Fortinet FCP_FAZ_AN-7.6 Practice Test 87
Question 860
A SOC analyst sees a local notification succeed and assumes the perimeter firewall also blocked the IP. The observed fault is: Successful local task execution does not guarantee a FortiGate rule or object was changed. Which remediation best corrects the root cause?
- The corrective action is to use a green playbook icon instead of verifying the remote policy.
- The corrective action is to assume a local log annotation automatically edits FortiGate firewall policy.
- The corrective action is to configure and authorize the appropriate connector and verify actual device-side action.
- The corrective action is to provide a random FortiGate address without an authenticated connector.
Explanation
Correct Answer
C:Recheck connector type, device credentials, FortiOS task action, remote audit and policy or address result. Local playbook actions and remote Security Fabric device actions have different execution boundaries.
Incorrect Answers
A:Use a green playbook icon instead of verifying the remote policy. Successful local task execution does not guarantee a FortiGate rule or object was changed. Instead, configure and authorize the appropriate connector and verify actual device-side action.
B:Assume a local log annotation automatically edits FortiGate firewall policy. Successful local task execution does not guarantee a FortiGate rule or object was changed. Instead, configure and authorize the appropriate connector and verify actual device-side action.
D:Provide a random FortiGate address without an authenticated connector. Successful local task execution does not guarantee a FortiGate rule or object was changed. Instead, configure and authorize the appropriate connector and verify actual device-side action.
Question 861
An automation connector uses an administrator account with unrestricted privileges for a simple IOC lookup. Which administrator action meets the documented requirement?
- Store API tokens in public incident comments for convenient troubleshooting.
- Configure connector credentials with least required privileges and secure rotation while validating access.
- Give every connector global super admin without task analysis.
- Disable authentication to avoid expired credentials.
Explanation
Correct Answer
B:Connector actions depend on suitable authorization and secret lifecycle management. This is the targeted correction for connector credential scope and secret handling.
Incorrect Answers
A:Overprivileged or expired connector credentials create compromise risk and failed responses. Use configure connector credentials with least required privileges and secure rotation while validating access.
C:Give every connector global super admin without task analysis. Connector actions depend on suitable authorization and secret lifecycle management. Relevant observations are credential scope, API authorization error, secret storage, rotation log and action test.
D:Overprivileged or expired connector credentials create compromise risk and failed responses. The supported correction is configure connector credentials with least required privileges and secure rotation while validating access.
Question 862
An automation connector uses an administrator account with unrestricted privileges for a simple IOC lookup. Which observations should the engineer inspect before declaring success?
- An approved change request without recorded workflow execution.
- An unrelated incident status with no matching event or task audit.
- A severity label without source evidence and affected asset identity.
- Credential scope, API authorization error, secret storage, rotation log and action test.
Explanation
Correct Answer
D:The planned operation is configure connector credentials with least required privileges and secure rotation while validating access. Connector actions depend on suitable authorization and secret lifecycle management.
Incorrect Answers
A:An approved change request without recorded workflow execution. The relevant evidence is credential scope, API authorization error, secret storage, rotation log and action test. Connector actions depend on suitable authorization and secret lifecycle management.
B:An unrelated incident status with no matching event or task audit. The relevant evidence is credential scope, API authorization error, secret storage, rotation log and action test. Connector actions depend on suitable authorization and secret lifecycle management.
C:A severity label without source evidence and affected asset identity. The relevant evidence is credential scope, API authorization error, secret storage, rotation log and action test. Connector actions depend on suitable authorization and secret lifecycle management.
Question 863
An automation connector uses an administrator account with unrestricted privileges for a simple IOC lookup. Which platform statement is MOST accurate for this scenario?
- Connector actions depend on suitable authorization and secret lifecycle management.
- An incident marked resolved proves a remote firewall policy change succeeded.
- A connector listed in inventory always has valid permissions and network reachability.
- Every IOC match is confirmed active malware compromise.
