Fortinet FCP_FAZ_AN-7.6 Practice Test 73
Question 720
A new phishing-detection handler must be tested without risking automatic containment from unverified criteria. The observed fault is: Unvalidated handler changes can cause false escalation or unintended production actions. Which controlled recovery BEST addresses this failure?
- The corrective action is to disable all audit logging during the trial to reduce noise.
- The corrective action is to refine conditions and stage enablement with rollback and alert-volume monitoring.
- The corrective action is to tie every new handler immediately to unrestricted device quarantine.
- The corrective action is to assume an empty rule preview guarantees no false positives.
Explanation
Correct Answer
B:Recheck handler test output, matching and nonmatching samples, runbook approval and activation history.
Incorrect Answers
A:Disable all audit logging during the trial to reduce noise. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
C:Tie every new handler immediately to unrestricted device quarantine. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
D:Assume an empty rule preview guarantees no false positives. Unvalidated handler changes can cause false escalation or unintended production actions. Instead, refine conditions and stage enablement with rollback and alert-volume monitoring.
Question 721
Security events fire in the handler console but no incident record is created where the team expects. What is the BEST supported implementation or corrective action?
- Change the event display name without configuring incident creation.
- Delete raw logs after an incident number appears.
- Assume one incident per raw log is always the correct correlation strategy.
- Check supported handler actions and incident workflow mapping, grouping and update behavior.
Explanation
Correct Answer
D:This is the targeted correction for handler-to-incident creation mapping. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
Incorrect Answers
A:Assuming all triggered events automatically form one clean incident can create investigation gaps. Use check supported handler actions and incident workflow mapping, grouping and update behavior.
B:Delete raw logs after an incident number appears. Detecting an event and creating or updating an incident are separate configured workflow outcomes. Relevant observations are event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
C:Assuming all triggered events automatically form one clean incident can create investigation gaps. The supported correction is check supported handler actions and incident workflow mapping, grouping and update behavior.
Question 722
Security events fire in the handler console but no incident record is created where the team expects. Which diagnostic evidence BEST verifies the intended outcome?
- An automation playbook name with no job history or target outcome.
- A connector icon without authorization or current API response.
- An unrelated incident status with no matching event or task audit.
- Event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Explanation
Correct Answer
D:The planned operation is check supported handler actions and incident workflow mapping, grouping and update behavior. These observations directly test handler-to-incident creation mapping under the actual system state.
Incorrect Answers
A:An automation playbook name with no job history or target outcome. The relevant evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
B:A connector icon without authorization or current API response. The relevant evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
C:An unrelated incident status with no matching event or task audit. The relevant evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
Question 723
Security events fire in the handler console but no incident record is created where the team expects. Which technical principle BEST explains this result?
- Detecting an event and creating or updating an incident are separate configured workflow outcomes.
- A saved playbook without an eligible trigger automatically performs all tasks.
- An incident marked resolved proves a remote firewall policy change succeeded.
- A delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
A:Verification depends on event handler output, incident creation settings, incident IDs, grouping fields and timestamps. This is why check supported handler actions and incident workflow mapping, grouping and update behavior.
Incorrect Answers
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of handler-to-incident creation mapping. The relevant behavior is detecting an event and creating or updating an incident are separate configured workflow outcomes. Check event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
C:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of handler-to-incident creation mapping. The relevant behavior is detecting an event and creating or updating an incident are separate configured workflow outcomes. Check event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
D:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of handler-to-incident creation mapping. The relevant behavior is detecting an event and creating or updating an incident are separate configured workflow outcomes. Check event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Question 724
Security events fire in the handler console but no incident record is created where the team expects. An operator instead chooses this incorrect shortcut: Change the event display name without configuring incident creation. What material failure follows from the mistaken shortcut?
- An accurate incident assignment caused the missing log source.
- Reviewing the playbook job result caused the original malicious event.
- Assuming all triggered events automatically form one clean incident can create investigation gaps.
- The only effect is a cosmetic incident title change.
Explanation
Correct Answer
C:The intended preventive choice is check supported handler actions and incident workflow mapping, grouping and update behavior. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
Incorrect Answers
A:This does not account for the actual handler-to-incident creation mapping weakness. The more relevant failure is assuming all triggered events automatically form one clean incident can create investigation gaps.
B:This does not account for the actual handler-to-incident creation mapping weakness. Confirm with event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
D:This does not account for the actual handler-to-incident creation mapping weakness. The only effect is a cosmetic incident title change.
Question 725
Security events fire in the handler console but no incident record is created where the team expects. The observed fault is: Assuming all triggered events automatically form one clean incident can create investigation gaps. Which controlled recovery BEST addresses this failure?
