Fortinet FCP_FAZ_AN-7.6 Practice Test 93
Question 920
A playbook has parallel tasks and one prerequisite fails while subsequent notification still asserts success. The observed fault is: Ignoring failed tasks can produce false containment claims and leave a threat active. Which controlled recovery BEST addresses this failure?
- The corrective action is to assume a timed-out remote call always completed on the target device.
- The corrective action is to set every task to successful whenever the first step starts.
- The corrective action is to delete error output before an incident reviewer reads it.
- The corrective action is to repair the failure and rerun only approved steps then confirm technical effect.
Explanation
Correct Answer
D:Recheck job ID, task states, connector errors, dependency results and verified device outcome.
Incorrect Answers
A:Assume a timed-out remote call always completed on the target device. Ignoring failed tasks can produce false containment claims and leave a threat active. Instead, repair the failure and rerun only approved steps then confirm technical effect.
B:Set every task to successful whenever the first step starts. Ignoring failed tasks can produce false containment claims and leave a threat active. Instead, repair the failure and rerun only approved steps then confirm technical effect.
C:Delete error output before an incident reviewer reads it. Ignoring failed tasks can produce false containment claims and leave a threat active. Instead, repair the failure and rerun only approved steps then confirm technical effect.
Question 921
An auditor asks who ran a manual containment workflow against a sensitive production system. What is the BEST supported implementation or corrective action?
- Use only the playbook title to prove who executed it.
- Erase failed jobs from the audit trail because they look untidy.
- Review the playbook job history with initiator, timestamps, action arguments and target-side verification.
- Equate an administrator login with a successful playbook run.
Explanation
Correct Answer
C:Verify using job ID, operator identity, trigger, task result, parameter values and remote audit log. This is the targeted correction for playbook execution history and audit trace.
Incorrect Answers
A:A workflow with no preserved history cannot substantiate incident response claims. Use review the playbook job history with initiator, timestamps, action arguments and target-side verification.
B:Erase failed jobs from the audit trail because they look untidy. Playbook audit evidence links authorization and intended action to observed execution. Relevant observations are job ID, operator identity, trigger, task result, parameter values and remote audit log.
D:A workflow with no preserved history cannot substantiate incident response claims. The supported correction is review the playbook job history with initiator, timestamps, action arguments and target-side verification.
Question 922
An auditor asks who ran a manual containment workflow against a sensitive production system. Which diagnostic evidence BEST verifies the intended outcome?
- Job ID, operator identity, trigger, task result, parameter values and remote audit log.
- An automation playbook name with no job history or target outcome.
- A connector icon without authorization or current API response.
- An unrelated incident status with no matching event or task audit.
Explanation
Correct Answer
A:These observations directly test playbook execution history and audit trace under the actual system state. Playbook audit evidence links authorization and intended action to observed execution.
Incorrect Answers
B:An automation playbook name with no job history or target outcome. The relevant evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
C:A connector icon without authorization or current API response. The relevant evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
D:An unrelated incident status with no matching event or task audit. The relevant evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
Question 923
An auditor asks who ran a manual containment workflow against a sensitive production system. Which technical principle BEST explains this result?
- Playbook audit evidence links authorization and intended action to observed execution.
- A saved playbook without an eligible trigger automatically performs all tasks.
- An incident marked resolved proves a remote firewall policy change succeeded.
- A delivered notification email always means the remote endpoint was quarantined.
Explanation
Correct Answer
A:Verification depends on job ID, operator identity, trigger, task result, parameter values and remote audit log. This is why review the playbook job history with initiator, timestamps, action arguments and target-side verification.
Incorrect Answers
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of playbook execution history and audit trace. The relevant behavior is playbook audit evidence links authorization and intended action to observed execution. Check job ID, operator identity, trigger, task result, parameter values and remote audit log.
C:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of playbook execution history and audit trace. The relevant behavior is playbook audit evidence links authorization and intended action to observed execution. Check job ID, operator identity, trigger, task result, parameter values and remote audit log.
D:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of playbook execution history and audit trace. The relevant behavior is playbook audit evidence links authorization and intended action to observed execution. Check job ID, operator identity, trigger, task result, parameter values and remote audit log.
Question 924
An auditor asks who ran a manual containment workflow against a sensitive production system. An operator instead chooses this incorrect shortcut: Use only the playbook title to prove who executed it. What material failure follows from the mistaken shortcut?
- A workflow with no preserved history cannot substantiate incident response claims.
- An accurate incident assignment caused the missing log source.
- Reviewing the playbook job result caused the original malicious event.
- The only effect is a cosmetic incident title change.
Explanation
Correct Answer
A:The intended preventive choice is review the playbook job history with initiator, timestamps, action arguments and target-side verification. Playbook audit evidence links authorization and intended action to observed execution.
Incorrect Answers
B:This does not account for the actual playbook execution history and audit trace weakness. The more relevant failure is a workflow with no preserved history cannot substantiate incident response claims.
C:This does not account for the actual playbook execution history and audit trace weakness. Confirm with job ID, operator identity, trigger, task result, parameter values and remote audit log.
