Fortinet FCP_FAZ_AN-7.6 Practice Test 99
Question 980
An incident response dashboard displays notification success and management assumes malicious traffic was blocked. The observed fault is: Conflating a delivered email with completed remediation can leave the attack unrestricted. Which remediation best corrects the root cause?
- The corrective action is to replace FortiOS connector task with a report subscription and label it blocked.
- The corrective action is to run the authorized remediation if warranted and verify independently at the target.
- The corrective action is to assume an SMTP success code proves the firewall quarantined an endpoint.
- The corrective action is to disable device-side verification after email delivery.
Explanation
Correct Answer
B:Notification tells responders about an event but does not inherently change network or endpoint state. Recheck email delivery status, task type, remote connector output and current device enforcement state.
Incorrect Answers
A:Replace FortiOS connector task with a report subscription and label it blocked. Conflating a delivered email with completed remediation can leave the attack unrestricted. Instead, run the authorized remediation if warranted and verify independently at the target.
C:Assume an SMTP success code proves the firewall quarantined an endpoint. Conflating a delivered email with completed remediation can leave the attack unrestricted. Instead, run the authorized remediation if warranted and verify independently at the target.
D:Disable device-side verification after email delivery. Conflating a delivered email with completed remediation can leave the attack unrestricted. Instead, run the authorized remediation if warranted and verify independently at the target.
Question 981
An event handler creates incidents but an associated response playbook never starts. Which administrator action meets the documented requirement?
- Delete all existing event logs because the playbook did not run.
- Set an unrelated report schedule as the incident trigger.
- Assume a connected external connector causes every playbook to launch automatically.
- Check enabled state, trigger type and actual event or incident match before debugging downstream tasks.
Explanation
Correct Answer
D:No downstream tasks execute if an eligible trigger has not started the workflow. Verify using playbook status, trigger condition, matching incident ID, job history and operator changes.
Incorrect Answers
A:Assuming a saved playbook always runs can conceal a detection-to-response gap. Use check enabled state, trigger type and actual event or incident match before debugging downstream tasks.
B:Set an unrelated report schedule as the incident trigger. No downstream tasks execute if an eligible trigger has not started the workflow. Relevant observations are playbook status, trigger condition, matching incident ID, job history and operator changes.
C:Assuming a saved playbook always runs can conceal a detection-to-response gap. The supported correction is check enabled state, trigger type and actual event or incident match before debugging downstream tasks.
Question 982
An event handler creates incidents but an associated response playbook never starts. Which observations should the engineer inspect before declaring success?
- A severity label without source evidence and affected asset identity.
- An approved change request without recorded workflow execution.
- A connector icon without authorization or current API response.
- Playbook status, trigger condition, matching incident ID, job history and operator changes.
Explanation
Correct Answer
D:These observations directly test playbook disabled or unmatched trigger diagnosis under the actual system state. No downstream tasks execute if an eligible trigger has not started the workflow.
Incorrect Answers
A:A severity label without source evidence and affected asset identity. The relevant evidence is playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
B:An approved change request without recorded workflow execution. The relevant evidence is playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
C:A connector icon without authorization or current API response. The relevant evidence is playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
Question 983
An event handler creates incidents but an associated response playbook never starts. Which platform statement is MOST accurate for this scenario?
- Every IOC match is confirmed active malware compromise.
- A saved playbook without an eligible trigger automatically performs all tasks.
- A connector listed in inventory always has valid permissions and network reachability.
- No downstream tasks execute if an eligible trigger has not started the workflow.
Explanation
Correct Answer
D:Verification depends on playbook status, trigger condition, matching incident ID, job history and operator changes. This is why check enabled state, trigger type and actual event or incident match before debugging downstream tasks.
Incorrect Answers
A:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of playbook disabled or unmatched trigger diagnosis. The relevant behavior is no downstream tasks execute if an eligible trigger has not started the workflow. Check playbook status, trigger condition, matching incident ID, job history and operator changes.
B:A saved playbook without an eligible trigger automatically performs all tasks. That generalization is incorrect in the context of playbook disabled or unmatched trigger diagnosis. The relevant behavior is no downstream tasks execute if an eligible trigger has not started the workflow. Check playbook status, trigger condition, matching incident ID, job history and operator changes.
C:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of playbook disabled or unmatched trigger diagnosis. The relevant behavior is no downstream tasks execute if an eligible trigger has not started the workflow. Check playbook status, trigger condition, matching incident ID, job history and operator changes.
Question 984
An event handler creates incidents but an associated response playbook never starts. An operator instead chooses this incorrect shortcut: Delete all existing event logs because the playbook did not run. Which consequence BEST explains the flaw in the proposed change?
