Fortinet FCP_FAZ_AN-7.6 Practice Test 94
Question 930
An SOC shift cannot tell whether yesterday's playbook blocked the host or only sent an email. The observed fault is: A workflow with no preserved history cannot substantiate incident response claims. How should the administrator restore and verify the intended state?
- The corrective action is to reconcile job and device audit logs and retain required evidence.
- The corrective action is to equate an administrator login with a successful playbook run.
- The corrective action is to use only the playbook title to prove who executed it.
- The corrective action is to erase failed jobs from the audit trail because they look untidy.
Explanation
Correct Answer
A:Recheck job ID, operator identity, trigger, task result, parameter values and remote audit log.
Incorrect Answers
B:Equate an administrator login with a successful playbook run. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
C:Use only the playbook title to prove who executed it. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
D:Erase failed jobs from the audit trail because they look untidy. A workflow with no preserved history cannot substantiate incident response claims. Instead, reconcile job and device audit logs and retain required evidence.
Question 931
A high-impact playbook changes security policy without any second-person review. Which configuration decision most directly resolves this situation?
- Separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
- Give every tier-one observer permission to edit critical FortiGate policies.
- Skip all containment review because the indicator is present in a feed.
- Disable policy auditing once a playbook is saved.
Explanation
Correct Answer
A:Verify using action risk tier, approval or operator record, playbook version and remote policy audit. This is the targeted correction for approval separation for automated firewall changes.
Incorrect Answers
B:Automatic unreviewed policy changes can cause broad production outages. Use separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
C:Response automation should align execution privilege with business and security risk. Relevant observations are action risk tier, approval or operator record, playbook version and remote policy audit.
D:Automatic unreviewed policy changes can cause broad production outages. The supported correction is separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
Question 932
A high-impact playbook changes security policy without any second-person review. What evidence most strongly confirms the operational condition?
- A severity label without source evidence and affected asset identity.
- An approved change request without recorded workflow execution.
- Action risk tier, approval or operator record, playbook version and remote policy audit.
- A connector icon without authorization or current API response.
Explanation
Correct Answer
C:These observations directly test approval separation for automated firewall changes under the actual system state. Response automation should align execution privilege with business and security risk.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
B:An approved change request without recorded workflow execution. The relevant evidence is action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
D:A connector icon without authorization or current API response. The relevant evidence is action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
Question 933
A high-impact playbook changes security policy without any second-person review. What FortiAnalyzer behavior explains the correct decision?
- Every IOC match is confirmed active malware compromise.
- A saved playbook without an eligible trigger automatically performs all tasks.
- Response automation should align execution privilege with business and security risk.
- A connector listed in inventory always has valid permissions and network reachability.
Explanation
Correct Answer
C:This is why separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported. Verification depends on action risk tier, approval or operator record, playbook version and remote policy audit.
Incorrect Answers
A:That generalization is incorrect in the context of approval separation for automated firewall changes. The relevant behavior is response automation should align execution privilege with business and security risk.
B:That generalization is incorrect in the context of approval separation for automated firewall changes. Check action risk tier, approval or operator record, playbook version and remote policy audit.
D:That generalization is incorrect in the context of approval separation for automated firewall changes.
Question 934
A high-impact playbook changes security policy without any second-person review. An operator instead chooses this incorrect shortcut: Give every tier-one observer permission to edit critical FortiGate policies. Which resulting risk should the reviewer identify?
- Automatic unreviewed policy changes can cause broad production outages.
- The only effect is a cosmetic incident title change.
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
A:The intended preventive choice is separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported. Response automation should align execution privilege with business and security risk.
Incorrect Answers
B:This does not account for the actual approval separation for automated firewall changes weakness. The more relevant failure is automatic unreviewed policy changes can cause broad production outages.
C:This does not account for the actual approval separation for automated firewall changes weakness. Confirm with action risk tier, approval or operator record, playbook version and remote policy audit.
D:This does not account for the actual approval separation for automated firewall changes weakness.
Question 935
A high-impact playbook changes security policy without any second-person review. The observed fault is: Automatic unreviewed policy changes can cause broad production outages. How should the administrator restore and verify the intended state?
- Skip all containment review because the indicator is present in a feed.
- Disable policy auditing once a playbook is saved.
- Introduce the appropriate control and verify a restricted user cannot run the disruptive task.
- Give every tier-one observer permission to edit critical FortiGate policies.
Explanation
Correct Answer
C:This fixes the described operational problem with observable validation. Response automation should align execution privilege with business and security risk.
Incorrect Answers
A:Skip all containment review because the indicator is present in a feed. Automatic unreviewed policy changes can cause broad production outages. Instead, introduce the appropriate control and verify a restricted user cannot run the disruptive task.
