Fortinet FCP_FAZ_AN-7.6 Practice Test 78
Question 770
A similar signature fires on an isolated development endpoint and requires lower response priority. The observed fault is: Ignoring privileged asset context can delay critical containment. How should the administrator restore and verify the intended state?
- The corrective action is to reassess and document priority and notify the right escalation owner.
- The corrective action is to replace the incident's evidence with a severity label.
- The corrective action is to assume any endpoint with the word admin in its hostname is a critical domain controller.
- The corrective action is to use only total event count to calculate business severity.
Explanation
Correct Answer
A:Recheck asset classification, identity privilege, indicator confidence, observed impact and recorded escalation.
Incorrect Answers
B:Replace the incident's evidence with a severity label. Ignoring privileged asset context can delay critical containment. Instead, reassess and document priority and notify the right escalation owner.
C:Assume any endpoint with the word admin in its hostname is a critical domain controller. Ignoring privileged asset context can delay critical containment. Instead, reassess and document priority and notify the right escalation owner.
D:Use only total event count to calculate business severity. Ignoring privileged asset context can delay critical containment. Instead, reassess and document priority and notify the right escalation owner. In this specific situation, a similar signature fires on an isolated development endpoint and requires lower response priority.
Question 771
One incident contains antivirus and IPS detections but their timestamps and sources are unclear. Which configuration decision most directly resolves this situation?
- Attach or reference the correct source events with stable identifiers and meaningful time ordering.
- Paste an unattributed screenshot as sole proof of compromise.
- Replace raw record IDs with a subjective analyst confidence statement.
- Assume all logs within one day belong to the same incident.
Explanation
Correct Answer
A:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. This is the targeted correction for Incident related events and evidence attachment.
Incorrect Answers
B:Paste an unattributed screenshot as sole proof of compromise. Missing provenance weakens investigation confidence and later audit review. Use attach or reference the correct source events with stable identifiers and meaningful time ordering.
C:Replace raw record IDs with a subjective analyst confidence statement. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Relevant observations are related event list, raw log IDs, device serial, incident timeline and analyst notes.
D:Assume all logs within one day belong to the same incident. This leaves the operational requirement unresolved. Missing provenance weakens investigation confidence and later audit review. The supported correction is attach or reference the correct source events with stable identifiers and meaningful time ordering.
Question 772
One incident contains antivirus and IPS detections but their timestamps and sources are unclear. What evidence most strongly confirms the operational condition?
- Related event list, raw log IDs, device serial, incident timeline and analyst notes.
- An automation playbook name with no job history or target outcome.
- A connector icon without authorization or current API response.
- An unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
A:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. These observations directly test Incident related events and evidence attachment under the actual system state.
Incorrect Answers
B:An automation playbook name with no job history or target outcome. The relevant evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
C:A connector icon without authorization or current API response. The relevant evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
Question 773
One incident contains antivirus and IPS detections but their timestamps and sources are unclear. What FortiAnalyzer behavior explains the correct decision?
- A saved playbook without an eligible trigger automatically performs all tasks.
- An incident marked resolved proves a remote firewall policy change succeeded.
- A delivered notification email always means the remote endpoint was quarantined.
- Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
Explanation
Correct Answer
D:Verification depends on related event list, raw log IDs, device serial, incident timeline and analyst notes. This is why attach or reference the correct source events with stable identifiers and meaningful time ordering.
Incorrect Answers
A:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of Incident related events and evidence attachment. The relevant behavior is Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Check related event list, raw log IDs, device serial, incident timeline and analyst notes.
B:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of Incident related events and evidence attachment. The relevant behavior is Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Check related event list, raw log IDs, device serial, incident timeline and analyst notes.
C:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of Incident related events and evidence attachment. The relevant behavior is Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Check related event list, raw log IDs, device serial, incident timeline and analyst notes.
Question 774
One incident contains antivirus and IPS detections but their timestamps and sources are unclear. An operator instead chooses this incorrect shortcut: Paste an unattributed screenshot as sole proof of compromise. Which resulting risk should the reviewer identify?
- An accurate incident assignment caused the missing log source.
- Reviewing the playbook job result caused the original malicious event.
- Missing provenance weakens investigation confidence and later audit review.
- The only effect is a cosmetic incident title change.
Explanation
Correct Answer
C:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. The intended preventive choice is attach or reference the correct source events with stable identifiers and meaningful time ordering.
Incorrect Answers
A:This does not account for the actual Incident related events and evidence attachment weakness. The more relevant failure is missing provenance weakens investigation confidence and later audit review.
B:This does not account for the actual Incident related events and evidence attachment weakness. Confirm with related event list, raw log IDs, device serial, incident timeline and analyst notes.
