Fortinet FCP_FAZ_AN-7.6 Practice Test 68
Question 670
A targeted domain controller attack is grouped with low-impact scans because all events receive identical priority. The observed fault is: Over-severe mapping creates alert fatigue while under-severe mapping delays response. What corrective action restores the target behavior with validation?
- The corrective action is to suppress all high-confidence events to reduce escalation volume.
- The corrective action is to adjust mapping after reviewing representative events and document the triage rule.
- The corrective action is to set every handler to critical so no alert can be missed.
- The corrective action is to assign event severity solely from the longest hostname.
Explanation
Correct Answer
B:Handler severity is an operational assessment that should reflect risk context and not just a static label. Recheck configured handler severity, raw signature, critical asset tags, false positives and escalation impact.
Incorrect Answers
A:Suppress all high-confidence events to reduce escalation volume. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
C:Set every handler to critical so no alert can be missed. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
D:Assign event severity solely from the longest hostname. Over-severe mapping creates alert fatigue while under-severe mapping delays response. Instead, adjust mapping after reviewing representative events and document the triage rule.
Question 671
An approved vulnerability scanner repeatedly alerts during a planned assessment window. Which FortiAnalyzer analyst action is most appropriate?
- Disable every authentication handler for the entire month.
- Create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
- Delete the underlying log rows because the scan was authorized.
- Use only a calendar title without applying a condition in the event rule.
Explanation
Correct Answer
B:Verify using exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
Incorrect Answers
A:Global handler disablement can hide real attacks outside the maintenance scope. Use create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
C:Delete the underlying log rows because the scan was authorized. Detection tuning should narrow known false positives without disabling broad unrelated coverage. Relevant observations are exception match, change request, time range, test benign alert and unaffected threat sample.
D:Global handler disablement can hide real attacks outside the maintenance scope. The supported correction is create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
Question 672
An approved vulnerability scanner repeatedly alerts during a planned assessment window. Which collection of records directly tests the suspected mechanism?
- Exception match, change request, time range, test benign alert and unaffected threat sample.
- An automation playbook name with no job history or target outcome.
- A connector icon without authorization or current API response.
- An unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
A:These observations directly test event handler suppression and maintenance exception under the actual system state. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
Incorrect Answers
B:An automation playbook name with no job history or target outcome. The relevant evidence is exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
C:A connector icon without authorization or current API response. The relevant evidence is exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
Question 673
An approved vulnerability scanner repeatedly alerts during a planned assessment window. Which implementation principle supports the intended approach?
- A saved playbook without an eligible trigger automatically performs all tasks.
- An incident marked resolved proves a remote firewall policy change succeeded.
- Detection tuning should narrow known false positives without disabling broad unrelated coverage.
- A delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
C:Verification depends on exception match, change request, time range, test benign alert and unaffected threat sample. This is why create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
Incorrect Answers
A:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of event handler suppression and maintenance exception. The relevant behavior is detection tuning should narrow known false positives without disabling broad unrelated coverage. Check exception match, change request, time range, test benign alert and unaffected threat sample.
B:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of event handler suppression and maintenance exception. The relevant behavior is detection tuning should narrow known false positives without disabling broad unrelated coverage. Check exception match, change request, time range, test benign alert and unaffected threat sample.
D:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of event handler suppression and maintenance exception. The relevant behavior is detection tuning should narrow known false positives without disabling broad unrelated coverage. Check exception match, change request, time range, test benign alert and unaffected threat sample.
Question 674
An approved vulnerability scanner repeatedly alerts during a planned assessment window. An operator instead chooses this incorrect shortcut: Disable every authentication handler for the entire month. What technical weakness does this incorrect change introduce?
- An accurate incident assignment caused the missing log source.
- Reviewing the playbook job result caused the original malicious event.
- The only effect is a cosmetic incident title change.
- Global handler disablement can hide real attacks outside the maintenance scope.
Explanation
Correct Answer
D:The intended preventive choice is create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
Incorrect Answers
A:This does not account for the actual event handler suppression and maintenance exception weakness. The more relevant failure is global handler disablement can hide real attacks outside the maintenance scope.
B:This does not account for the actual event handler suppression and maintenance exception weakness. Confirm with exception match, change request, time range, test benign alert and unaffected threat sample.
C:This does not account for the actual event handler suppression and maintenance exception weakness. The only effect is a cosmetic incident title change.
Question 675
An approved vulnerability scanner repeatedly alerts during a planned assessment window. The observed fault is: Global handler disablement can hide real attacks outside the maintenance scope. What corrective action restores the target behavior with validation?
- Apply the limited exception and test that unrelated malicious-like events still alert.
- Delete the underlying log rows because the scan was authorized.
- Use only a calendar title without applying a condition in the event rule.
- Disable every authentication handler for the entire month.
Explanation
Correct Answer
A:This fixes the described operational problem with observable validation. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
Incorrect Answers
B:Delete the underlying log rows because the scan was authorized. Global handler disablement can hide real attacks outside the maintenance scope. Instead, apply the limited exception and test that unrelated malicious-like events still alert.