B:Disable policy auditing once a playbook is saved. Automatic unreviewed policy changes can cause broad production outages. Instead, introduce the appropriate control and verify a restricted user cannot run the disruptive task.
D:Give every tier-one observer permission to edit critical FortiGate policies. Automatic unreviewed policy changes can cause broad production outages. Instead, introduce the appropriate control and verify a restricted user cannot run the disruptive task.
Question 936
A team wants low-risk enrichment to be automatic but production blocking to require authorized intervention. Which administrator action meets the documented requirement?
- For this FortiAnalyzer investigation, skip all containment review because the indicator is present in a feed.
- For this FortiAnalyzer investigation, disable policy auditing once a playbook is saved.
- For this FortiAnalyzer investigation, give every tier-one observer permission to edit critical FortiGate policies.
- For this FortiAnalyzer investigation, separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
Explanation
Correct Answer
D:Verify using action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
Incorrect Answers
A:Response automation should align execution privilege with business and security risk. This alternative targets the wrong capability or ignores prerequisites.
B:Automatic unreviewed policy changes can cause broad production outages. In this specific situation, a team wants low-risk enrichment to be automatic but production blocking to require authorized intervention.
C:Automatic unreviewed policy changes can cause broad production outages. This change does not provide the specified control.
Question 937
A team wants low-risk enrichment to be automatic but production blocking to require authorized intervention. Which observations should the engineer inspect before declaring success?
- The supporting evidence is action risk tier, approval or operator record, playbook version and remote policy audit.
- The supporting evidence is an unrelated incident status with no matching event or task audit.
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is an approved change request without recorded workflow execution.
Explanation
Correct Answer
A:These observations directly test approval separation for automated firewall changes under the actual system state. The planned operation is separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
Incorrect Answers
B:An unrelated incident status with no matching event or task audit. The relevant evidence is action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
C:A severity label without source evidence and affected asset identity. The relevant evidence is action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
D:An approved change request without recorded workflow execution. The relevant evidence is action risk tier, approval or operator record, playbook version and remote policy audit. Response automation should align execution privilege with business and security risk.
Question 938
A team wants low-risk enrichment to be automatic but production blocking to require authorized intervention. Which platform statement is MOST accurate for this scenario?
- The governing concept is that response automation should align execution privilege with business and security risk.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
Explanation
Correct Answer
A:This is why separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
Incorrect Answers
B:That generalization is incorrect in the context of approval separation for automated firewall changes.
C:The relevant behavior is response automation should align execution privilege with business and security risk.
D:That generalization is incorrect in the context of approval separation for automated firewall changes. An incident marked resolved proves a remote firewall policy change succeeded.
Question 939
A team wants low-risk enrichment to be automatic but production blocking to require authorized intervention. An operator instead chooses this incorrect shortcut: Give every tier-one observer permission to edit critical FortiGate policies. Which consequence BEST explains the flaw in the proposed change?
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that automatic unreviewed policy changes can cause broad production outages.
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
Explanation
Correct Answer
B:The intended preventive choice is separate harmless enrichment from high-risk actions and use approved gated execution or operator review where supported.
Incorrect Answers
A:This does not account for the actual approval separation for automated firewall changes weakness.
C:This does not account for the actual approval separation for automated firewall changes weakness. An accurate incident assignment caused the missing log source.
D:This does not account for the actual approval separation for automated firewall changes weakness. An approved narrow connector scope caused every unrelated Internet outage.
Question 940
A team wants low-risk enrichment to be automatic but production blocking to require authorized intervention. The observed fault is: Automatic unreviewed policy changes can cause broad production outages. Which remediation best corrects the root cause?
- The corrective action is to introduce the appropriate control and verify a restricted user cannot run the disruptive task.
- The corrective action is to disable policy auditing once a playbook is saved.
- The corrective action is to give every tier-one observer permission to edit critical FortiGate policies.
- The corrective action is to skip all containment review because the indicator is present in a feed.
Explanation
Correct Answer
A:Recheck action risk tier, approval or operator record, playbook version and remote policy audit.
Incorrect Answers
B:Disable policy auditing once a playbook is saved. Automatic unreviewed policy changes can cause broad production outages. Instead, introduce the appropriate control and verify a restricted user cannot run the disruptive task.
C:Give every tier-one observer permission to edit critical FortiGate policies. Automatic unreviewed policy changes can cause broad production outages. Instead, introduce the appropriate control and verify a restricted user cannot run the disruptive task.
D:Skip all containment review because the indicator is present in a feed. Automatic unreviewed policy changes can cause broad production outages. Instead, introduce the appropriate control and verify a restricted user cannot run the disruptive task.
