Fortinet FCP_FAZ_AN-7.6 Practice Test 79
Question 780
A forensic reviewer asks which original log entries support a claimed chain of activity. The observed fault is: Missing provenance weakens investigation confidence and later audit review. Which remediation best corrects the root cause?
- The corrective action is to reconcile related-event links and preserve exact device and time context.
- The corrective action is to assume all logs within one day belong to the same incident.
- The corrective action is to paste an unattributed screenshot as sole proof of compromise.
- The corrective action is to replace raw record IDs with a subjective analyst confidence statement.
Explanation
Correct Answer
A:Incident evidence must be traceable to actual events and cannot be replaced by an unsupported summary. Recheck related event list, raw log IDs, device serial, incident timeline and analyst notes.
Incorrect Answers
B:Assume all logs within one day belong to the same incident. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
C:Paste an unattributed screenshot as sole proof of compromise. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
D:Replace raw record IDs with a subjective analyst confidence statement. Missing provenance weakens investigation confidence and later audit review. Instead, reconcile related-event links and preserve exact device and time context.
Question 781
A file hash indicator is mistakenly compared against destination IP text and never matches. Which administrator action meets the documented requirement?
- Compare file SHA-256 bytes directly to TCP destination port strings.
- Replace every URL indicator with a random resolved IP without context.
- Classify indicators by supported observable type and normalize only as justified without changing the actual security meaning.
- Assume all indicator strings are semantically identical across field types.
Explanation
Correct Answer
C:A meaningful IOC match requires compatible data types and consistent representation. This is the targeted correction for indicator type and observable normalization.
Incorrect Answers
A:Type mismatches cause missed detections or misleading false matches. Use classify indicators by supported observable type and normalize only as justified without changing the actual security meaning.
B:Replace every URL indicator with a random resolved IP without context. A meaningful IOC match requires compatible data types and consistent representation. Relevant observations are IOC type, original value, normalization rule, lookup source and matched field.
D:Type mismatches cause missed detections or misleading false matches. The supported correction is classify indicators by supported observable type and normalize only as justified without changing the actual security meaning.
Question 782
A file hash indicator is mistakenly compared against destination IP text and never matches. Which observations should the engineer inspect before declaring success?
- A severity label without source evidence and affected asset identity.
- An approved change request without recorded workflow execution.
- A connector icon without authorization or current API response.
- IOC type, original value, normalization rule, lookup source and matched field.
Explanation
Correct Answer
D:The planned operation is classify indicators by supported observable type and normalize only as justified without changing the actual security meaning. A meaningful IOC match requires compatible data types and consistent representation.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is IOC type, original value, normalization rule, lookup source and matched field. A meaningful IOC match requires compatible data types and consistent representation.
B:An approved change request without recorded workflow execution. The relevant evidence is IOC type, original value, normalization rule, lookup source and matched field. A meaningful IOC match requires compatible data types and consistent representation.
C:A connector icon without authorization or current API response. The relevant evidence is IOC type, original value, normalization rule, lookup source and matched field. A meaningful IOC match requires compatible data types and consistent representation.
Question 783
A file hash indicator is mistakenly compared against destination IP text and never matches. Which platform statement is MOST accurate for this scenario?
- Every IOC match is confirmed active malware compromise.
- A saved playbook without an eligible trigger automatically performs all tasks.
- A connector listed in inventory always has valid permissions and network reachability.
- A meaningful IOC match requires compatible data types and consistent representation.
Explanation
Correct Answer
D:This is why classify indicators by supported observable type and normalize only as justified without changing the actual security meaning. Verification depends on IOC type, original value, normalization rule, lookup source and matched field.
Incorrect Answers
A:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of indicator type and observable normalization. The relevant behavior is a meaningful IOC match requires compatible data types and consistent representation. Check IOC type, original value, normalization rule, lookup source and matched field.
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of indicator type and observable normalization. The relevant behavior is a meaningful IOC match requires compatible data types and consistent representation. Check IOC type, original value, normalization rule, lookup source and matched field.
C:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of indicator type and observable normalization. The relevant behavior is a meaningful IOC match requires compatible data types and consistent representation. Check IOC type, original value, normalization rule, lookup source and matched field.
Question 784
A file hash indicator is mistakenly compared against destination IP text and never matches. An operator instead chooses this incorrect shortcut: Compare file SHA-256 bytes directly to TCP destination port strings. Which consequence BEST explains the flaw in the proposed change?
- The only effect is a cosmetic incident title change.
- An approved narrow connector scope caused every unrelated Internet outage.
- Type mismatches cause missed detections or misleading false matches.
- Preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
C:The intended preventive choice is classify indicators by supported observable type and normalize only as justified without changing the actual security meaning. A meaningful IOC match requires compatible data types and consistent representation.
Incorrect Answers
A:This does not account for the actual indicator type and observable normalization weakness. The more relevant failure is type mismatches cause missed detections or misleading false matches.
B:This does not account for the actual indicator type and observable normalization weakness. Confirm with IOC type, original value, normalization rule, lookup source and matched field.
D:This does not account for the actual indicator type and observable normalization weakness. In this specific situation, a file hash indicator is mistakenly compared against destination IP text and never matches.
Question 785
A file hash indicator is mistakenly compared against destination IP text and never matches. The observed fault is: Type mismatches cause missed detections or misleading false matches. Which remediation best corrects the root cause?
- Replace every URL indicator with a random resolved IP without context.
