Fortinet FCP_FAZ_AN-7.6 Practice Test 82
Question 810
A threat feed marks a domain risky but independent sources conflict about its present use. The observed fault is: Uncorroborated enrichment can turn benign hosted services into false positives. How should the administrator restore and verify the intended state?
- The corrective action is to delete conflicting evidence to make the threat label unanimous.
- The corrective action is to treat a single unverified feed score as automatic proof of data theft.
- The corrective action is to assess source freshness and local event evidence and document uncertainty.
- The corrective action is to ignore the lookup timestamp when recording the IOC.
Explanation
Correct Answer
C:Threat intelligence improves context but a reputation label alone is not definitive evidence of successful attack. Recheck external feed result, reputation timestamp, observed local behavior, source reliability and matched events.
Incorrect Answers
A:Delete conflicting evidence to make the threat label unanimous. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
B:Treat a single unverified feed score as automatic proof of data theft. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
D:Ignore the lookup timestamp when recording the IOC. Uncorroborated enrichment can turn benign hosted services into false positives. Instead, assess source freshness and local event evidence and document uncertainty.
Question 811
Two event handlers create separate cases for the same endpoint and same observed event series. Which configuration decision most directly resolves this situation?
- Merge only incidents with established shared entity and chronology while retaining all source links and original IDs.
- Merge every incident with the same severity regardless of assets.
- Delete one case and all its only-existing raw references.
- Assume matching incident titles prove exact source-event equivalence.
Explanation
Correct Answer
A:Verify using Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. This is the targeted correction for Incident duplicate merging with retained provenance.
Incorrect Answers
B:Merging unrelated incidents can hide distinct attack paths and remediation tasks. Use merge only incidents with established shared entity and chronology while retaining all source links and original IDs.
C:Delete one case and all its only-existing raw references. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Relevant observations are Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
D:Merging unrelated incidents can hide distinct attack paths and remediation tasks. The supported correction is merge only incidents with established shared entity and chronology while retaining all source links and original IDs.
Question 812
Two event handlers create separate cases for the same endpoint and same observed event series. What evidence most strongly confirms the operational condition?
- An approved change request without recorded workflow execution.
- An unrelated incident status with no matching event or task audit.
- Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
- A severity label without source evidence and affected asset identity.
Explanation
Correct Answer
C:The planned operation is merge only incidents with established shared entity and chronology while retaining all source links and original IDs. These observations directly test Incident duplicate merging with retained provenance under the actual system state.
Incorrect Answers
A:An approved change request without recorded workflow execution. The relevant evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
B:An unrelated incident status with no matching event or task audit. The relevant evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
D:A severity label without source evidence and affected asset identity. The relevant evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
Question 813
Two event handlers create separate cases for the same endpoint and same observed event series. What FortiAnalyzer behavior explains the correct decision?
- An incident marked resolved proves a remote firewall policy change succeeded.
- Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
- A connector listed in inventory always has valid permissions and network reachability.
- Every IOC match is confirmed active malware compromise.
Explanation
Correct Answer
B:This is why merge only incidents with established shared entity and chronology while retaining all source links and original IDs. Verification depends on Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
Incorrect Answers
A:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of Incident duplicate merging with retained provenance. The relevant behavior is Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Check Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
C:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of Incident duplicate merging with retained provenance. The relevant behavior is Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Check Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
D:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of Incident duplicate merging with retained provenance. The relevant behavior is Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Check Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
Question 814
Two event handlers create separate cases for the same endpoint and same observed event series. An operator instead chooses this incorrect shortcut: Merge every incident with the same severity regardless of assets. Which resulting risk should the reviewer identify?
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
- An accurate incident assignment caused the missing log source.
- Merging unrelated incidents can hide distinct attack paths and remediation tasks.
Explanation
Correct Answer
D:The intended preventive choice is merge only incidents with established shared entity and chronology while retaining all source links and original IDs. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
Incorrect Answers
A:This does not account for the actual Incident duplicate merging with retained provenance weakness. The more relevant failure is merging unrelated incidents can hide distinct attack paths and remediation tasks.
B:This does not account for the actual Incident duplicate merging with retained provenance weakness. Confirm with Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
C:This does not account for the actual Incident duplicate merging with retained provenance weakness. An accurate incident assignment caused the missing log source.
Question 815
Two event handlers create separate cases for the same endpoint and same observed event series. The observed fault is: Merging unrelated incidents can hide distinct attack paths and remediation tasks. How should the administrator restore and verify the intended state?
- Delete one case and all its only-existing raw references.
- Assume matching incident titles prove exact source-event equivalence.
- Merge every incident with the same severity regardless of assets.