C:Use only a calendar title without applying a condition in the event rule. Global handler disablement can hide real attacks outside the maintenance scope. Instead, apply the limited exception and test that unrelated malicious-like events still alert.
D:Disable every authentication handler for the entire month. Global handler disablement can hide real attacks outside the maintenance scope. Instead, apply the limited exception and test that unrelated malicious-like events still alert.
Question 676
A noisy automated backup account causes an event handler to trigger but security wants to preserve other authentication detections. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, delete the underlying log rows because the scan was authorized.
- For this FortiAnalyzer investigation, create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
- For this FortiAnalyzer investigation, use only a calendar title without applying a condition in the event rule.
- For this FortiAnalyzer investigation, disable every authentication handler for the entire month.
Explanation
Correct Answer
B:Verify using exception match, change request, time range, test benign alert and unaffected threat sample. This is the targeted correction for event handler suppression and maintenance exception.
Incorrect Answers
A:Delete the underlying log rows because the scan was authorized. Detection tuning should narrow known false positives without disabling broad unrelated coverage. Relevant observations are exception match, change request, time range, test benign alert and unaffected threat sample.
C:Global handler disablement can hide real attacks outside the maintenance scope. Use only a calendar title without applying a condition in the event rule.
D:Global handler disablement can hide real attacks outside the maintenance scope. This change does not provide the specified control.
Question 677
A noisy automated backup account causes an event handler to trigger but security wants to preserve other authentication detections. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is a connector icon without authorization or current API response.
- The supporting evidence is exception match, change request, time range, test benign alert and unaffected threat sample.
Explanation
Correct Answer
D:These observations directly test event handler suppression and maintenance exception under the actual system state. The planned operation is create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
B:An automation playbook name with no job history or target outcome. The relevant evidence is exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
C:A connector icon without authorization or current API response. The relevant evidence is exception match, change request, time range, test benign alert and unaffected threat sample. Detection tuning should narrow known false positives without disabling broad unrelated coverage.
Question 678
A noisy automated backup account causes an event handler to trigger but security wants to preserve other authentication detections. Which technical principle BEST explains this result?
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
- The governing concept is that a saved playbook without an eligible trigger automatically performs all tasks.
- The governing concept is that detection tuning should narrow known false positives without disabling broad unrelated coverage.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
Explanation
Correct Answer
C:Verification depends on exception match, change request, time range, test benign alert and unaffected threat sample.
Incorrect Answers
A:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of event handler suppression and maintenance exception. The relevant behavior is detection tuning should narrow known false positives without disabling broad unrelated coverage. Check exception match, change request, time range, test benign alert and unaffected threat sample.
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of event handler suppression and maintenance exception. The relevant behavior is detection tuning should narrow known false positives without disabling broad unrelated coverage. Check exception match, change request, time range, test benign alert and unaffected threat sample.
D:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of event handler suppression and maintenance exception. The relevant behavior is detection tuning should narrow known false positives without disabling broad unrelated coverage. Check exception match, change request, time range, test benign alert and unaffected threat sample.
Question 679
A noisy automated backup account causes an event handler to trigger but security wants to preserve other authentication detections. An operator instead chooses this incorrect shortcut: Disable every authentication handler for the entire month. What material failure follows from the mistaken shortcut?
- The material failure is that the only effect is a cosmetic incident title change.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
- The material failure is that global handler disablement can hide real attacks outside the maintenance scope.
- The material failure is that reviewing the playbook job result caused the original malicious event.
Explanation
Correct Answer
C:The intended preventive choice is create narrowly scoped suppression or exceptions for authorized identity, target and maintenance period.
Incorrect Answers
A:This does not account for the actual event handler suppression and maintenance exception weakness. In this specific situation, a noisy automated backup account causes an event handler to trigger but security wants to preserve other authentication detections.
B:This does not account for the actual event handler suppression and maintenance exception weakness. An approved narrow connector scope caused every unrelated Internet outage.
D:This does not account for the actual event handler suppression and maintenance exception weakness. Reviewing the playbook job result caused the original malicious event.
Question 680
A noisy automated backup account causes an event handler to trigger but security wants to preserve other authentication detections. The observed fault is: Global handler disablement can hide real attacks outside the maintenance scope. Which controlled recovery BEST addresses this failure?
- The corrective action is to use only a calendar title without applying a condition in the event rule.
- The corrective action is to apply the limited exception and test that unrelated malicious-like events still alert.
- The corrective action is to disable every authentication handler for the entire month.
- The corrective action is to delete the underlying log rows because the scan was authorized.
Explanation
Correct Answer
B:Recheck exception match, change request, time range, test benign alert and unaffected threat sample.
Incorrect Answers
A:Use only a calendar title without applying a condition in the event rule. Global handler disablement can hide real attacks outside the maintenance scope. Instead, apply the limited exception and test that unrelated malicious-like events still alert.
C:Disable every authentication handler for the entire month. Global handler disablement can hide real attacks outside the maintenance scope. Instead, apply the limited exception and test that unrelated malicious-like events still alert.
D:Delete the underlying log rows because the scan was authorized. Global handler disablement can hide real attacks outside the maintenance scope. Instead, apply the limited exception and test that unrelated malicious-like events still alert.