Explanation
Correct Answer
A:This is why configure connector credentials with least required privileges and secure rotation while validating access. Verification depends on credential scope, API authorization error, secret storage, rotation log and action test.
Incorrect Answers
B:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of connector credential scope and secret handling. The relevant behavior is connector actions depend on suitable authorization and secret lifecycle management. Check credential scope, API authorization error, secret storage, rotation log and action test.
C:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of connector credential scope and secret handling. The relevant behavior is connector actions depend on suitable authorization and secret lifecycle management. Check credential scope, API authorization error, secret storage, rotation log and action test.
D:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of connector credential scope and secret handling. The relevant behavior is connector actions depend on suitable authorization and secret lifecycle management. Check credential scope, API authorization error, secret storage, rotation log and action test.
Question 864
An automation connector uses an administrator account with unrestricted privileges for a simple IOC lookup. An operator instead chooses this incorrect shortcut: Store API tokens in public incident comments for convenient troubleshooting. Which consequence BEST explains the flaw in the proposed change?
- Overprivileged or expired connector credentials create compromise risk and failed responses.
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
- An accurate incident assignment caused the missing log source.
Explanation
Correct Answer
A:The intended preventive choice is configure connector credentials with least required privileges and secure rotation while validating access. Connector actions depend on suitable authorization and secret lifecycle management.
Incorrect Answers
B:This does not account for the actual connector credential scope and secret handling weakness. The more relevant failure is overprivileged or expired connector credentials create compromise risk and failed responses.
C:This does not account for the actual connector credential scope and secret handling weakness. Confirm with credential scope, API authorization error, secret storage, rotation log and action test.
D:This does not account for the actual connector credential scope and secret handling weakness. An accurate incident assignment caused the missing log source.
Question 865
An automation connector uses an administrator account with unrestricted privileges for a simple IOC lookup. The observed fault is: Overprivileged or expired connector credentials create compromise risk and failed responses. Which remediation best corrects the root cause?
- Rotate or rescope credentials and retest approved and denied actions.
- Give every connector global super admin without task analysis.
- Disable authentication to avoid expired credentials.
- Store API tokens in public incident comments for convenient troubleshooting.
Explanation
Correct Answer
A:This fixes the described operational problem with observable validation. Connector actions depend on suitable authorization and secret lifecycle management.
Incorrect Answers
B:Give every connector global super admin without task analysis. Overprivileged or expired connector credentials create compromise risk and failed responses. Instead, rotate or rescope credentials and retest approved and denied actions.
C:Disable authentication to avoid expired credentials. Overprivileged or expired connector credentials create compromise risk and failed responses. Instead, rotate or rescope credentials and retest approved and denied actions.
D:Store API tokens in public incident comments for convenient troubleshooting. Overprivileged or expired connector credentials create compromise risk and failed responses. Instead, rotate or rescope credentials and retest approved and denied actions.
Question 866
A playbook suddenly fails after an API credential expires and security staff propose storing the password in logs. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, configure connector credentials with least required privileges and secure rotation while validating access.
- For this FortiAnalyzer investigation, give every connector global super admin without task analysis.
- For this FortiAnalyzer investigation, disable authentication to avoid expired credentials.
- For this FortiAnalyzer investigation, store API tokens in public incident comments for convenient troubleshooting.
Explanation
Correct Answer
A:Connector actions depend on suitable authorization and secret lifecycle management. Verify using credential scope, API authorization error, secret storage, rotation log and action test.
Incorrect Answers
B:Give every connector global super admin without task analysis. Connector actions depend on suitable authorization and secret lifecycle management. Relevant observations are credential scope, API authorization error, secret storage, rotation log and action test.
C:Overprivileged or expired connector credentials create compromise risk and failed responses. In this specific situation, a playbook suddenly fails after an API credential expires and security staff propose storing the password in logs.
D:Overprivileged or expired connector credentials create compromise risk and failed responses. This change does not provide the specified control.