- Reconcile identities and chronology, merge supported duplicates and keep audit references.
Explanation
Correct Answer
D:Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
Incorrect Answers
A:Delete one case and all its only-existing raw references. Merging unrelated incidents can hide distinct attack paths and remediation tasks. Instead, reconcile identities and chronology, merge supported duplicates and keep audit references.
B:Assume matching incident titles prove exact source-event equivalence. Merging unrelated incidents can hide distinct attack paths and remediation tasks. Instead, reconcile identities and chronology, merge supported duplicates and keep audit references.
C:Merge every incident with the same severity regardless of assets. Merging unrelated incidents can hide distinct attack paths and remediation tasks. Instead, reconcile identities and chronology, merge supported duplicates and keep audit references.
Question 816
A SOC wants to combine related alerts while preserving that a different host may require another investigation. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, delete one case and all its only-existing raw references.
- For this FortiAnalyzer investigation, merge only incidents with established shared entity and chronology while retaining all source links and original IDs.
- For this FortiAnalyzer investigation, assume matching incident titles prove exact source-event equivalence.
- For this FortiAnalyzer investigation, merge every incident with the same severity regardless of assets.
Explanation
Correct Answer
B:Verify using Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
Incorrect Answers
A:Delete one case and all its only-existing raw references. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Relevant observations are Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
C:Merging unrelated incidents can hide distinct attack paths and remediation tasks. In this specific situation, a SOC wants to combine related alerts while preserving that a different host may require another investigation.
D:Merging unrelated incidents can hide distinct attack paths and remediation tasks. This change does not provide the specified control.
Question 817
A SOC wants to combine related alerts while preserving that a different host may require another investigation. Which observations should the engineer inspect before declaring success?
- The supporting evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is an approved change request without recorded workflow execution.
- The supporting evidence is an unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
A:The planned operation is merge only incidents with established shared entity and chronology while retaining all source links and original IDs. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
Incorrect Answers
B:An automation playbook name with no job history or target outcome. The relevant evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
C:An approved change request without recorded workflow execution. The relevant evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links. Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
Question 818
A SOC wants to combine related alerts while preserving that a different host may require another investigation. Which platform statement is MOST accurate for this scenario?
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
B:This is why merge only incidents with established shared entity and chronology while retaining all source links and original IDs.
Incorrect Answers
A:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of Incident duplicate merging with retained provenance. The relevant behavior is Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Check Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
C:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of Incident duplicate merging with retained provenance. The relevant behavior is Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Check Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
D:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of Incident duplicate merging with retained provenance. The relevant behavior is Incident deduplication is an evidentiary relationship decision and should preserve investigation lineage. Check Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
Question 819
A SOC wants to combine related alerts while preserving that a different host may require another investigation. An operator instead chooses this incorrect shortcut: Merge every incident with the same severity regardless of assets. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that reviewing the playbook job result caused the original malicious event.
- The material failure is that merging unrelated incidents can hide distinct attack paths and remediation tasks.
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
C:The intended preventive choice is merge only incidents with established shared entity and chronology while retaining all source links and original IDs.
Incorrect Answers
A:This does not account for the actual Incident duplicate merging with retained provenance weakness.
B:This does not account for the actual Incident duplicate merging with retained provenance weakness. Reviewing the playbook job result caused the original malicious event.
D:This does not account for the actual Incident duplicate merging with retained provenance weakness. Preserving the task audit trail created all earlier endpoint infections.
Question 820
A SOC wants to combine related alerts while preserving that a different host may require another investigation. The observed fault is: Merging unrelated incidents can hide distinct attack paths and remediation tasks. Which remediation best corrects the root cause?
- The corrective action is to reconcile identities and chronology, merge supported duplicates and keep audit references.
- The corrective action is to assume matching incident titles prove exact source-event equivalence.
- The corrective action is to merge every incident with the same severity regardless of assets.
- The corrective action is to delete one case and all its only-existing raw references.
Explanation
Correct Answer
A:Recheck Incident entity mapping, event IDs, duplicate criteria, audit history and resulting case links.
Incorrect Answers
B:Assume matching incident titles prove exact source-event equivalence. Merging unrelated incidents can hide distinct attack paths and remediation tasks. Instead, reconcile identities and chronology, merge supported duplicates and keep audit references.
C:Merge every incident with the same severity regardless of assets. Merging unrelated incidents can hide distinct attack paths and remediation tasks. Instead, reconcile identities and chronology, merge supported duplicates and keep audit references.
D:Delete one case and all its only-existing raw references. Merging unrelated incidents can hide distinct attack paths and remediation tasks. Instead, reconcile identities and chronology, merge supported duplicates and keep audit references.
