Fortinet FCP_FAZ_AN-7.6 Practice Test 67
Question 660
An analyst needs to alert on outbound sessions to a specified malicious domain only while the indicator is still valid. The observed fault is: An expired or mis-mapped indicator can produce missed alerts or persistent false positives. Which remediation best corrects the root cause?
- The corrective action is to refresh matching logic and indicator source and prove a known test event matches.
- The corrective action is to ignore indicator expiration and use a permanent global block list by default.
- The corrective action is to treat any random destination IP as a verified current IOC.
- The corrective action is to match only the FortiAnalyzer appliance address as the remote destination.
Explanation
Correct Answer
A:This fixes the described operational problem with observable validation. Recheck IOC identity and validity, destination field, matched logs and handler execution.
Incorrect Answers
B:Ignore indicator expiration and use a permanent global block list by default. An expired or mis-mapped indicator can produce missed alerts or persistent false positives. Instead, refresh matching logic and indicator source and prove a known test event matches.
C:Treat any random destination IP as a verified current IOC. An expired or mis-mapped indicator can produce missed alerts or persistent false positives. Instead, refresh matching logic and indicator source and prove a known test event matches.
D:Match only the FortiAnalyzer appliance address as the remote destination. An expired or mis-mapped indicator can produce missed alerts or persistent false positives. Instead, refresh matching logic and indicator source and prove a known test event matches.
Question 661
A low-confidence proxy alert is assigned critical severity and overwhelms on-call analysts. Which administrator action meets the documented requirement?
- Set every handler to critical so no alert can be missed.
- Assign event severity solely from the longest hostname.
- Suppress all high-confidence events to reduce escalation volume.
- Map event-handler output severity using source risk, corroboration, confidence and target importance.
Explanation
Correct Answer
D:Handler severity is an operational assessment that should reflect risk context and not just a static label. This is the targeted correction for event severity mapping and alert prioritization.
Incorrect Answers
A:Over-severe mapping creates alert fatigue while under-severe mapping delays response. Use map event-handler output severity using source risk, corroboration, confidence and target importance.
B:Assign event severity solely from the longest hostname. Handler severity is an operational assessment that should reflect risk context and not just a static label. Relevant observations are configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
C:Over-severe mapping creates alert fatigue while under-severe mapping delays response. The supported correction is map event-handler output severity using source risk, corroboration, confidence and target importance.
Question 662
A low-confidence proxy alert is assigned critical severity and overwhelms on-call analysts. Which observations should the engineer inspect before declaring success?
- An approved change request without recorded workflow execution.
- An unrelated incident status with no matching event or task audit.
- Configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
- A severity label without source evidence and affected asset identity.
Explanation
Correct Answer
C:Handler severity is an operational assessment that should reflect risk context and not just a static label. The planned operation is map event-handler output severity using source risk, corroboration, confidence and target importance.
Incorrect Answers
A:An approved change request without recorded workflow execution. The relevant evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact. Handler severity is an operational assessment that should reflect risk context and not just a static label.
B:An unrelated incident status with no matching event or task audit. The relevant evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact. Handler severity is an operational assessment that should reflect risk context and not just a static label.
D:A severity label without source evidence and affected asset identity. The relevant evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact. Handler severity is an operational assessment that should reflect risk context and not just a static label.
Question 663
A low-confidence proxy alert is assigned critical severity and overwhelms on-call analysts. Which platform statement is MOST accurate for this scenario?
- An incident marked resolved proves a remote firewall policy change succeeded.
- A connector listed in inventory always has valid permissions and network reachability.
- Handler severity is an operational assessment that should reflect risk context and not just a static label.
- Every IOC match is confirmed active malware compromise.
Explanation
Correct Answer
C:This is why map event-handler output severity using source risk, corroboration, confidence and target importance. Verification depends on configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
Incorrect Answers
A:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of event severity mapping and alert prioritization. The relevant behavior is handler severity is an operational assessment that should reflect risk context and not just a static label. Check configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
B:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of event severity mapping and alert prioritization. The relevant behavior is handler severity is an operational assessment that should reflect risk context and not just a static label. Check configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
D:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of event severity mapping and alert prioritization. The relevant behavior is handler severity is an operational assessment that should reflect risk context and not just a static label. Check configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
Question 664
A low-confidence proxy alert is assigned critical severity and overwhelms on-call analysts. An operator instead chooses this incorrect shortcut: Set every handler to critical so no alert can be missed. Which consequence BEST explains the flaw in the proposed change?
- An approved narrow connector scope caused every unrelated Internet outage.
- Over-severe mapping creates alert fatigue while under-severe mapping delays response.
- Preserving the task audit trail created all earlier endpoint infections.
- An accurate incident assignment caused the missing log source.
Explanation
Correct Answer
B:Handler severity is an operational assessment that should reflect risk context and not just a static label. The intended preventive choice is map event-handler output severity using source risk, corroboration, confidence and target importance.
Incorrect Answers
A:This does not account for the actual event severity mapping and alert prioritization weakness. The more relevant failure is over-severe mapping creates alert fatigue while under-severe mapping delays response.
