Fortinet FCP_FAZ_AN-7.6 Practice Test 74
Question 730
An incident is duplicated on every individual log despite an intended grouping rule. The observed fault is: Assuming all triggered events automatically form one clean incident can create investigation gaps. How should the administrator restore and verify the intended state?
- The corrective action is to assume one incident per raw log is always the correct correlation strategy.
- The corrective action is to change the event display name without configuring incident creation.
- The corrective action is to correct event-to-incident linkage and verify expected incident lifecycle.
- The corrective action is to delete raw logs after an incident number appears.
Explanation
Correct Answer
C:Recheck event handler output, incident creation settings, incident IDs, grouping fields and timestamps.
Incorrect Answers
A:Assume one incident per raw log is always the correct correlation strategy. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
B:Change the event display name without configuring incident creation. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
D:Delete raw logs after an incident number appears. Assuming all triggered events automatically form one clean incident can create investigation gaps. Instead, correct event-to-incident linkage and verify expected incident lifecycle.
Question 731
Two broad handlers react to the same suspicious login and page the on-call team twice. Which configuration decision most directly resolves this situation?
- Disable all detection rules except the newest one without coverage review.
- Treat duplicate alerts as proof there were multiple separate intrusions.
- Review overlapping event handler conditions and implement a documented deduplication or notification plan.
- Ignore handler overlap when configuring automated responses.
Explanation
Correct Answer
C:Multiple independent detection rules can match the same source event, requiring alert-design coordination. This is the targeted correction for event handler rule precedence and overlapping detections.
Incorrect Answers
A:Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Use review overlapping event handler conditions and implement a documented deduplication or notification plan.
B:Treat duplicate alerts as proof there were multiple separate intrusions. Multiple independent detection rules can match the same source event, requiring alert-design coordination. Relevant observations are handler match expressions, shared log IDs, notification outcomes and suppression logic.
D:Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. The supported correction is review overlapping event handler conditions and implement a documented deduplication or notification plan.
Question 732
Two broad handlers react to the same suspicious login and page the on-call team twice. What evidence most strongly confirms the operational condition?
- A severity label without source evidence and affected asset identity.
- An approved change request without recorded workflow execution.
- Handler match expressions, shared log IDs, notification outcomes and suppression logic.
- A connector icon without authorization or current API response.
Explanation
Correct Answer
C:These observations directly test event handler rule precedence and overlapping detections under the actual system state. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
B:An approved change request without recorded workflow execution. The relevant evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
D:A connector icon without authorization or current API response. The relevant evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Question 733
Two broad handlers react to the same suspicious login and page the on-call team twice. What FortiAnalyzer behavior explains the correct decision?
- Every IOC match is confirmed active malware compromise.
- A saved playbook without an eligible trigger automatically performs all tasks.
- A connector listed in inventory always has valid permissions and network reachability.
- Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Explanation
Correct Answer
D:This is why review overlapping event handler conditions and implement a documented deduplication or notification plan. Verification depends on handler match expressions, shared log IDs, notification outcomes and suppression logic.
Incorrect Answers
A:That generalization is incorrect in the context of event handler rule precedence and overlapping detections. The relevant behavior is multiple independent detection rules can match the same source event, requiring alert-design coordination.
B:That generalization is incorrect in the context of event handler rule precedence and overlapping detections. Check handler match expressions, shared log IDs, notification outcomes and suppression logic.
C:That generalization is incorrect in the context of event handler rule precedence and overlapping detections. A connector listed in inventory always has valid permissions and network reachability.
Question 734
Two broad handlers react to the same suspicious login and page the on-call team twice. An operator instead chooses this incorrect shortcut: Disable all detection rules except the newest one without coverage review. Which resulting risk should the reviewer identify?
- The only effect is a cosmetic incident title change.
- Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks.
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
B:The intended preventive choice is review overlapping event handler conditions and implement a documented deduplication or notification plan. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Incorrect Answers
A:This does not account for the actual event handler rule precedence and overlapping detections weakness. The more relevant failure is overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks.
C:This does not account for the actual event handler rule precedence and overlapping detections weakness. Confirm with handler match expressions, shared log IDs, notification outcomes and suppression logic.
D:This does not account for the actual event handler rule precedence and overlapping detections weakness. Preserving the task audit trail created all earlier endpoint infections.
Question 735
Two broad handlers react to the same suspicious login and page the on-call team twice. The observed fault is: Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. How should the administrator restore and verify the intended state?
- Treat duplicate alerts as proof there were multiple separate intrusions.
- Tune scope or notification handling and verify a known event has expected alerts.
- Ignore handler overlap when configuring automated responses.
