorization.
- An alert label from a different ADOM and time window.
- An unrelated web page load with no security log evidence.
- One source IP without source device or session context.
Explanation
Correct Answer
A:Scan-like patterns depend on destination diversity and timing rather than only session count. These observations directly test threat hunting source-port distribution widget under the actual system state.
Incorrect Answers
B:An alert label from a different ADOM and time window. The relevant evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
C:An unrelated web page load with no security log evidence. The relevant evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
D:One source IP without source device or session context. The relevant evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
Question 483
One compromised client opens short-lived connections to many destination ports in a brief window. Which technical principle BEST explains this result?
- Any dashboard widget automatically covers every ADOM and all time.
- A traffic volume graph alone proves data exfiltration occurred.
- A public NAT address always identifies one unique internal endpoint.
- Scan-like patterns depend on destination diversity and timing rather than only session count.
Explanation
Correct Answer
D:Verification depends on per-host destination port counts, unique targets, policy outcomes and scanner authorization. This is why analyze destination-port and unique-target distribution with process and approved-scanner context.
Incorrect Answers
A:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of threat hunting source-port distribution widget. The relevant behavior is scan-like patterns depend on destination diversity and timing rather than only session count. Check per-host destination port counts, unique targets, policy outcomes and scanner authorization.
B:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of threat hunting source-port distribution widget. The relevant behavior is scan-like patterns depend on destination diversity and timing rather than only session count. Check per-host destination port counts, unique targets, policy outcomes and scanner authorization.
C:A public NAT address always identifies one unique internal endpoint. That generalization is incorrect in the context of threat hunting source-port distribution widget. The relevant behavior is scan-like patterns depend on destination diversity and timing rather than only session count. Check per-host destination port counts, unique targets, policy outcomes and scanner authorization.
Question 484
One compromised client opens short-lived connections to many destination ports in a brief window. An operator instead chooses this incorrect shortcut: Assume every device with more than ten sessions is scanning maliciously. What material failure follows from the mistaken shortcut?
- A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold.
- The only fault is an unrelated chart legend spelling error.
- Correctly preserving session ID caused the original traffic denial.
- A valid security event timestamp created the unauthorized login.
Explanation
Correct Answer
A:The intended preventive choice is analyze destination-port and unique-target distribution with process and approved-scanner context. Scan-like patterns depend on destination diversity and timing rather than only session count.
Incorrect Answers
B:This does not account for the actual threat hunting source-port distribution widget weakness. The more relevant failure is a legitimate scanner may be misclassified or a slow scan may be missed by a single threshold.
C:This does not account for the actual threat hunting source-port distribution widget weakness. Confirm with per-host destination port counts, unique targets, policy outcomes and scanner authorization.
D:This does not account for the actual threat hunting source-port distribution widget weakness. A valid security event timestamp created the unauthorized login.
Question 485
One compromised client opens short-lived connections to many destination ports in a brief window. The observed fault is: A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Which controlled recovery BEST addresses this failure?
- Cross-check authorization and compare distributions before triage or blocking.
- Ignore destination diversity when evaluating scan patterns.
- Replace forensic session samples with one aggregate user count.
- Assume every device with more than ten sessions is scanning maliciously.
Explanation
Correct Answer
A:Scan-like patterns depend on destination diversity and timing rather than only session count.
Incorrect Answers
B:Ignore destination diversity when evaluating scan patterns. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
C:Replace forensic session samples with one aggregate user count. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
D:Assume every device with more than ten sessions is scanning maliciously. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
Question 486
A high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan. Which configuration decision most directly resolves this situation?
- For this FortiAnalyzer investigation, analyze destination-port and unique-target distribution with process and approved-scanner context.
- For this FortiAnalyzer investigation, ignore destination diversity when evaluating scan patterns.
- For this FortiAnalyzer investigation, replace forensic session samples with one aggregate user count.
- For this FortiAnalyzer investigation, assume every device with more than ten sessions is scanning maliciously.
