Fortinet FCP_FAZ_AN-7.6 Practice Test 89
Question 880
A fabric automation connector reports offline after a network route change despite correct credentials. The observed fault is: A visible connector object can still fail due to disabled state or network transport. Which controlled recovery BEST addresses this failure?
- The corrective action is to change the playbook name instead of testing endpoint reachability.
- The corrective action is to restore connector connectivity or credentials and verify a harmless test call.
- The corrective action is to assume listing a connector in the GUI proves all remote actions will succeed.
- The corrective action is to turn off TLS verification permanently to conceal a wrong certificate.
Explanation
Correct Answer
B:Recheck connector enabled state, endpoint route, TLS handshake, API response and task output.
Incorrect Answers
A:Change the playbook name instead of testing endpoint reachability. A visible connector object can still fail due to disabled state or network transport. Instead, restore connector connectivity or credentials and verify a harmless test call.
C:Assume listing a connector in the GUI proves all remote actions will succeed. A visible connector object can still fail due to disabled state or network transport. Instead, restore connector connectivity or credentials and verify a harmless test call.
D:Turn off TLS verification permanently to conceal a wrong certificate. A visible connector object can still fail due to disabled state or network transport. Instead, restore connector connectivity or credentials and verify a harmless test call.
Question 881
A block-IP task receives a user display name instead of the suspected attacker's IP address. What is the BEST supported implementation or corrective action?
- Map every action parameter to the incident title rather than its typed observable.
- Ignore malformed payload errors and declare response success.
- Substitute a date field for a destination IP because both are strings.
- Map the intended incident or event field into the action parameter with type validation.
Explanation
Correct Answer
D:Automation correctness requires compatible parameters carried from source context to connector actions. This is the targeted correction for playbook action parameter mapping from incident context.
Incorrect Answers
A:Incorrect field mapping can block the wrong address or silently fail validation. Use map the intended incident or event field into the action parameter with type validation.
B:Ignore malformed payload errors and declare response success. Automation correctness requires compatible parameters carried from source context to connector actions. Relevant observations are trigger payload, variable mapping, destination action schema and job trace.
C:Incorrect field mapping can block the wrong address or silently fail validation. The supported correction is map the intended incident or event field into the action parameter with type validation.
Question 882
A block-IP task receives a user display name instead of the suspected attacker's IP address. Which diagnostic evidence BEST verifies the intended outcome?
- Trigger payload, variable mapping, destination action schema and job trace.
- A severity label without source evidence and affected asset identity.
- An approved change request without recorded workflow execution.
- A connector icon without authorization or current API response.
Explanation
Correct Answer
A:These observations directly test playbook action parameter mapping from incident context under the actual system state. Automation correctness requires compatible parameters carried from source context to connector actions.
Incorrect Answers
B:A severity label without source evidence and affected asset identity. The relevant evidence is trigger payload, variable mapping, destination action schema and job trace. Automation correctness requires compatible parameters carried from source context to connector actions.
C:An approved change request without recorded workflow execution. The relevant evidence is trigger payload, variable mapping, destination action schema and job trace. Automation correctness requires compatible parameters carried from source context to connector actions.
D:A connector icon without authorization or current API response. The relevant evidence is trigger payload, variable mapping, destination action schema and job trace. Automation correctness requires compatible parameters carried from source context to connector actions.
Question 883
A block-IP task receives a user display name instead of the suspected attacker's IP address. Which technical principle BEST explains this result?
- Every IOC match is confirmed active malware compromise.
- A saved playbook without an eligible trigger automatically performs all tasks.
- Automation correctness requires compatible parameters carried from source context to connector actions.
- A connector listed in inventory always has valid permissions and network reachability.
Explanation
Correct Answer
C:This is why map the intended incident or event field into the action parameter with type validation. Verification depends on trigger payload, variable mapping, destination action schema and job trace.
Incorrect Answers
A:That generalization is incorrect in the context of playbook action parameter mapping from incident context. The relevant behavior is automation correctness requires compatible parameters carried from source context to connector actions.
B:That generalization is incorrect in the context of playbook action parameter mapping from incident context. Check trigger payload, variable mapping, destination action schema and job trace.
D:That generalization is incorrect in the context of playbook action parameter mapping from incident context.
Question 884
A block-IP task receives a user display name instead of the suspected attacker's IP address. An operator instead chooses this incorrect shortcut: Map every action parameter to the incident title rather than its typed observable. What material failure follows from the mistaken shortcut?
- The only effect is a cosmetic incident title change.
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
- Incorrect field mapping can block the wrong address or silently fail validation.
Explanation
Correct Answer
D:The intended preventive choice is map the intended incident or event field into the action parameter with type validation.
Incorrect Answers
A:This does not account for the actual playbook action parameter mapping from incident context weakness. The more relevant failure is incorrect field mapping can block the wrong address or silently fail validation.
B:This does not account for the actual playbook action parameter mapping from incident context weakness. Confirm with trigger payload, variable mapping, destination action schema and job trace.
C:This does not account for the actual playbook action parameter mapping from incident context weakness.
Question 885
A block-IP task receives a user display name instead of the suspected attacker's IP address. The observed fault is: Incorrect field mapping can block the wrong address or silently fail validation. Which controlled recovery BEST addresses this failure?
- Ignore malformed payload errors and declare response success.
- Substitute a date field for a destination IP because both are strings.
- Map every action parameter to the incident title rather than its typed observable.
- Correct field mapping and test with a known synthetic incident and device result.
