Fortinet FCP_FAZ_AN-7.6 Practice Test 81
Question 800
A feed updates the confidence of a hash IOC and analysts need to decide whether to retain automated actions. The observed fault is: Retaining stale indicators indefinitely can increase false positives and unnecessary blocking. Which controlled recovery BEST addresses this failure?
- The corrective action is to suppress every indicator of the same type because one went stale.
- The corrective action is to treat every expired indicator as a current confirmed compromise.
- The corrective action is to review source validity and retire or narrow unsupported indicators while keeping history.
- The corrective action is to never record source or observation time for a feed entry.
Explanation
Correct Answer
C:Recheck indicator record, feed version, update time, confidence, event match and resolution decision.
Incorrect Answers
A:Suppress every indicator of the same type because one went stale. Retaining stale indicators indefinitely can increase false positives and unnecessary blocking. Instead, review source validity and retire or narrow unsupported indicators while keeping history.
B:Treat every expired indicator as a current confirmed compromise. Retaining stale indicators indefinitely can increase false positives and unnecessary blocking. Instead, review source validity and retire or narrow unsupported indicators while keeping history.
D:Never record source or observation time for a feed entry. Retaining stale indicators indefinitely can increase false positives and unnecessary blocking. Instead, review source validity and retire or narrow unsupported indicators while keeping history.
Question 801
An analyst sees a previously unknown destination and wants context before declaring it malicious. What is the BEST supported implementation or corrective action?
- Treat a single unverified feed score as automatic proof of data theft.
- Ignore the lookup timestamp when recording the IOC.
- Delete conflicting evidence to make the threat label unanimous.
- Enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
Explanation
Correct Answer
D:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. This is the targeted correction for indicator enrichment with external threat intelligence.
Incorrect Answers
A:Uncorroborated enrichment can turn benign hosted services into false positives. Use enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
B:Ignore the lookup timestamp when recording the IOC. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Relevant observations are external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
C:Uncorroborated enrichment can turn benign hosted services into false positives. The supported correction is enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
Question 802
An analyst sees a previously unknown destination and wants context before declaring it malicious. Which diagnostic evidence BEST verifies the intended outcome?
- External feed result, reputation timestamp, observed local behavior, source reliability and matched events.
- A connector icon without authorization or current API response.
- A severity label without source evidence and affected asset identity.
- An automation playbook name with no job history or target outcome.
Explanation
Correct Answer
A:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. These observations directly test indicator enrichment with external threat intelligence under the actual system state.
Incorrect Answers
B:A connector icon without authorization or current API response. The relevant evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
C:A severity label without source evidence and affected asset identity. The relevant evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
D:An automation playbook name with no job history or target outcome. The relevant evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
Question 803
An analyst sees a previously unknown destination and wants context before declaring it malicious. Which technical principle BEST explains this result?
- A connector listed in inventory always has valid permissions and network reachability.
- A delivered notification email always means the remote endpoint was quarantined.
- Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
- A saved playbook without an eligible trigger automatically performs all tasks.
Explanation
Correct Answer
C:Verification depends on external feed result, reputation timestamp, observed local behavior, source reliability and matched events. This is why enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
Incorrect Answers
A:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of indicator enrichment with external threat intelligence. The relevant behavior is threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Check external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
B:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of indicator enrichment with external threat intelligence. The relevant behavior is threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Check external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
D:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of indicator enrichment with external threat intelligence. The relevant behavior is threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Check external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
Question 804
An analyst sees a previously unknown destination and wants context before declaring it malicious. An operator instead chooses this incorrect shortcut: Treat a single unverified feed score as automatic proof of data theft. What material failure follows from the mistaken shortcut?
- Reviewing the playbook job result caused the original malicious event.
- The only effect is a cosmetic incident title change.
- Uncorroborated enrichment can turn benign hosted services into false positives.
- An approved narrow connector scope caused every unrelated Internet outage.
Explanation
Correct Answer
C:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. The intended preventive choice is enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
Incorrect Answers
A:This does not account for the actual indicator enrichment with external threat intelligence weakness. The more relevant failure is uncorroborated enrichment can turn benign hosted services into false positives.
B:This does not account for the actual indicator enrichment with external threat intelligence weakness. Confirm with external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
D:This does not account for the actual indicator enrichment with external threat intelligence weakness. An approved narrow connector scope caused every unrelated Internet outage.
