Fortinet FCP_FAZ_AN-7.6 Practice Test 52
Question 510
A sanctioned cloud application appears among risk-labeled applications and analysts need to assess actual use. The observed fault is: Treating a monitored application as blocked can misstate the security outcome. What corrective action restores the target behavior with validation?
- The corrective action is to discard session identity when checking app usage.
- The corrective action is to assume an app category alone proves the user breached policy.
- The corrective action is to treat every application-control detection as an IPS event.
- The corrective action is to confirm the configured enforcement and evaluate whether use violates the approved policy.
Explanation
Correct Answer
D:Recheck application signature, app category, policy action, user, traffic volume and session linkage.
Incorrect Answers
A:Discard session identity when checking app usage. Treating a monitored application as blocked can misstate the security outcome. Instead, confirm the configured enforcement and evaluate whether use violates the approved policy.
B:Assume an app category alone proves the user breached policy. Treating a monitored application as blocked can misstate the security outcome. Instead, confirm the configured enforcement and evaluate whether use violates the approved policy.
C:Treat every application-control detection as an IPS event. Treating a monitored application as blocked can misstate the security outcome. Instead, confirm the configured enforcement and evaluate whether use violates the approved policy.
Question 511
Two FortiAnalyzer ADOMs show very different attack counts but one includes many more devices. Which FortiAnalyzer analyst action is most appropriate?
- Assume ten devices and one device should produce equal total log volume.
- Ignore disconnected collectors when comparing office threat rates.
- Compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
- Rank SOC performance solely from a dashboard screenshot.
Explanation
Correct Answer
C:Verify using ADOM device count, active logging sources, event rates, sampled period and normalized metric. This is the targeted correction for FortiView device and ADOM comparison fairness.
Incorrect Answers
A:Raw event count rankings can reward missing logs or penalize larger regions. Use compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
B:Ignore disconnected collectors when comparing office threat rates. Cross-ADOM comparisons need consistent scope and denominator to be meaningful. Relevant observations are ADOM device count, active logging sources, event rates, sampled period and normalized metric.
D:Raw event count rankings can reward missing logs or penalize larger regions. The supported correction is compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
Question 512
Two FortiAnalyzer ADOMs show very different attack counts but one includes many more devices. Which collection of records directly tests the suspected mechanism?
- ADOM device count, active logging sources, event rates, sampled period and normalized metric.
- An unrelated web page load with no security log evidence.
- A pie chart snapshot without filters and drilldown to logs.
- An alert label from a different ADOM and time window.
Explanation
Correct Answer
A:These observations directly test FortiView device and ADOM comparison fairness under the actual system state. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Incorrect Answers
B:An unrelated web page load with no security log evidence. The relevant evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
C:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
D:An alert label from a different ADOM and time window. The relevant evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Question 513
Two FortiAnalyzer ADOMs show very different attack counts but one includes many more devices. Which implementation principle supports the intended approach?
- An event count always equals the number of compromised devices.
- A public NAT address always identifies one unique internal endpoint.
- Any dashboard widget automatically covers every ADOM and all time.
- Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Explanation
Correct Answer
D:Verification depends on ADOM device count, active logging sources, event rates, sampled period and normalized metric. This is why compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
Incorrect Answers
A:An event count always equals the number of compromised devices. That generalization is incorrect in the context of FortiView device and ADOM comparison fairness. The relevant behavior is cross-ADOM comparisons need consistent scope and denominator to be meaningful. Check ADOM device count, active logging sources, event rates, sampled period and normalized metric.
B:A public NAT address always identifies one unique internal endpoint. That generalization is incorrect in the context of FortiView device and ADOM comparison fairness. The relevant behavior is cross-ADOM comparisons need consistent scope and denominator to be meaningful. Check ADOM device count, active logging sources, event rates, sampled period and normalized metric.
C:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of FortiView device and ADOM comparison fairness. The relevant behavior is cross-ADOM comparisons need consistent scope and denominator to be meaningful. Check ADOM device count, active logging sources, event rates, sampled period and normalized metric.
Question 514
Two FortiAnalyzer ADOMs show very different attack counts but one includes many more devices. An operator instead chooses this incorrect shortcut: Assume ten devices and one device should produce equal total log volume. What technical weakness does this incorrect change introduce?
- Correctly preserving session ID caused the original traffic denial.
- Raw event count rankings can reward missing logs or penalize larger regions.
- A valid security event timestamp created the unauthorized login.
- A controlled analyst investigation itself disconnected every FortiGate.
Explanation
Correct Answer
B:The intended preventive choice is compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Incorrect Answers
A:This does not account for the actual FortiView device and ADOM comparison fairness weakness. The more relevant failure is raw event count rankings can reward missing logs or penalize larger regions.
C:This does not account for the actual FortiView device and ADOM comparison fairness weakness. Confirm with ADOM device count, active logging sources, event rates, sampled period and normalized metric.
D:This does not account for the actual FortiView device and ADOM comparison fairness weakness.
Question 515
Two FortiAnalyzer ADOMs show very different attack counts but one includes many more devices. The observed fault is: Raw event count rankings can reward missing logs or penalize larger regions. What corrective action restores the target behavior with validation?
- Ignore disconnected collectors when comparing office threat rates.
- Normalize scope and validate event completeness before comparing trends.
- Rank SOC performance solely from a dashboard screenshot.
- Assume ten devices and one device should produce equal total log volume.