- Disable all detection rules except the newest one without coverage review.
Explanation
Correct Answer
B:Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Incorrect Answers
A:Treat duplicate alerts as proof there were multiple separate intrusions. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Instead, tune scope or notification handling and verify a known event has expected alerts.
C:Ignore handler overlap when configuring automated responses. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Instead, tune scope or notification handling and verify a known event has expected alerts.
D:Disable all detection rules except the newest one without coverage review. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Instead, tune scope or notification handling and verify a known event has expected alerts.
Question 736
A high-confidence custom handler is drowned out by an older generic anomaly rule. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, treat duplicate alerts as proof there were multiple separate intrusions.
- For this FortiAnalyzer investigation, ignore handler overlap when configuring automated responses.
- For this FortiAnalyzer investigation, disable all detection rules except the newest one without coverage review.
- For this FortiAnalyzer investigation, review overlapping event handler conditions and implement a documented deduplication or notification plan.
Explanation
Correct Answer
D:Multiple independent detection rules can match the same source event, requiring alert-design coordination. Verify using handler match expressions, shared log IDs, notification outcomes and suppression logic.
Incorrect Answers
A:Treat duplicate alerts as proof there were multiple separate intrusions. Multiple independent detection rules can match the same source event, requiring alert-design coordination. Relevant observations are handler match expressions, shared log IDs, notification outcomes and suppression logic.
B:Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks.
C:Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Disable all detection rules except the newest one without coverage review.
Question 737
A high-confidence custom handler is drowned out by an older generic anomaly rule. Which observations should the engineer inspect before declaring success?
- The supporting evidence is an unrelated incident status with no matching event or task audit.
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic.
- The supporting evidence is an approved change request without recorded workflow execution.
Explanation
Correct Answer
C:These observations directly test event handler rule precedence and overlapping detections under the actual system state. The planned operation is review overlapping event handler conditions and implement a documented deduplication or notification plan.
Incorrect Answers
A:An unrelated incident status with no matching event or task audit. The relevant evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
B:A severity label without source evidence and affected asset identity. The relevant evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
D:An approved change request without recorded workflow execution. The relevant evidence is handler match expressions, shared log IDs, notification outcomes and suppression logic. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Question 738
A high-confidence custom handler is drowned out by an older generic anomaly rule. Which platform statement is MOST accurate for this scenario?
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
- The governing concept is that multiple independent detection rules can match the same source event, requiring alert-design coordination.
Explanation
Correct Answer
D:This is why review overlapping event handler conditions and implement a documented deduplication or notification plan. Multiple independent detection rules can match the same source event, requiring alert-design coordination.
Incorrect Answers
A:That generalization is incorrect in the context of event handler rule precedence and overlapping detections.
B:The relevant behavior is multiple independent detection rules can match the same source event, requiring alert-design coordination.
C:That generalization is incorrect in the context of event handler rule precedence and overlapping detections. An incident marked resolved proves a remote firewall policy change succeeded.
Question 739
A high-confidence custom handler is drowned out by an older generic anomaly rule. An operator instead chooses this incorrect shortcut: Disable all detection rules except the newest one without coverage review. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks.
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
Explanation
Correct Answer
B:The intended preventive choice is review overlapping event handler conditions and implement a documented deduplication or notification plan. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks.
Incorrect Answers
A:This does not account for the actual event handler rule precedence and overlapping detections weakness.
C:This does not account for the actual event handler rule precedence and overlapping detections weakness. An accurate incident assignment caused the missing log source.
D:This does not account for the actual event handler rule precedence and overlapping detections weakness. An approved narrow connector scope caused every unrelated Internet outage.
Question 740
A high-confidence custom handler is drowned out by an older generic anomaly rule. The observed fault is: Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Which remediation best corrects the root cause?
- The corrective action is to ignore handler overlap when configuring automated responses.
- The corrective action is to disable all detection rules except the newest one without coverage review.
- The corrective action is to treat duplicate alerts as proof there were multiple separate intrusions.
- The corrective action is to tune scope or notification handling and verify a known event has expected alerts.
Explanation
Correct Answer
D:Recheck handler match expressions, shared log IDs, notification outcomes and suppression logic.
Incorrect Answers
A:Ignore handler overlap when configuring automated responses. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Instead, tune scope or notification handling and verify a known event has expected alerts.
B:Disable all detection rules except the newest one without coverage review. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Instead, tune scope or notification handling and verify a known event has expected alerts.
C:Treat duplicate alerts as proof there were multiple separate intrusions. Overlapping broad rules generate duplicate analyst work and can fire conflicting playbooks. Instead, tune scope or notification handling and verify a known event has expected alerts.