Question 805
An analyst sees a previously unknown destination and wants context before declaring it malicious. The observed fault is: Uncorroborated enrichment can turn benign hosted services into false positives. Which controlled recovery BEST addresses this failure?
- Ignore the lookup timestamp when recording the IOC.
- Delete conflicting evidence to make the threat label unanimous.
- Assess source freshness and local event evidence and document uncertainty.
- Treat a single unverified feed score as automatic proof of data theft.
Explanation
Correct Answer
C:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
Incorrect Answers
A:Ignore the lookup timestamp when recording the IOC. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
B:Delete conflicting evidence to make the threat label unanimous. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
D:Treat a single unverified feed score as automatic proof of data theft. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
Question 806
A threat feed marks a domain risky but independent sources conflict about its present use. Which configuration decision most directly resolves this situation?
- For this FortiAnalyzer investigation, ignore the lookup timestamp when recording the IOC.
- For this FortiAnalyzer investigation, enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
- For this FortiAnalyzer investigation, delete conflicting evidence to make the threat label unanimous.
- For this FortiAnalyzer investigation, treat a single unverified feed score as automatic proof of data theft.
Explanation
Correct Answer
B:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Verify using external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
Incorrect Answers
A:Ignore the lookup timestamp when recording the IOC. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Relevant observations are external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
C:Uncorroborated enrichment can turn benign hosted services into false positives. In this specific situation, a threat feed marks a domain risky but independent sources conflict about its present use.
D:Uncorroborated enrichment can turn benign hosted services into false positives. This change does not provide the specified control.
Question 807
A threat feed marks a domain risky but independent sources conflict about its present use. What evidence most strongly confirms the operational condition?
- The supporting evidence is an approved change request without recorded workflow execution.
- The supporting evidence is a connector icon without authorization or current API response.
- The supporting evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
- The supporting evidence is a severity label without source evidence and affected asset identity.
Explanation
Correct Answer
C:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. The planned operation is enrich the indicator with supported reputable sources and corroborate against local logs before changing severity.
Incorrect Answers
A:An approved change request without recorded workflow execution. The relevant evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
B:A connector icon without authorization or current API response. The relevant evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
D:A severity label without source evidence and affected asset identity. The relevant evidence is external feed result, reputation timestamp, observed local behavior, source reliability and matched events. Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
Question 808
A threat feed marks a domain risky but independent sources conflict about its present use. What FortiAnalyzer behavior explains the correct decision?
- The governing concept is that a saved playbook without an eligible trigger automatically performs all tasks.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
- The governing concept is that threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
- The governing concept is that every IOC match is confirmed active malware compromise.
Explanation
Correct Answer
C:Verification depends on external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
Incorrect Answers
A:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of indicator enrichment with external threat intelligence. The relevant behavior is threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Check external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
B:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of indicator enrichment with external threat intelligence. The relevant behavior is threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Check external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
D:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of indicator enrichment with external threat intelligence. The relevant behavior is threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Check external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
Question 809
A threat feed marks a domain risky but independent sources conflict about its present use. An operator instead chooses this incorrect shortcut: Treat a single unverified feed score as automatic proof of data theft. Which resulting risk should the reviewer identify?
- The material failure is that uncorroborated enrichment can turn benign hosted services into false positives.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that the only effect is a cosmetic incident title change.
Explanation
Correct Answer
A:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack.
Incorrect Answers
B:This does not account for the actual indicator enrichment with external threat intelligence weakness.
C:This does not account for the actual indicator enrichment with external threat intelligence weakness. Preserving the task audit trail created all earlier endpoint infections.
D:This does not account for the actual indicator enrichment with external threat intelligence weakness. The only effect is a cosmetic incident title change.
Question 810
A threat feed marks a domain risky but independent sources conflict about its present use. The observed fault is: Uncorroborated enrichment can turn benign hosted services into false positives. How should the administrator restore and verify the intended state?
- The corrective action is to delete conflicting evidence to make the threat label unanimous.
- The corrective action is to treat a single unverified feed score as automatic proof of data theft.
- The corrective action is to assess source freshness and local event evidence and document uncertainty.
- The corrective action is to ignore the lookup timestamp when recording the IOC.
Explanation
Correct Answer
C:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Recheck external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
Incorrect Answers
A:Delete conflicting evidence to make the threat label unanimous. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
B:Treat a single unverified feed score as automatic proof of data theft. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
D:Ignore the lookup timestamp when recording the IOC. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
