Fortinet FCP_FAZ_AN-7.6 Practice Test 55
Question 540
A SOC compares map hotspots by number of alerts and must avoid mistaking one noisy source for many actors. The observed fault is: Interpreting event frequency as attacker count overstates geographic threats. Which remediation best corrects the root cause?
- The corrective action is to discard time range when comparing two map hotspots.
- The corrective action is to assume one hundred logs from one IP means one hundred attackers.
- The corrective action is to recompute unique-source distributions and corroborate notable outliers in raw logs.
- The corrective action is to describe a geolocation cluster as proof of legal jurisdiction of a threat actor.
Explanation
Correct Answer
C:Location heatmaps can be dominated by repeated events from one source and need unique-entity validation. Recheck map source IP, count of distinct IPs, event volume, geo lookup and threat actions.
Incorrect Answers
A:Discard time range when comparing two map hotspots. Interpreting event frequency as attacker count overstates geographic threats. Instead, recompute unique-source distributions and corroborate notable outliers in raw logs.
B:Assume one hundred logs from one IP means one hundred attackers. Interpreting event frequency as attacker count overstates geographic threats. Instead, recompute unique-source distributions and corroborate notable outliers in raw logs.
D:Describe a geolocation cluster as proof of legal jurisdiction of a threat actor. Interpreting event frequency as attacker count overstates geographic threats. Instead, recompute unique-source distributions and corroborate notable outliers in raw logs.
Question 541
An event handler creates a high-severity alert but the SOC needs to identify which host was actually targeted. Which administrator action meets the documented requirement?
- Treat any matching IOC as proof every device in the ADOM was infected.
- Use event severity without consulting affected host identifiers.
- Merge all matching incident titles regardless of unique host and time.
- Open the event's supporting logs and map detected indicators to specific devices and sessions.
Explanation
Correct Answer
D:Verify using event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
Incorrect Answers
A:Treat any matching IOC as proof every device in the ADOM was infected. Applying containment to a threat indicator alone may block the wrong systems. Use open the event's supporting logs and map detected indicators to specific devices and sessions.
B:Use event severity without consulting affected host identifiers. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution. Relevant observations are event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
C:Merge all matching incident titles regardless of unique host and time. This leaves the operational requirement unresolved. Applying containment to a threat indicator alone may block the wrong systems. The supported correction is open the event's supporting logs and map detected indicators to specific devices and sessions.
Question 542
An event handler creates a high-severity alert but the SOC needs to identify which host was actually targeted. Which observations should the engineer inspect before declaring success?
- Event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
- A pie chart snapshot without filters and drilldown to logs.
- A chart title with no underlying dated source records.
- An unrelated web page load with no security log evidence.
Explanation
Correct Answer
A:These observations directly test threat event drilldown affected assets and indicators under the actual system state. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
Incorrect Answers
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
C:A chart title with no underlying dated source records. The relevant evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
D:An unrelated web page load with no security log evidence. The relevant evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
Question 543
An event handler creates a high-severity alert but the SOC needs to identify which host was actually targeted. Which platform statement is MOST accurate for this scenario?
- A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
- Every UTM detection means a firewall session was blocked.
- Any dashboard widget automatically covers every ADOM and all time.
- An event count always equals the number of compromised devices.
Explanation
Correct Answer
A:Verification depends on event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. This is why open the event's supporting logs and map detected indicators to specific devices and sessions.
Incorrect Answers
B:That generalization is incorrect in the context of threat event drilldown affected assets and indicators. The relevant behavior is a rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
C:That generalization is incorrect in the context of threat event drilldown affected assets and indicators. Check event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
D:That generalization is incorrect in the context of threat event drilldown affected assets and indicators.
Question 544
An event handler creates a high-severity alert but the SOC needs to identify which host was actually targeted. An operator instead chooses this incorrect shortcut: Treat any matching IOC as proof every device in the ADOM was infected. Which consequence BEST explains the flaw in the proposed change?
- A valid security event timestamp created the unauthorized login.
- A controlled analyst investigation itself disconnected every FortiGate.
- A legitimate source log lookup caused all earlier IPS events.
- Applying containment to a threat indicator alone may block the wrong systems.
Explanation
Correct Answer
D:The intended preventive choice is open the event's supporting logs and map detected indicators to specific devices and sessions. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
Incorrect Answers
A:This does not account for the actual threat event drilldown affected assets and indicators weakness. The more relevant failure is applying containment to a threat indicator alone may block the wrong systems.
B:This does not account for the actual threat event drilldown affected assets and indicators weakness. Confirm with event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
C:This does not account for the actual threat event drilldown affected assets and indicators weakness.
Question 545
An event handler creates a high-severity alert but the SOC needs to identify which host was actually targeted. The observed fault is: Applying containment to a threat indicator alone may block the wrong systems. Which remediation best corrects the root cause?
- Use event severity without consulting affected host identifiers.
- Merge all matching incident titles regardless of unique host and time.
- Resolve affected devices and validate event-to-incident mappings before response.
- Treat any matching IOC as proof every device in the ADOM was infected.
Explanation
Correct Answer
C:A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
Incorrect Answers
A:Use event severity without consulting affected host identifiers. Applying containment to a threat indicator alone may block the wrong systems. Instead, resolve affected devices and validate event-to-incident mappings before response.