Explanation
Correct Answer
A:Scan-like patterns depend on destination diversity and timing rather than only session count. Verify using per-host destination port counts, unique targets, policy outcomes and scanner authorization.
Incorrect Answers
B:Ignore destination diversity when evaluating scan patterns. Scan-like patterns depend on destination diversity and timing rather than only session count. Relevant observations are per-host destination port counts, unique targets, policy outcomes and scanner authorization.
C:A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Replace forensic session samples with one aggregate user count.
D:A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold.
Question 487
A high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan. What evidence most strongly confirms the operational condition?
- The supporting evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is an alert label from a different ADOM and time window.
- The supporting evidence is an unrelated web page load with no security log evidence.
Explanation
Correct Answer
A:Scan-like patterns depend on destination diversity and timing rather than only session count. The planned operation is analyze destination-port and unique-target distribution with process and approved-scanner context.
Incorrect Answers
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
C:An alert label from a different ADOM and time window. The relevant evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
D:An unrelated web page load with no security log evidence. The relevant evidence is per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
Question 488
A high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan. What FortiAnalyzer behavior explains the correct decision?
- The governing concept is that a public NAT address always identifies one unique internal endpoint.
- The governing concept is that scan-like patterns depend on destination diversity and timing rather than only session count.
- The governing concept is that any dashboard widget automatically covers every ADOM and all time.
- The governing concept is that an event count always equals the number of compromised devices.
Explanation
Correct Answer
B:Verification depends on per-host destination port counts, unique targets, policy outcomes and scanner authorization. Scan-like patterns depend on destination diversity and timing rather than only session count.
Incorrect Answers
A:A public NAT address always identifies one unique internal endpoint. That generalization is incorrect in the context of threat hunting source-port distribution widget. The relevant behavior is scan-like patterns depend on destination diversity and timing rather than only session count. Check per-host destination port counts, unique targets, policy outcomes and scanner authorization.
C:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of threat hunting source-port distribution widget. The relevant behavior is scan-like patterns depend on destination diversity and timing rather than only session count. Check per-host destination port counts, unique targets, policy outcomes and scanner authorization.
D:An event count always equals the number of compromised devices. That generalization is incorrect in the context of threat hunting source-port distribution widget. The relevant behavior is scan-like patterns depend on destination diversity and timing rather than only session count. Check per-host destination port counts, unique targets, policy outcomes and scanner authorization.
Question 489
A high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan. An operator instead chooses this incorrect shortcut: Assume every device with more than ten sessions is scanning maliciously. Which resulting risk should the reviewer identify?
- The material failure is that a valid security event timestamp created the unauthorized login.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
- The material failure is that correctly preserving session ID caused the original traffic denial.
- The material failure is that a legitimate scanner may be misclassified or a slow scan may be missed by a single threshold.
Explanation
Correct Answer
D:The intended preventive choice is analyze destination-port and unique-target distribution with process and approved-scanner context. In this specific situation, a high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan.
Incorrect Answers
A:This does not account for the actual threat hunting source-port distribution widget weakness.
B:The more relevant failure is a legitimate scanner may be misclassified or a slow scan may be missed by a single threshold.
C:This does not account for the actual threat hunting source-port distribution widget weakness. Correctly preserving session ID caused the original traffic denial.
Question 490
A high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan. The observed fault is: A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. How should the administrator restore and verify the intended state?
- The corrective action is to cross-check authorization and compare distributions before triage or blocking.
- The corrective action is to replace forensic session samples with one aggregate user count.
- The corrective action is to assume every device with more than ten sessions is scanning maliciously.
- The corrective action is to ignore destination diversity when evaluating scan patterns.
Explanation
Correct Answer
A:Recheck per-host destination port counts, unique targets, policy outcomes and scanner authorization.
Incorrect Answers
B:Replace forensic session samples with one aggregate user count. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
C:Assume every device with more than ten sessions is scanning maliciously. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
D:Ignore destination diversity when evaluating scan patterns. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