D:This does not account for the actual playbook execution history and audit trace weakness. The only effect is a cosmetic incident title change.
Question 925
An auditor asks who ran a manual containment workflow against a sensitive production system. The observed fault is: A workflow with no preserved history cannot substantiate incident response claims. Which controlled recovery BEST addresses this failure?
- Erase failed jobs from the audit trail because they look untidy.
- Equate an administrator login with a successful playbook run.
- Reconcile job and device audit logs and retain required evidence.
- Use only the playbook title to prove who executed it.
Explanation
Correct Answer
C:This fixes the described operational problem with observable validation. Playbook audit evidence links authorization and intended action to observed execution.
Incorrect Answers
A:Erase failed jobs from the audit trail because they look untidy. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
B:Equate an administrator login with a successful playbook run. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
D:Use only the playbook title to prove who executed it. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
Question 926
An SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email. Which configuration decision most directly resolves this situation?
- For this FortiAnalyzer investigation, review the playbook job history with initiator, timestamps, action arguments and target-side verification.
- For this FortiAnalyzer investigation, erase failed jobs from the audit trail because they look untidy.
- For this FortiAnalyzer investigation, equate an administrator login with a successful playbook run.
- For this FortiAnalyzer investigation, use only the playbook title to prove who executed it.
Explanation
Correct Answer
A:Verify using job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
Incorrect Answers
B:Erase failed jobs from the audit trail because they look untidy. Playbook audit evidence links authorization and intended action to observed execution. Relevant observations are job ID, operator identity, trigger, task result, parameter values and remote audit log.
C:A workflow with no preserved history cannot substantiate incident response claims. In this specific situation, an SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email.
D:A workflow with no preserved history cannot substantiate incident response claims. Use only the playbook title to prove who executed it.
Question 927
An SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email. What evidence most strongly confirms the operational condition?
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log.
- The supporting evidence is an automation playbook name with no job history or target outcome.
- The supporting evidence is a connector icon without authorization or current API response.
Explanation
Correct Answer
B:These observations directly test playbook execution history and audit trace under the actual system state. The planned operation is review the playbook job history with initiator, timestamps, action arguments and target-side verification.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
C:An automation playbook name with no job history or target outcome. The relevant evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
D:A connector icon without authorization or current API response. The relevant evidence is job ID, operator identity, trigger, task result, parameter values and remote audit log. Playbook audit evidence links authorization and intended action to observed execution.
Question 928
An SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email. What FortiAnalyzer behavior explains the correct decision?
- The governing concept is that playbook audit evidence links authorization and intended action to observed execution.
- The governing concept is that a delivered notification email always means the remote endpoint was quarantined.
- The governing concept is that a saved playbook without an eligible trigger automatically performs all tasks.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
Explanation
Correct Answer
A:Verification depends on job ID, operator identity, trigger, task result, parameter values and remote audit log.
Incorrect Answers
B:A delivered notification email always means the remote endpoint was quarantined. That generalization is incorrect in the context of playbook execution history and audit trace. The relevant behavior is playbook audit evidence links authorization and intended action to observed execution. Check job ID, operator identity, trigger, task result, parameter values and remote audit log.
C:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of playbook execution history and audit trace. The relevant behavior is playbook audit evidence links authorization and intended action to observed execution. Check job ID, operator identity, trigger, task result, parameter values and remote audit log.
D:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of playbook execution history and audit trace. The relevant behavior is playbook audit evidence links authorization and intended action to observed execution. Check job ID, operator identity, trigger, task result, parameter values and remote audit log.
Question 929
An SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email. An operator instead chooses this incorrect shortcut: Use only the playbook title to prove who executed it. Which resulting risk should the reviewer identify?
- The material failure is that the only effect is a cosmetic incident title change.
- The material failure is that a workflow with no preserved history cannot substantiate incident response claims.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
- The material failure is that reviewing the playbook job result caused the original malicious event.
Explanation
Correct Answer
B:The intended preventive choice is review the playbook job history with initiator, timestamps, action arguments and target-side verification. In this specific situation, an SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email.
Incorrect Answers
A:This does not account for the actual playbook execution history and audit trace weakness. In this specific situation, an SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email.
C:This does not account for the actual playbook execution history and audit trace weakness. An approved narrow connector scope caused every unrelated Internet outage.
D:This does not account for the actual playbook execution history and audit trace weakness. Reviewing the playbook job result caused the original malicious event.
Question 930
An SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email. The observed fault is: A workflow with no preserved history cannot substantiate incident response claims. How should the administrator restore and verify the intended state?
- The corrective action is to reconcile job and device audit logs and retain required evidence.
- The corrective action is to equate an administrator login with a successful playbook run.
- The corrective action is to use only the playbook title to prove who executed it.
- The corrective action is to erase failed jobs from the audit trail because they look untidy.
Explanation
Correct Answer
A:Recheck job ID, operator identity, trigger, task result, parameter values and remote audit log.
Incorrect Answers
B:Equate an administrator login with a successful playbook run. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
C:Use only the playbook title to prove who executed it. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
D:Erase failed jobs from the audit trail because they look untidy. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