B:Merge all matching incident titles regardless of unique host and time. Applying containment to a threat indicator alone may block the wrong systems. Instead, resolve affected devices and validate event-to-incident mappings before response.
D:Treat any matching IOC as proof every device in the ADOM was infected. Applying containment to a threat indicator alone may block the wrong systems. Instead, resolve affected devices and validate event-to-incident mappings before response.
Question 546
Two incidents share a malware IOC but affected devices and observed actions differ. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, use event severity without consulting affected host identifiers.
- For this FortiAnalyzer investigation, open the event's supporting logs and map detected indicators to specific devices and sessions.
- For this FortiAnalyzer investigation, merge all matching incident titles regardless of unique host and time.
- For this FortiAnalyzer investigation, treat any matching IOC as proof every device in the ADOM was infected.
Explanation
Correct Answer
B:Verify using event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. This is the targeted correction for threat event drilldown affected assets and indicators.
Incorrect Answers
A:Use event severity without consulting affected host identifiers. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution. Relevant observations are event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
C:Merge all matching incident titles regardless of unique host and time. This leaves the operational requirement unresolved. Applying containment to a threat indicator alone may block the wrong systems. The supported correction is open the event's supporting logs and map detected indicators to specific devices and sessions.
D:Treat any matching IOC as proof every device in the ADOM was infected. Applying containment to a threat indicator alone may block the wrong systems. Use open the event's supporting logs and map detected indicators to specific devices and sessions.
Question 547
Two incidents share a malware IOC but affected devices and observed actions differ. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is one source IP without source device or session context.
- The supporting evidence is a pie chart snapshot without filters and drilldown to logs.
- The supporting evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
- The supporting evidence is a chart title with no underlying dated source records.
Explanation
Correct Answer
C:These observations directly test threat event drilldown affected assets and indicators under the actual system state. The planned operation is open the event's supporting logs and map detected indicators to specific devices and sessions.
Incorrect Answers
A:One source IP without source device or session context. The relevant evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
B:A pie chart snapshot without filters and drilldown to logs. The relevant evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
D:A chart title with no underlying dated source records. The relevant evidence is event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping. A rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
Question 548
Two incidents share a malware IOC but affected devices and observed actions differ. Which implementation principle supports the intended approach?
- The governing concept is that an event count always equals the number of compromised devices.
- The governing concept is that a rule hit identifies a correlation condition; affected-asset scope requires entity resolution.
- The governing concept is that every UTM detection means a firewall session was blocked.
- The governing concept is that a traffic volume graph alone proves data exfiltration occurred.
Explanation
Correct Answer
B:Verification depends on event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
Incorrect Answers
A:That generalization is incorrect in the context of threat event drilldown affected assets and indicators.
C:That generalization is incorrect in the context of threat event drilldown affected assets and indicators. Every UTM detection means a firewall session was blocked.
D:That generalization is incorrect in the context of threat event drilldown affected assets and indicators. A traffic volume graph alone proves data exfiltration occurred.
Question 549
Two incidents share a malware IOC but affected devices and observed actions differ. An operator instead chooses this incorrect shortcut: Treat any matching IOC as proof every device in the ADOM was infected. What technical weakness does this incorrect change introduce?
- The material failure is that a legitimate source log lookup caused all earlier IPS events.
- The material failure is that applying containment to a threat indicator alone may block the wrong systems.
- The material failure is that the only fault is an unrelated chart legend spelling error.
- The material failure is that a controlled analyst investigation itself disconnected every FortiGate.
Explanation
Correct Answer
B:The intended preventive choice is open the event's supporting logs and map detected indicators to specific devices and sessions.
Incorrect Answers
A:This does not account for the actual threat event drilldown affected assets and indicators weakness.
C:This does not account for the actual threat event drilldown affected assets and indicators weakness. The only fault is an unrelated chart legend spelling error.
D:The more relevant failure is applying containment to a threat indicator alone may block the wrong systems.
Question 550
Two incidents share a malware IOC but affected devices and observed actions differ. The observed fault is: Applying containment to a threat indicator alone may block the wrong systems. What corrective action restores the target behavior with validation?
- The corrective action is to merge all matching incident titles regardless of unique host and time.
- The corrective action is to treat any matching IOC as proof every device in the ADOM was infected.
- The corrective action is to use event severity without consulting affected host identifiers.
- The corrective action is to resolve affected devices and validate event-to-incident mappings before response.
Explanation
Correct Answer
D:Recheck event handler ID, incident relation, IOC, target address, raw logs and endpoint mapping.
Incorrect Answers
A:Merge all matching incident titles regardless of unique host and time. Applying containment to a threat indicator alone may block the wrong systems. Instead, resolve affected devices and validate event-to-incident mappings before response.
B:Treat any matching IOC as proof every device in the ADOM was infected. Applying containment to a threat indicator alone may block the wrong systems. Instead, resolve affected devices and validate event-to-incident mappings before response.
C:Use event severity without consulting affected host identifiers. Applying containment to a threat indicator alone may block the wrong systems. Instead, resolve affected devices and validate event-to-incident mappings before response.
