Fortinet FCP_FAZ_AN-7.6 Practice Test 50
Question 490
A high connection count alert could reflect a legitimate vulnerability scanner or an unauthorized scan. The observed fault is: A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. How should the administrator restore and verify the intended state?
- The corrective action is to cross-check authorization and compare distributions before triage or blocking.
- The corrective action is to replace forensic session samples with one aggregate user count.
- The corrective action is to assume every device with more than ten sessions is scanning maliciously.
- The corrective action is to ignore destination diversity when evaluating scan patterns.
Explanation
Correct Answer
A:Recheck per-host destination port counts, unique targets, policy outcomes and scanner authorization.
Incorrect Answers
B:Replace forensic session samples with one aggregate user count. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
C:Assume every device with more than ten sessions is scanning maliciously. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
D:Ignore destination diversity when evaluating scan patterns. A legitimate scanner may be misclassified or a slow scan may be missed by a single threshold. Instead, cross-check authorization and compare distributions before triage or blocking.
Question 491
A dashboard groups antivirus, IPS and web-filter detections but one category dominates and obscures a smaller critical type. Which configuration decision most directly resolves this situation?
- Filter by appropriate security subtype and action while retaining an all-event context for triage.
- Combine all different UTM actions into one confirmed infection count.
- Remove all IPS logs to reduce chart clutter.
- Use bandwidth rate alone to infer antivirus verdict.
Explanation
Correct Answer
A:Threat categories describe different sensor events and should not be assumed comparable without definition. Verify using widget event subtype, action filter, per-category counts and raw records.
Incorrect Answers
B:Over-filtering by one subtype can hide relevant incident evidence. Use filter by appropriate security subtype and action while retaining an all-event context for triage.
C:Remove all IPS logs to reduce chart clutter. Threat categories describe different sensor events and should not be assumed comparable without definition. Relevant observations are widget event subtype, action filter, per-category counts and raw records.
D:Over-filtering by one subtype can hide relevant incident evidence. The supported correction is filter by appropriate security subtype and action while retaining an all-event context for triage.
Question 492
A dashboard groups antivirus, IPS and web-filter detections but one category dominates and obscures a smaller critical type. What evidence most strongly confirms the operational condition?
- Widget event subtype, action filter, per-category counts and raw records.
- A pie chart snapshot without filters and drilldown to logs.
- A chart title with no underlying dated source records.
- An unrelated web page load with no security log evidence.
Explanation
Correct Answer
A:The planned operation is filter by appropriate security subtype and action while retaining an all-event context for triage. Threat categories describe different sensor events and should not be assumed comparable without definition.
Incorrect Answers
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is widget event subtype, action filter, per-category counts and raw records. Threat categories describe different sensor events and should not be assumed comparable without definition.
C:A chart title with no underlying dated source records. The relevant evidence is widget event subtype, action filter, per-category counts and raw records. Threat categories describe different sensor events and should not be assumed comparable without definition.
D:An unrelated web page load with no security log evidence. The relevant evidence is widget event subtype, action filter, per-category counts and raw records. Threat categories describe different sensor events and should not be assumed comparable without definition.
Question 493
A dashboard groups antivirus, IPS and web-filter detections but one category dominates and obscures a smaller critical type. What FortiAnalyzer behavior explains the correct decision?
- Threat categories describe different sensor events and should not be assumed comparable without definition.
- Every UTM detection means a firewall session was blocked.
- Any dashboard widget automatically covers every ADOM and all time.
- An event count always equals the number of compromised devices.
Explanation
Correct Answer
A:This is why filter by appropriate security subtype and action while retaining an all-event context for triage. Verification depends on widget event subtype, action filter, per-category counts and raw records.
Incorrect Answers
B:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of UTM event by category widget filtering. The relevant behavior is threat categories describe different sensor events and should not be assumed comparable without definition. Check widget event subtype, action filter, per-category counts and raw records.
C:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of UTM event by category widget filtering. The relevant behavior is threat categories describe different sensor events and should not be assumed comparable without definition. Check widget event subtype, action filter, per-category counts and raw records.
D:An event count always equals the number of compromised devices. That generalization is incorrect in the context of UTM event by category widget filtering. The relevant behavior is threat categories describe different sensor events and should not be assumed comparable without definition. Check widget event subtype, action filter, per-category counts and raw records.
Question 494
A dashboard groups antivirus, IPS and web-filter detections but one category dominates and obscures a smaller critical type. An operator instead chooses this incorrect shortcut: Combine all different UTM actions into one confirmed infection count. Which resulting risk should the reviewer identify?
- Over-filtering by one subtype can hide relevant incident evidence.
- A valid security event timestamp created the unauthorized login.
- A controlled analyst investigation itself disconnected every FortiGate.
- A legitimate source log lookup caused all earlier IPS events.
Explanation
Correct Answer
A:The intended preventive choice is filter by appropriate security subtype and action while retaining an all-event context for triage. Threat categories describe different sensor events and should not be assumed comparable without definition.
Incorrect Answers
B:This does not account for the actual UTM event by category widget filtering weakness. The more relevant failure is over-filtering by one subtype can hide relevant incident evidence.
C:This does not account for the actual UTM event by category widget filtering weakness. Confirm with widget event subtype, action filter, per-category counts and raw records.
D:This does not account for the actual UTM event by category widget filtering weakness. In this specific situation, a dashboard groups antivirus, IPS and web-filter detections but one category dominates and obscures a smaller critical type.
Question 495
A dashboard groups antivirus, IPS and web-filter detections but one category dominates and obscures a smaller critical type. The observed fault is: Over-filtering by one subtype can hide relevant incident evidence. How should the administrator restore and verify the intended state?
- Remove all IPS logs to reduce chart clutter.