- Delete raw logs after an incident number appears.
- Assume one incident per raw log is always the correct correlation strategy.
- Correct event-to-incident linkage and verify expected incident lifecycle.
- Change the event display name without configuring incident creation.
Explanation
Correct Answer
C:Detecting an event and creating or updating an incident are separate configured workflow outcomes.
Incorrect Answers
A:Delete raw logs after an incident number appears. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
B:Assume one incident per raw log is always the correct correlation strategy. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
D:Change the event display name without configuring incident creation. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
Question 726
An incident is duplicated on every individual log despite an intended grouping rule. Which configuration decision most directly resolves this situation?
- For this FortiAnalyzer investigation, check supported handler actions and incident workflow mapping, grouping and update behavior.
- For this FortiAnalyzer investigation, delete raw logs after an incident number appears.
- For this FortiAnalyzer investigation, assume one incident per raw log is always the correct correlation strategy.
- For this FortiAnalyzer investigation, change the event display name without configuring incident creation.
Explanation
Correct Answer
A:This is the targeted correction for handler-to-incident creation mapping. Verify using event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Incorrect Answers
B:Delete raw logs after an incident number appears. Detecting an event and creating or updating an incident are separate configured workflow outcomes. Relevant observations are event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
C:Assuming all triggered events automatically form one clean incident can create investigation gaps. Assume one incident per raw log is always the correct correlation strategy.
D:Assuming all triggered events automatically form one clean incident can create investigation gaps. Change the event display name without configuring incident creation.
Question 727
An incident is duplicated on every individual log despite an intended grouping rule. What evidence most strongly confirms the operational condition?
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
- The supporting evidence is a connector icon without authorization or current API response.
Explanation
Correct Answer
C:The planned operation is check supported handler actions and incident workflow mapping, grouping and update behavior. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
B:An automation playbook name with no job history or target outcome. The relevant evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
D:A connector icon without authorization or current API response. The relevant evidence is event handler output, incident creation settings, incident IDs, grouping fields and timestamps. Detecting an event and creating or updating an incident are separate configured workflow outcomes.
Question 728
An incident is duplicated on every individual log despite an intended grouping rule. What FortiAnalyzer behavior explains the correct decision?
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
- The governing concept is that a saved playbook without an eligible trigger automatically performs all tasks.
- The governing concept is that detecting an event and creating or updating an incident are separate configured workflow outcomes.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
Explanation
Correct Answer
C:Verification depends on event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Incorrect Answers
A:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of handler-to-incident creation mapping. The relevant behavior is detecting an event and creating or updating an incident are separate configured workflow outcomes. Check event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of handler-to-incident creation mapping. The relevant behavior is detecting an event and creating or updating an incident are separate configured workflow outcomes. Check event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
D:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of handler-to-incident creation mapping. The relevant behavior is detecting an event and creating or updating an incident are separate configured workflow outcomes. Check event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Question 729
An incident is duplicated on every individual log despite an intended grouping rule. An operator instead chooses this incorrect shortcut: Change the event display name without configuring incident creation. Which resulting risk should the reviewer identify?
- The material failure is that the only effect is a cosmetic incident title change.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
- The material failure is that reviewing the playbook job result caused the original malicious event.
- The material failure is that assuming all triggered events automatically form one clean incident can create investigation gaps.
Explanation
Correct Answer
D:The intended preventive choice is check supported handler actions and incident workflow mapping, grouping and update behavior. Assuming all triggered events automatically form one clean incident can create investigation gaps.
Incorrect Answers
A:This does not account for the actual handler-to-incident creation mapping weakness. In this specific situation, an incident is duplicated on every individual log despite an intended grouping rule.
B:This does not account for the actual handler-to-incident creation mapping weakness. An approved narrow connector scope caused every unrelated Internet outage.
C:This does not account for the actual handler-to-incident creation mapping weakness. Reviewing the playbook job result caused the original malicious event.
Question 730
An incident is duplicated on every individual log despite an intended grouping rule. The observed fault is: Assuming all triggered events automatically form one clean incident can create investigation gaps. How should the administrator restore and verify the intended state?
- The corrective action is to assume one incident per raw log is always the correct correlation strategy.
- The corrective action is to change the event display name without configuring incident creation.
- The corrective action is to correct event-to-incident linkage and verify expected incident lifecycle.
- The corrective action is to delete raw logs after an incident number appears.
Explanation
Correct Answer
C:Recheck event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Incorrect Answers
A:Assume one incident per raw log is always the correct correlation strategy. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
B:Change the event display name without configuring incident creation. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
D:Delete raw logs after an incident number appears. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