Explanation
Correct Answer
D:Automation correctness requires compatible parameters carried from source context to connector actions.
Incorrect Answers
A:Ignore malformed payload errors and declare response success. Incorrect field mapping can block the wrong address or silently fail validation. Instead, correct field mapping and test with a known synthetic incident and device result.
B:Substitute a date field for a destination IP because both are strings. Incorrect field mapping can block the wrong address or silently fail validation. Instead, correct field mapping and test with a known synthetic incident and device result.
C:Map every action parameter to the incident title rather than its typed observable. Incorrect field mapping can block the wrong address or silently fail validation. Instead, correct field mapping and test with a known synthetic incident and device result.
Question 886
A security playbook is triggered by an incident but its downstream connector needs the correct event indicator value. Which configuration decision most directly resolves this situation?
- For this FortiAnalyzer investigation, map the intended incident or event field into the action parameter with type validation.
- For this FortiAnalyzer investigation, ignore malformed payload errors and declare response success.
- For this FortiAnalyzer investigation, substitute a date field for a destination IP because both are strings.
- For this FortiAnalyzer investigation, map every action parameter to the incident title rather than its typed observable.
Explanation
Correct Answer
A:Automation correctness requires compatible parameters carried from source context to connector actions. Verify using trigger payload, variable mapping, destination action schema and job trace.
Incorrect Answers
B:Ignore malformed payload errors and declare response success. Automation correctness requires compatible parameters carried from source context to connector actions. Relevant observations are trigger payload, variable mapping, destination action schema and job trace.
C:Incorrect field mapping can block the wrong address or silently fail validation. Substitute a date field for a destination IP because both are strings.
D:Incorrect field mapping can block the wrong address or silently fail validation. Map every action parameter to the incident title rather than its typed observable.
Question 887
A security playbook is triggered by an incident but its downstream connector needs the correct event indicator value. What evidence most strongly confirms the operational condition?
- The supporting evidence is an unrelated incident status with no matching event or task audit.
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is trigger payload, variable mapping, destination action schema and job trace.
- The supporting evidence is an approved change request without recorded workflow execution.
Explanation
Correct Answer
C:These observations directly test playbook action parameter mapping from incident context under the actual system state. The planned operation is map the intended incident or event field into the action parameter with type validation.
Incorrect Answers
A:An unrelated incident status with no matching event or task audit. The relevant evidence is trigger payload, variable mapping, destination action schema and job trace. Automation correctness requires compatible parameters carried from source context to connector actions.
B:A severity label without source evidence and affected asset identity. The relevant evidence is trigger payload, variable mapping, destination action schema and job trace. Automation correctness requires compatible parameters carried from source context to connector actions.
D:An approved change request without recorded workflow execution. The relevant evidence is trigger payload, variable mapping, destination action schema and job trace. Automation correctness requires compatible parameters carried from source context to connector actions.
Question 888
A security playbook is triggered by an incident but its downstream connector needs the correct event indicator value. What FortiAnalyzer behavior explains the correct decision?
- The governing concept is that automation correctness requires compatible parameters carried from source context to connector actions.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
Explanation
Correct Answer
A:This is why map the intended incident or event field into the action parameter with type validation.
Incorrect Answers
B:That generalization is incorrect in the context of playbook action parameter mapping from incident context.
C:The relevant behavior is automation correctness requires compatible parameters carried from source context to connector actions.
D:That generalization is incorrect in the context of playbook action parameter mapping from incident context. An incident marked resolved proves a remote firewall policy change succeeded.
Question 889
A security playbook is triggered by an incident but its downstream connector needs the correct event indicator value. An operator instead chooses this incorrect shortcut: Map every action parameter to the incident title rather than its typed observable. Which resulting risk should the reviewer identify?
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
- The material failure is that incorrect field mapping can block the wrong address or silently fail validation.
Explanation
Correct Answer
D:Automation correctness requires compatible parameters carried from source context to connector actions. The intended preventive choice is map the intended incident or event field into the action parameter with type validation.
Incorrect Answers
A:This does not account for the actual playbook action parameter mapping from incident context weakness.
B:This does not account for the actual playbook action parameter mapping from incident context weakness. An accurate incident assignment caused the missing log source.
C:This does not account for the actual playbook action parameter mapping from incident context weakness. An approved narrow connector scope caused every unrelated Internet outage.
Question 890
A security playbook is triggered by an incident but its downstream connector needs the correct event indicator value. The observed fault is: Incorrect field mapping can block the wrong address or silently fail validation. How should the administrator restore and verify the intended state?
- The corrective action is to substitute a date field for a destination IP because both are strings.
- The corrective action is to map every action parameter to the incident title rather than its typed observable.
- The corrective action is to ignore malformed payload errors and declare response success.
- The corrective action is to correct field mapping and test with a known synthetic incident and device result.
Explanation
Correct Answer
D:This fixes the described operational problem with observable validation. Recheck trigger payload, variable mapping, destination action schema and job trace.
Incorrect Answers
A:Substitute a date field for a destination IP because both are strings. Incorrect field mapping can block the wrong address or silently fail validation. Instead, correct field mapping and test with a known synthetic incident and device result.
B:Map every action parameter to the incident title rather than its typed observable. Incorrect field mapping can block the wrong address or silently fail validation. Instead, correct field mapping and test with a known synthetic incident and device result.
C:Ignore malformed payload errors and declare response success. Incorrect field mapping can block the wrong address or silently fail validation. Instead, correct field mapping and test with a known synthetic incident and device result.
