Fortinet FCP_FAZ_AN-7.6 Practice Test 72
Question 710
Two independent hosts share one malware signature and the SOC must not treat them as a single endpoint. The observed fault is: Overly broad aggregation hides separate infected hosts and incident impact. What corrective action restores the target behavior with validation?
- The corrective action is to treat all matching detections as successful malware removal.
- The corrective action is to erase every repeated antivirus log and retain only a count.
- The corrective action is to group by signature only and ignore device identity.
- The corrective action is to tune grouping and verify a repeated same-host case and a distinct-host case.
Explanation
Correct Answer
D:Recheck unique host ID, AV signature, detection count, deduplication rule and linked raw log IDs. Event aggregation improves triage but must preserve per-asset attribution.
Incorrect Answers
A:Treat all matching detections as successful malware removal. Overly broad aggregation hides separate infected hosts and incident impact. Instead, tune grouping and verify a repeated same-host case and a distinct-host case.
B:Erase every repeated antivirus log and retain only a count. Overly broad aggregation hides separate infected hosts and incident impact. Instead, tune grouping and verify a repeated same-host case and a distinct-host case.
C:Group by signature only and ignore device identity. Overly broad aggregation hides separate infected hosts and incident impact. Instead, tune grouping and verify a repeated same-host case and a distinct-host case.
Question 711
An analyst publishes a revised rule directly to production and receives ten thousand alerts. Which FortiAnalyzer analyst action is most appropriate?
- Test rule conditions on representative historical or safely generated logs before enabling risky actions.
- Tie every new handler immediately to unrestricted device quarantine.
- Assume an empty rule preview guarantees no false positives.
- Disable all audit logging during the trial to reduce noise.
Explanation
Correct Answer
A:This is the targeted correction for event handler test and rollback before enabling. Predeployment validation separates correct detection conditions from unsafe automated response.
Incorrect Answers
B:Unvalidated handler changes can cause false escalation or unintended production actions. Use test rule conditions on representative historical or safely generated logs before enabling risky actions.
C:Assume an empty rule preview guarantees no false positives. Predeployment validation separates correct detection conditions from unsafe automated response. Relevant observations are handler test output, matching and nonmatching samples, runbook approval and activation history.
D:Unvalidated handler changes can cause false escalation or unintended production actions. The supported correction is test rule conditions on representative historical or safely generated logs before enabling risky actions.
Question 712
An analyst publishes a revised rule directly to production and receives ten thousand alerts. Which collection of records directly tests the suspected mechanism?
- Handler test output, matching and nonmatching samples, runbook approval and activation history.
- An approved change request without recorded workflow execution.
- An unrelated incident status with no matching event or task audit.
- A severity label without source evidence and affected asset identity.
Explanation
Correct Answer
A:These observations directly test event handler test and rollback before enabling under the actual system state. Predeployment validation separates correct detection conditions from unsafe automated response.
Incorrect Answers
B:An approved change request without recorded workflow execution. The relevant evidence is handler test output, matching and nonmatching samples, runbook approval and activation history. Predeployment validation separates correct detection conditions from unsafe automated response.
C:An unrelated incident status with no matching event or task audit. The relevant evidence is handler test output, matching and nonmatching samples, runbook approval and activation history. Predeployment validation separates correct detection conditions from unsafe automated response.
D:A severity label without source evidence and affected asset identity. The relevant evidence is handler test output, matching and nonmatching samples, runbook approval and activation history. Predeployment validation separates correct detection conditions from unsafe automated response.
Question 713
An analyst publishes a revised rule directly to production and receives ten thousand alerts. Which implementation principle supports the intended approach?
- An incident marked resolved proves a remote firewall policy change succeeded.
- A connector listed in inventory always has valid permissions and network reachability.
- Predeployment validation separates correct detection conditions from unsafe automated response.
- Every IOC match is confirmed active malware compromise.
Explanation
Correct Answer
C:Verification depends on handler test output, matching and nonmatching samples, runbook approval and activation history. This is why test rule conditions on representative historical or safely generated logs before enabling risky actions.
Incorrect Answers
A:That generalization is incorrect in the context of event handler test and rollback before enabling. The relevant behavior is predeployment validation separates correct detection conditions from unsafe automated response.
B:That generalization is incorrect in the context of event handler test and rollback before enabling. Check handler test output, matching and nonmatching samples, runbook approval and activation history.
D:That generalization is incorrect in the context of event handler test and rollback before enabling.
Question 714
An analyst publishes a revised rule directly to production and receives ten thousand alerts. An operator instead chooses this incorrect shortcut: Tie every new handler immediately to unrestricted device quarantine. What technical weakness does this incorrect change introduce?
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
- An accurate incident assignment caused the missing log source.
- Unvalidated handler changes can cause false escalation or unintended production actions.
Explanation
Correct Answer
D:The intended preventive choice is test rule conditions on representative historical or safely generated logs before enabling risky actions. Predeployment validation separates correct detection conditions from unsafe automated response.
Incorrect Answers
A:This does not account for the actual event handler test and rollback before enabling weakness. The more relevant failure is unvalidated handler changes can cause false escalation or unintended production actions.
B:This does not account for the actual event handler test and rollback before enabling weakness. Confirm with handler test output, matching and nonmatching samples, runbook approval and activation history.