C:This does not account for the actual event severity mapping and alert prioritization weakness. Confirm with configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
D:This does not account for the actual event severity mapping and alert prioritization weakness. An accurate incident assignment caused the missing log source.
Question 665
A low-confidence proxy alert is assigned critical severity and overwhelms on-call analysts. The observed fault is: Over-severe mapping creates alert fatigue while under-severe mapping delays response. Which remediation best corrects the root cause?
- Assign event severity solely from the longest hostname.
- Suppress all high-confidence events to reduce escalation volume.
- Adjust mapping after reviewing representative events and document the triage rule.
- Set every handler to critical so no alert can be missed.
Explanation
Correct Answer
C:Handler severity is an operational assessment that should reflect risk context and not just a static label.
Incorrect Answers
A:Assign event severity solely from the longest hostname. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
B:Suppress all high-confidence events to reduce escalation volume. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
D:Set every handler to critical so no alert can be missed. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
Question 666
A targeted domain controller attack is grouped with low-impact scans because all events receive identical priority. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, assign event severity solely from the longest hostname.
- For this FortiAnalyzer investigation, suppress all high-confidence events to reduce escalation volume.
- For this FortiAnalyzer investigation, set every handler to critical so no alert can be missed.
- For this FortiAnalyzer investigation, map event-handler output severity using source risk, corroboration, confidence and target importance.
Explanation
Correct Answer
D:Handler severity is an operational assessment that should reflect risk context and not just a static label. Verify using configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
Incorrect Answers
A:Assign event severity solely from the longest hostname. Handler severity is an operational assessment that should reflect risk context and not just a static label. Relevant observations are configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
B:Over-severe mapping creates alert fatigue while under-severe mapping delays response. In this specific situation, a targeted domain controller attack is grouped with low-impact scans because all events receive identical priority.
C:Over-severe mapping creates alert fatigue while under-severe mapping delays response. Set every handler to critical so no alert can be missed.
Question 667
A targeted domain controller attack is grouped with low-impact scans because all events receive identical priority. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
- The supporting evidence is an approved change request without recorded workflow execution.
- The supporting evidence is an unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
B:Handler severity is an operational assessment that should reflect risk context and not just a static label. These observations directly test event severity mapping and alert prioritization under the actual system state.
Incorrect Answers
A:An automation playbook name with no job history or target outcome. The relevant evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact. Handler severity is an operational assessment that should reflect risk context and not just a static label.
C:An approved change request without recorded workflow execution. The relevant evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact. Handler severity is an operational assessment that should reflect risk context and not just a static label.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is configured handler severity, raw signature, critical asset tags, false positives and escalation impact. Handler severity is an operational assessment that should reflect risk context and not just a static label.
Question 668
A targeted domain controller attack is grouped with low-impact scans because all events receive identical priority. Which implementation principle supports the intended approach?
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that handler severity is an operational assessment that should reflect risk context and not just a static label.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
B:This is why map event-handler output severity using source risk, corroboration, confidence and target importance.
Incorrect Answers
A:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of event severity mapping and alert prioritization. The relevant behavior is handler severity is an operational assessment that should reflect risk context and not just a static label. Check configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
C:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of event severity mapping and alert prioritization. The relevant behavior is handler severity is an operational assessment that should reflect risk context and not just a static label. Check configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
D:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of event severity mapping and alert prioritization. The relevant behavior is handler severity is an operational assessment that should reflect risk context and not just a static label. Check configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
Question 669
A targeted domain controller attack is grouped with low-impact scans because all events receive identical priority. An operator instead chooses this incorrect shortcut: Set every handler to critical so no alert can be missed. What technical weakness does this incorrect change introduce?
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that over-severe mapping creates alert fatigue while under-severe mapping delays response.
- The material failure is that reviewing the playbook job result caused the original malicious event.
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
B:Handler severity is an operational assessment that should reflect risk context and not just a static label.
Incorrect Answers
A:This does not account for the actual event severity mapping and alert prioritization weakness. In this specific situation, a targeted domain controller attack is grouped with low-impact scans because all events receive identical priority.
C:This does not account for the actual event severity mapping and alert prioritization weakness. Reviewing the playbook job result caused the original malicious event.
D:This does not account for the actual event severity mapping and alert prioritization weakness. Preserving the task audit trail created all earlier endpoint infections.
Question 670
A targeted domain controller attack is grouped with low-impact scans because all events receive identical priority. The observed fault is: Over-severe mapping creates alert fatigue while under-severe mapping delays response. What corrective action restores the target behavior with validation?
- The corrective action is to suppress all high-confidence events to reduce escalation volume.
- The corrective action is to adjust mapping after reviewing representative events and document the triage rule.
- The corrective action is to set every handler to critical so no alert can be missed.
- The corrective action is to assign event severity solely from the longest hostname.
Explanation
Correct Answer
B:Handler severity is an operational assessment that should reflect risk context and not just a static label. Recheck configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
Incorrect Answers
A:Suppress all high-confidence events to reduce escalation volume. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
C:Set every handler to critical so no alert can be missed. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
D:Assign event severity solely from the longest hostname. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