- Correct indicator classification and test on representative known values.
- Assume all indicator strings are semantically identical across field types.
- Compare file SHA-256 bytes directly to TCP destination port strings.
Explanation
Correct Answer
B:This fixes the described operational problem with observable validation. A meaningful IOC match requires compatible data types and consistent representation.
Incorrect Answers
A:Replace every URL indicator with a random resolved IP without context. Type mismatches cause missed detections or misleading false matches. Instead, correct indicator classification and test on representative known values.
C:Assume all indicator strings are semantically identical across field types. Type mismatches cause missed detections or misleading false matches. Instead, correct indicator classification and test on representative known values.
D:Compare file SHA-256 bytes directly to TCP destination port strings. Type mismatches cause missed detections or misleading false matches. Instead, correct indicator classification and test on representative known values.
Question 786
A domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, replace every URL indicator with a random resolved IP without context.
- For this FortiAnalyzer investigation, assume all indicator strings are semantically identical across field types.
- For this FortiAnalyzer investigation, classify indicators by supported observable type and normalize only as justified without changing the actual security meaning.
- For this FortiAnalyzer investigation, compare file SHA-256 bytes directly to TCP destination port strings.
Explanation
Correct Answer
C:A meaningful IOC match requires compatible data types and consistent representation. Verify using IOC type, original value, normalization rule, lookup source and matched field.
Incorrect Answers
A:Replace every URL indicator with a random resolved IP without context. A meaningful IOC match requires compatible data types and consistent representation. Relevant observations are IOC type, original value, normalization rule, lookup source and matched field.
B:Type mismatches cause missed detections or misleading false matches. In this specific situation, a domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact.
D:Type mismatches cause missed detections or misleading false matches. This change does not provide the specified control.
Question 787
A domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is an unrelated incident status with no matching event or task audit.
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is IOC type, original value, normalization rule, lookup source and matched field.
- The supporting evidence is an approved change request without recorded workflow execution.
Explanation
Correct Answer
C:The planned operation is classify indicators by supported observable type and normalize only as justified without changing the actual security meaning. These observations directly test indicator type and observable normalization under the actual system state.
Incorrect Answers
A:An unrelated incident status with no matching event or task audit. The relevant evidence is IOC type, original value, normalization rule, lookup source and matched field. A meaningful IOC match requires compatible data types and consistent representation.
B:A severity label without source evidence and affected asset identity. The relevant evidence is IOC type, original value, normalization rule, lookup source and matched field. A meaningful IOC match requires compatible data types and consistent representation.
D:An approved change request without recorded workflow execution. The relevant evidence is IOC type, original value, normalization rule, lookup source and matched field. A meaningful IOC match requires compatible data types and consistent representation.
Question 788
A domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact. Which implementation principle supports the intended approach?
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
- The governing concept is that a meaningful IOC match requires compatible data types and consistent representation.
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
Explanation
Correct Answer
B:This is why classify indicators by supported observable type and normalize only as justified without changing the actual security meaning.
Incorrect Answers
A:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of indicator type and observable normalization. The relevant behavior is a meaningful IOC match requires compatible data types and consistent representation. Check IOC type, original value, normalization rule, lookup source and matched field.
C:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of indicator type and observable normalization. The relevant behavior is a meaningful IOC match requires compatible data types and consistent representation. Check IOC type, original value, normalization rule, lookup source and matched field.
D:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of indicator type and observable normalization. The relevant behavior is a meaningful IOC match requires compatible data types and consistent representation. Check IOC type, original value, normalization rule, lookup source and matched field.
Question 789
A domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact. An operator instead chooses this incorrect shortcut: Compare file SHA-256 bytes directly to TCP destination port strings. What technical weakness does this incorrect change introduce?
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that type mismatches cause missed detections or misleading false matches.
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
Explanation
Correct Answer
B:The intended preventive choice is classify indicators by supported observable type and normalize only as justified without changing the actual security meaning.
Incorrect Answers
A:This does not account for the actual indicator type and observable normalization weakness. In this specific situation, a domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact.
C:This does not account for the actual indicator type and observable normalization weakness. An accurate incident assignment caused the missing log source.
D:This does not account for the actual indicator type and observable normalization weakness. An approved narrow connector scope caused every unrelated Internet outage.
Question 790
A domain IOC arrives in different letter cases and the SOC cannot explain whether the match is exact. The observed fault is: Type mismatches cause missed detections or misleading false matches. What corrective action restores the target behavior with validation?
- The corrective action is to assume all indicator strings are semantically identical across field types.
- The corrective action is to correct indicator classification and test on representative known values.
- The corrective action is to compare file SHA-256 bytes directly to TCP destination port strings.
- The corrective action is to replace every URL indicator with a random resolved IP without context.
Explanation
Correct Answer
B:This fixes the described operational problem with observable validation. Recheck IOC type, original value, normalization rule, lookup source and matched field.
Incorrect Answers
A:Assume all indicator strings are semantically identical across field types. Type mismatches cause missed detections or misleading false matches. Instead, correct indicator classification and test on representative known values.
C:Compare file SHA-256 bytes directly to TCP destination port strings. Type mismatches cause missed detections or misleading false matches. Instead, correct indicator classification and test on representative known values.
D:Replace every URL indicator with a random resolved IP without context. Type mismatches cause missed detections or misleading false matches. Instead, correct indicator classification and test on representative known values.