Question 867
A playbook suddenly fails after an API credential expires and security staff propose storing the password in logs. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is an approved change request without recorded workflow execution.
- The supporting evidence is credential scope, API authorization error, secret storage, rotation log and action test.
- The supporting evidence is an unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
C:The planned operation is configure connector credentials with least required privileges and secure rotation while validating access. These observations directly test connector credential scope and secret handling under the actual system state.
Incorrect Answers
A:An automation playbook name with no job history or target outcome. The relevant evidence is credential scope, API authorization error, secret storage, rotation log and action test. Connector actions depend on suitable authorization and secret lifecycle management.
B:An approved change request without recorded workflow execution. The relevant evidence is credential scope, API authorization error, secret storage, rotation log and action test. Connector actions depend on suitable authorization and secret lifecycle management.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is credential scope, API authorization error, secret storage, rotation log and action test. Connector actions depend on suitable authorization and secret lifecycle management.
Question 868
A playbook suddenly fails after an API credential expires and security staff propose storing the password in logs. Which implementation principle supports the intended approach?
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
- The governing concept is that connector actions depend on suitable authorization and secret lifecycle management.
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
C:This is why configure connector credentials with least required privileges and secure rotation while validating access.
Incorrect Answers
A:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of connector credential scope and secret handling. The relevant behavior is connector actions depend on suitable authorization and secret lifecycle management. Check credential scope, API authorization error, secret storage, rotation log and action test.
B:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of connector credential scope and secret handling. The relevant behavior is connector actions depend on suitable authorization and secret lifecycle management. Check credential scope, API authorization error, secret storage, rotation log and action test.
D:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of connector credential scope and secret handling. The relevant behavior is connector actions depend on suitable authorization and secret lifecycle management. Check credential scope, API authorization error, secret storage, rotation log and action test.
Question 869
A playbook suddenly fails after an API credential expires and security staff propose storing the password in logs. An operator instead chooses this incorrect shortcut: Store API tokens in public incident comments for convenient troubleshooting. What technical weakness does this incorrect change introduce?
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that reviewing the playbook job result caused the original malicious event.
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that overprivileged or expired connector credentials create compromise risk and failed responses.
Explanation
Correct Answer
D:The intended preventive choice is configure connector credentials with least required privileges and secure rotation while validating access.
Incorrect Answers
A:This does not account for the actual connector credential scope and secret handling weakness. In this specific situation, a playbook suddenly fails after an API credential expires and security staff propose storing the password in logs.
B:This does not account for the actual connector credential scope and secret handling weakness. Reviewing the playbook job result caused the original malicious event.
C:This does not account for the actual connector credential scope and secret handling weakness. Preserving the task audit trail created all earlier endpoint infections.
Question 870
A playbook suddenly fails after an API credential expires and security staff propose storing the password in logs. The observed fault is: Overprivileged or expired connector credentials create compromise risk and failed responses. What corrective action restores the target behavior with validation?
- The corrective action is to rotate or rescope credentials and retest approved and denied actions.
- The corrective action is to disable authentication to avoid expired credentials.
- The corrective action is to store API tokens in public incident comments for convenient troubleshooting.
- The corrective action is to give every connector global super admin without task analysis.
Explanation
Correct Answer
A:Recheck credential scope, API authorization error, secret storage, rotation log and action test.
Incorrect Answers
B:Disable authentication to avoid expired credentials. Overprivileged or expired connector credentials create compromise risk and failed responses. Instead, rotate or rescope credentials and retest approved and denied actions.
C:Store API tokens in public incident comments for convenient troubleshooting. Overprivileged or expired connector credentials create compromise risk and failed responses. Instead, rotate or rescope credentials and retest approved and denied actions.
D:Give every connector global super admin without task analysis. Overprivileged or expired connector credentials create compromise risk and failed responses. Instead, rotate or rescope credentials and retest approved and denied actions.