C:This does not account for the actual event handler test and rollback before enabling weakness. An accurate incident assignment caused the missing log source.
Question 715
An analyst publishes a revised rule directly to production and receives ten thousand alerts. The observed fault is: Unvalidated handler changes can cause false escalation or unintended production actions. What corrective action restores the target behavior with validation?
- Assume an empty rule preview guarantees no false positives.
- Disable all audit logging during the trial to reduce noise.
- Tie every new handler immediately to unrestricted device quarantine.
- Refine conditions and stage enablement with rollback and alert-volume monitoring.
Explanation
Correct Answer
D:This fixes the described operational problem with observable validation. Predeployment validation separates correct detection conditions from unsafe automated response.
Incorrect Answers
A:Assume an empty rule preview guarantees no false positives. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
B:Disable all audit logging during the trial to reduce noise. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
C:Tie every new handler immediately to unrestricted device quarantine. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
Question 716
A new phishing-detection handler must be tested without risking automatic containment from unverified criteria. What is the BEST supported implementation or corrective action?
- For this FortiAnalyzer investigation, assume an empty rule preview guarantees no false positives.
- For this FortiAnalyzer investigation, disable all audit logging during the trial to reduce noise.
- For this FortiAnalyzer investigation, tie every new handler immediately to unrestricted device quarantine.
- For this FortiAnalyzer investigation, test rule conditions on representative historical or safely generated logs before enabling risky actions.
Explanation
Correct Answer
D:This is the targeted correction for event handler test and rollback before enabling. Verify using handler test output, matching and nonmatching samples, runbook approval and activation history.
Incorrect Answers
A:Assume an empty rule preview guarantees no false positives. Predeployment validation separates correct detection conditions from unsafe automated response. Relevant observations are handler test output, matching and nonmatching samples, runbook approval and activation history.
B:Unvalidated handler changes can cause false escalation or unintended production actions. In this specific situation, a new phishing-detection handler must be tested without risking automatic containment from unverified criteria.
C:Unvalidated handler changes can cause false escalation or unintended production actions. This change does not provide the specified control.
Question 717
A new phishing-detection handler must be tested without risking automatic containment from unverified criteria. Which diagnostic evidence BEST verifies the intended outcome?
- The supporting evidence is handler test output, matching and nonmatching samples, runbook approval and activation history.
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is an approved change request without recorded workflow execution.
- The supporting evidence is an unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
A:These observations directly test event handler test and rollback before enabling under the actual system state. The planned operation is test rule conditions on representative historical or safely generated logs before enabling risky actions.
Incorrect Answers
B:An automation playbook name with no job history or target outcome. The relevant evidence is handler test output, matching and nonmatching samples, runbook approval and activation history. Predeployment validation separates correct detection conditions from unsafe automated response.
C:An approved change request without recorded workflow execution. The relevant evidence is handler test output, matching and nonmatching samples, runbook approval and activation history. Predeployment validation separates correct detection conditions from unsafe automated response.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is handler test output, matching and nonmatching samples, runbook approval and activation history. Predeployment validation separates correct detection conditions from unsafe automated response.
Question 718
A new phishing-detection handler must be tested without risking automatic containment from unverified criteria. Which technical principle BEST explains this result?
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that predeployment validation separates correct detection conditions from unsafe automated response.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
B:Verification depends on handler test output, matching and nonmatching samples, runbook approval and activation history.
Incorrect Answers
A:That generalization is incorrect in the context of event handler test and rollback before enabling.
C:That generalization is incorrect in the context of event handler test and rollback before enabling. An incident marked resolved proves a remote firewall policy change succeeded.
D:That generalization is incorrect in the context of event handler test and rollback before enabling. A delivered notification email always means the remote endpoint was quarantined.
Question 719
A new phishing-detection handler must be tested without risking automatic containment from unverified criteria. An operator instead chooses this incorrect shortcut: Tie every new handler immediately to unrestricted device quarantine. What material failure follows from the mistaken shortcut?
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that reviewing the playbook job result caused the original malicious event.
- The material failure is that unvalidated handler changes can cause false escalation or unintended production actions.
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
C:The intended preventive choice is test rule conditions on representative historical or safely generated logs before enabling risky actions.
Incorrect Answers
A:This does not account for the actual event handler test and rollback before enabling weakness.
B:This does not account for the actual event handler test and rollback before enabling weakness. Reviewing the playbook job result caused the original malicious event.
D:This does not account for the actual event handler test and rollback before enabling weakness. Preserving the task audit trail created all earlier endpoint infections.
Question 720
A new phishing-detection handler must be tested without risking automatic containment from unverified criteria. The observed fault is: Unvalidated handler changes can cause false escalation or unintended production actions. Which controlled recovery BEST addresses this failure?
- The corrective action is to disable all audit logging during the trial to reduce noise.
- The corrective action is to refine conditions and stage enablement with rollback and alert-volume monitoring.
- The corrective action is to tie every new handler immediately to unrestricted device quarantine.
- The corrective action is to assume an empty rule preview guarantees no false positives.
Explanation
Correct Answer
B:Recheck handler test output, matching and nonmatching samples, runbook approval and activation history.
Incorrect Answers
A:Disable all audit logging during the trial to reduce noise. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
C:Tie every new handler immediately to unrestricted device quarantine. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
D:Assume an empty rule preview guarantees no false positives. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