Explanation
Correct Answer
B:This fixes the described operational problem with observable validation. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Incorrect Answers
A:Ignore disconnected collectors when comparing office threat rates. Raw event count rankings can reward missing logs or penalize larger regions. Instead, normalize scope and validate event completeness before comparing trends.
C:Rank SOC performance solely from a dashboard screenshot. Raw event count rankings can reward missing logs or penalize larger regions. Instead, normalize scope and validate event completeness before comparing trends.
D:Assume ten devices and one device should produce equal total log volume. Raw event count rankings can reward missing logs or penalize larger regions. Instead, normalize scope and validate event completeness before comparing trends.
Question 516
A central supervisor ranks regional offices by event totals without normalizing for collection coverage. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, ignore disconnected collectors when comparing office threat rates.
- For this FortiAnalyzer investigation, rank SOC performance solely from a dashboard screenshot.
- For this FortiAnalyzer investigation, compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
- For this FortiAnalyzer investigation, assume ten devices and one device should produce equal total log volume.
Explanation
Correct Answer
C:Verify using ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Incorrect Answers
A:Ignore disconnected collectors when comparing office threat rates. Cross-ADOM comparisons need consistent scope and denominator to be meaningful. Relevant observations are ADOM device count, active logging sources, event rates, sampled period and normalized metric.
B:Raw event count rankings can reward missing logs or penalize larger regions. In this specific situation, a central supervisor ranks regional offices by event totals without normalizing for collection coverage.
D:Raw event count rankings can reward missing logs or penalize larger regions. This change does not provide the specified control.
Question 517
A central supervisor ranks regional offices by event totals without normalizing for collection coverage. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is a chart title with no underlying dated source records.
- The supporting evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric.
- The supporting evidence is an unrelated web page load with no security log evidence.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
Explanation
Correct Answer
B:These observations directly test FortiView device and ADOM comparison fairness under the actual system state. The planned operation is compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
Incorrect Answers
A:A chart title with no underlying dated source records. The relevant evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
C:An unrelated web page load with no security log evidence. The relevant evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
D:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is ADOM device count, active logging sources, event rates, sampled period and normalized metric. Cross-ADOM comparisons need consistent scope and denominator to be meaningful.
Question 518
A central supervisor ranks regional offices by event totals without normalizing for collection coverage. Which technical principle BEST explains this result?
- The governing concept is that any dashboard widget automatically covers every ADOM and all time.
- The governing concept is that cross-ADOM comparisons need consistent scope and denominator to be meaningful.
- The governing concept is that an event count always equals the number of compromised devices.
- The governing concept is that every UTM detection means a firewall session was blocked.
Explanation
Correct Answer
B:Verification depends on ADOM device count, active logging sources, event rates, sampled period and normalized metric.
Incorrect Answers
A:Any dashboard widget automatically covers every ADOM and all time. That generalization is incorrect in the context of FortiView device and ADOM comparison fairness. The relevant behavior is cross-ADOM comparisons need consistent scope and denominator to be meaningful. Check ADOM device count, active logging sources, event rates, sampled period and normalized metric.
C:An event count always equals the number of compromised devices. That generalization is incorrect in the context of FortiView device and ADOM comparison fairness. The relevant behavior is cross-ADOM comparisons need consistent scope and denominator to be meaningful. Check ADOM device count, active logging sources, event rates, sampled period and normalized metric.
D:Every UTM detection means a firewall session was blocked. That generalization is incorrect in the context of FortiView device and ADOM comparison fairness. The relevant behavior is cross-ADOM comparisons need consistent scope and denominator to be meaningful. Check ADOM device count, active logging sources, event rates, sampled period and normalized metric.
Question 519
A central supervisor ranks regional offices by event totals without normalizing for collection coverage. An operator instead chooses this incorrect shortcut: Assume ten devices and one device should produce equal total log volume. What material failure follows from the mistaken shortcut?
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
- The material failure is that raw event count rankings can reward missing logs or penalize larger regions.
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that a valid security event timestamp created the unauthorized login.
Explanation
Correct Answer
B:The intended preventive choice is compare like-for-like devices, collection periods and measured telemetry volumes before drawing regional conclusions.
Incorrect Answers
A:This does not account for the actual FortiView device and ADOM comparison fairness weakness.
C:This does not account for the actual FortiView device and ADOM comparison fairness weakness. A legitimate source log lookup caused all earlier IPS events.
D:This does not account for the actual FortiView device and ADOM comparison fairness weakness. A valid security event timestamp created the unauthorized login.
Question 520
A central supervisor ranks regional offices by event totals without normalizing for collection coverage. The observed fault is: Raw event count rankings can reward missing logs or penalize larger regions. Which controlled recovery BEST addresses this failure?
- The corrective action is to rank SOC performance solely from a dashboard screenshot.
- The corrective action is to assume ten devices and one device should produce equal total log volume.
- The corrective action is to ignore disconnected collectors when comparing office threat rates.
- The corrective action is to normalize scope and validate event completeness before comparing trends.
Explanation
Correct Answer
D:Recheck ADOM device count, active logging sources, event rates, sampled period and normalized metric.
Incorrect Answers
A:Rank SOC performance solely from a dashboard screenshot. Raw event count rankings can reward missing logs or penalize larger regions. Instead, normalize scope and validate event completeness before comparing trends.
B:Assume ten devices and one device should produce equal total log volume. Raw event count rankings can reward missing logs or penalize larger regions. Instead, normalize scope and validate event completeness before comparing trends.
C:Ignore disconnected collectors when comparing office threat rates. Raw event count rankings can reward missing logs or penalize larger regions. Instead, normalize scope and validate event completeness before comparing trends.