D:This does not account for the actual Incident related events and evidence attachment weakness. The only effect is a cosmetic incident title change.
Question 775
One incident contains antivirus and IPS detections but their timestamps and sources are unclear. The observed fault is: Missing provenance weakens investigation confidence and later audit review. How should the administrator restore and verify the intended state?
- Replace raw record IDs with a subjective analyst confidence statement.
- Reconcile related-event links and preserve exact device and time context.
- Assume all logs within one day belong to the same incident.
- Paste an unattributed screenshot as sole proof of compromise.
Explanation
Correct Answer
B:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
Incorrect Answers
A:Replace raw record IDs with a subjective analyst confidence statement. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
C:Assume all logs within one day belong to the same incident. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
D:Paste an unattributed screenshot as sole proof of compromise. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
Question 776
A forensic reviewer asks which original log entries support a claimed chain of activity. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, replace raw record IDs with a subjective analyst confidence statement.
- For this FortiAnalyzer investigation, assume all logs within one day belong to the same incident.
- For this FortiAnalyzer investigation, paste an unattributed screenshot as sole proof of compromise.
- For this FortiAnalyzer investigation, attach or reference the correct source events with stable identifiers and meaningful time ordering.
Explanation
Correct Answer
D:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Verify using related event list, raw log IDs, device serial, incident timeline and analyst notes.
Incorrect Answers
A:Replace raw record IDs with a subjective analyst confidence statement. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Relevant observations are related event list, raw log IDs, device serial, incident timeline and analyst notes.
B:Assume all logs within one day belong to the same incident. This leaves the operational requirement unresolved. Missing provenance weakens investigation confidence and later audit review. The supported correction is attach or reference the correct source events with stable identifiers and meaningful time ordering.
C:Paste an unattributed screenshot as sole proof of compromise. Missing provenance weakens investigation confidence and later audit review. Use attach or reference the correct source events with stable identifiers and meaningful time ordering.
Question 777
A forensic reviewer asks which original log entries support a claimed chain of activity. Which observations should the engineer inspect before declaring success?
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes.
- The supporting evidence is a connector icon without authorization or current API response.
Explanation
Correct Answer
C:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. The planned operation is attach or reference the correct source events with stable identifiers and meaningful time ordering.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
B:An automation playbook name with no job history or target outcome. The relevant evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
D:A connector icon without authorization or current API response. The relevant evidence is related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
Question 778
A forensic reviewer asks which original log entries support a claimed chain of activity. Which platform statement is MOST accurate for this scenario?
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
- The governing concept is that a saved playbook without an eligible trigger automatically performs all tasks.
- The governing concept is that Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
Explanation
Correct Answer
C:Verification depends on related event list, raw log IDs, device serial, incident timeline and analyst notes. Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
Incorrect Answers
A:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of Incident related events and evidence attachment. The relevant behavior is Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Check related event list, raw log IDs, device serial, incident timeline and analyst notes.
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of Incident related events and evidence attachment. The relevant behavior is Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Check related event list, raw log IDs, device serial, incident timeline and analyst notes.
D:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of Incident related events and evidence attachment. The relevant behavior is Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Check related event list, raw log IDs, device serial, incident timeline and analyst notes.
Question 779
A forensic reviewer asks which original log entries support a claimed chain of activity. An operator instead chooses this incorrect shortcut: Paste an unattributed screenshot as sole proof of compromise. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that the only effect is a cosmetic incident title change.
- The material failure is that missing provenance weakens investigation confidence and later audit review.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
- The material failure is that reviewing the playbook job result caused the original malicious event.
Explanation
Correct Answer
B:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary.
Incorrect Answers
A:This does not account for the actual Incident related events and evidence attachment weakness.
C:This does not account for the actual Incident related events and evidence attachment weakness. An approved narrow connector scope caused every unrelated Internet outage.
D:This does not account for the actual Incident related events and evidence attachment weakness. Reviewing the playbook job result caused the original malicious event.
Question 780
A forensic reviewer asks which original log entries support a claimed chain of activity. The observed fault is: Missing provenance weakens investigation confidence and later audit review. Which remediation best corrects the root cause?
- The corrective action is to reconcile related-event links and preserve exact device and time context.
- The corrective action is to assume all logs within one day belong to the same incident.
- The corrective action is to paste an unattributed screenshot as sole proof of compromise.
- The corrective action is to replace raw record IDs with a subjective analyst confidence statement.
Explanation
Correct Answer
A:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Recheck related event list, raw log IDs, device serial, incident timeline and analyst notes.
Incorrect Answers
B:Assume all logs within one day belong to the same incident. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
C:Paste an unattributed screenshot as sole proof of compromise. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
D:Replace raw record IDs with a subjective analyst confidence statement. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