- Correct subtype conditions and validate known examples for each intended category.
- Use bandwidth rate alone to infer antivirus verdict.
- Combine all different UTM actions into one confirmed infection count.
Explanation
Correct Answer
B:Threat categories describe different sensor events and should not be assumed comparable without definition.
Incorrect Answers
A:Remove all IPS logs to reduce chart clutter. Over-filtering by one subtype can hide relevant incident evidence. Instead, correct subtype conditions and validate known examples for each intended category.
C:Use bandwidth rate alone to infer antivirus verdict. Over-filtering by one subtype can hide relevant incident evidence. Instead, correct subtype conditions and validate known examples for each intended category.
D:Combine all different UTM actions into one confirmed infection count. Over-filtering by one subtype can hide relevant incident evidence. Instead, correct subtype conditions and validate known examples for each intended category.
Question 496
A detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, remove all IPS logs to reduce chart clutter.
- For this FortiAnalyzer investigation, filter by appropriate security subtype and action while retaining an all-event context for triage.
- For this FortiAnalyzer investigation, use bandwidth rate alone to infer antivirus verdict.
- For this FortiAnalyzer investigation, combine all different UTM actions into one confirmed infection count.
Explanation
Correct Answer
B:Threat categories describe different sensor events and should not be assumed comparable without definition. This is the targeted correction for UTM event by category widget filtering.
Incorrect Answers
A:Remove all IPS logs to reduce chart clutter. Threat categories describe different sensor events and should not be assumed comparable without definition. Relevant observations are widget event subtype, action filter, per-category counts and raw records.
C:Over-filtering by one subtype can hide relevant incident evidence. In this specific situation, a detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype.
D:Over-filtering by one subtype can hide relevant incident evidence. This change does not provide the specified control.
Question 497
A detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype. Which observations should the engineer inspect before declaring success?
- The supporting evidence is one source IP without source device or session context.
- The supporting evidence is widget event subtype, action filter, per-category counts and raw records.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is a chart title with no underlying dated source records.
Explanation
Correct Answer
B:The planned operation is filter by appropriate security subtype and action while retaining an all-event context for triage. These observations directly test UTM event by category widget filtering under the actual system state.
Incorrect Answers
A:One source IP without source device or session context. The relevant evidence is widget event subtype, action filter, per-category counts and raw records. Threat categories describe different sensor events and should not be assumed comparable without definition.
C:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is widget event subtype, action filter, per-category counts and raw records. Threat categories describe different sensor events and should not be assumed comparable without definition.
D:A chart title with no underlying dated source records. The relevant evidence is widget event subtype, action filter, per-category counts and raw records. Threat categories describe different sensor events and should not be assumed comparable without definition.
Question 498
A detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype. Which platform statement is MOST accurate for this scenario?
- The governing concept is that an event count always equals the number of compromised devices.
- The governing concept is that threat categories describe different sensor events and should not be assumed comparable without definition.
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
Explanation
Correct Answer
B:This is why filter by appropriate security subtype and action while retaining an all-event context for triage. Threat categories describe different sensor events and should not be assumed comparable without definition.
Incorrect Answers
A:An event count always equals the number of compromised devices. That generalization is incorrect in the context of UTM event by category widget filtering. The relevant behavior is threat categories describe different sensor events and should not be assumed comparable without definition. Check widget event subtype, action filter, per-category counts and raw records.
C:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of UTM event by category widget filtering. The relevant behavior is threat categories describe different sensor events and should not be assumed comparable without definition. Check widget event subtype, action filter, per-category counts and raw records.
D:A traffic volume graph alone proves data exfiltration occurred. That generalization is incorrect in the context of UTM event by category widget filtering. The relevant behavior is threat categories describe different sensor events and should not be assumed comparable without definition. Check widget event subtype, action filter, per-category counts and raw records.
Question 499
A detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype. An operator instead chooses this incorrect shortcut: Combine all different UTM actions into one confirmed infection count. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that over-filtering by one subtype can hide relevant incident evidence.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
Explanation
Correct Answer
C:The intended preventive choice is filter by appropriate security subtype and action while retaining an all-event context for triage. Over-filtering by one subtype can hide relevant incident evidence.
Incorrect Answers
A:This does not account for the actual UTM event by category widget filtering weakness. A legitimate source log lookup caused all earlier IPS events.
B:This does not account for the actual UTM event by category widget filtering weakness. The only fault is an unrelated chart legend spelling error.
D:This does not account for the actual UTM event by category widget filtering weakness. In this specific situation, a detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype.
Question 500
A detection widget unexpectedly reports zero results after an analyst excludes the wrong UTM subtype. The observed fault is: Over-filtering by one subtype can hide relevant incident evidence. Which remediation best corrects the root cause?
- The corrective action is to correct subtype conditions and validate known examples for each intended category.
- The corrective action is to use bandwidth rate alone to infer antivirus verdict.
- The corrective action is to combine all different UTM actions into one confirmed infection count.
- The corrective action is to remove all IPS logs to reduce chart clutter.
Explanation
Correct Answer
A:This fixes the described operational problem with observable validation. Recheck widget event subtype, action filter, per-category counts and raw records.
Incorrect Answers
B:Use bandwidth rate alone to infer antivirus verdict. Over-filtering by one subtype can hide relevant incident evidence. Instead, correct subtype conditions and validate known examples for each intended category.
C:Combine all different UTM actions into one confirmed infection count. Over-filtering by one subtype can hide relevant incident evidence. Instead, correct subtype conditions and validate known examples for each intended category.
D:Remove all IPS logs to reduce chart clutter. Over-filtering by one subtype can hide relevant incident evidence. Instead, correct subtype conditions and validate known examples for each intended category.