- The only effect is a cosmetic incident title change.
- Assuming a saved playbook always runs can conceal a detection-to-response gap.
- An approved narrow connector scope caused every unrelated Internet outage.
- Preserving the task audit trail created all earlier endpoint infections.
Explanation
Correct Answer
B:The intended preventive choice is check enabled state, trigger type and actual event or incident match before debugging downstream tasks. No downstream tasks execute if an eligible trigger has not started the workflow.
Incorrect Answers
A:This does not account for the actual playbook disabled or unmatched trigger diagnosis weakness. The more relevant failure is assuming a saved playbook always runs can conceal a detection-to-response gap.
C:This does not account for the actual playbook disabled or unmatched trigger diagnosis weakness. Confirm with playbook status, trigger condition, matching incident ID, job history and operator changes.
D:This does not account for the actual playbook disabled or unmatched trigger diagnosis weakness. In this specific situation, an event handler creates incidents but an associated response playbook never starts.
Question 985
An event handler creates incidents but an associated response playbook never starts. The observed fault is: Assuming a saved playbook always runs can conceal a detection-to-response gap. Which remediation best corrects the root cause?
- Enable only after approval and test trigger delivery to a real job record.
- Set an unrelated report schedule as the incident trigger.
- Assume a connected external connector causes every playbook to launch automatically.
- Delete all existing event logs because the playbook did not run.
Explanation
Correct Answer
A:This fixes the described operational problem with observable validation. No downstream tasks execute if an eligible trigger has not started the workflow.
Incorrect Answers
B:Set an unrelated report schedule as the incident trigger. Assuming a saved playbook always runs can conceal a detection-to-response gap. Instead, enable only after approval and test trigger delivery to a real job record.
C:Assume a connected external connector causes every playbook to launch automatically. Assuming a saved playbook always runs can conceal a detection-to-response gap. Instead, enable only after approval and test trigger delivery to a real job record.
D:Delete all existing event logs because the playbook did not run. Assuming a saved playbook always runs can conceal a detection-to-response gap. Instead, enable only after approval and test trigger delivery to a real job record.
Question 986
A playbook was disabled during change control and the team mistakenly reports active enforcement. Which FortiAnalyzer analyst action is most appropriate?
- For this FortiAnalyzer investigation, set an unrelated report schedule as the incident trigger.
- For this FortiAnalyzer investigation, check enabled state, trigger type and actual event or incident match before debugging downstream tasks.
- For this FortiAnalyzer investigation, assume a connected external connector causes every playbook to launch automatically.
- For this FortiAnalyzer investigation, delete all existing event logs because the playbook did not run.
Explanation
Correct Answer
B:No downstream tasks execute if an eligible trigger has not started the workflow. This is the targeted correction for playbook disabled or unmatched trigger diagnosis.
Incorrect Answers
A:Set an unrelated report schedule as the incident trigger. No downstream tasks execute if an eligible trigger has not started the workflow. Relevant observations are playbook status, trigger condition, matching incident ID, job history and operator changes.
C:Assuming a saved playbook always runs can conceal a detection-to-response gap. Assume a connected external connector causes every playbook to launch automatically.
D:Assuming a saved playbook always runs can conceal a detection-to-response gap. Delete all existing event logs because the playbook did not run.
Question 987
A playbook was disabled during change control and the team mistakenly reports active enforcement. Which collection of records directly tests the suspected mechanism?
- The supporting evidence is playbook status, trigger condition, matching incident ID, job history and operator changes.
- The supporting evidence is an unrelated incident status with no matching event or task audit.
- The supporting evidence is a severity label without source evidence and affected asset identity.
- The supporting evidence is an approved change request without recorded workflow execution.
Explanation
Correct Answer
A:These observations directly test playbook disabled or unmatched trigger diagnosis under the actual system state. The planned operation is check enabled state, trigger type and actual event or incident match before debugging downstream tasks.
Incorrect Answers
B:An unrelated incident status with no matching event or task audit. The relevant evidence is playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
C:A severity label without source evidence and affected asset identity. The relevant evidence is playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
D:An approved change request without recorded workflow execution. The relevant evidence is playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
Question 988
A playbook was disabled during change control and the team mistakenly reports active enforcement. Which implementation principle supports the intended approach?
- The governing concept is that no downstream tasks execute if an eligible trigger has not started the workflow.
- The governing concept is that a connector listed in inventory always has valid permissions and network reachability.
- The governing concept is that every IOC match is confirmed active malware compromise.
- The governing concept is that an incident marked resolved proves a remote firewall policy change succeeded.
Explanation
Correct Answer
A:Verification depends on playbook status, trigger condition, matching incident ID, job history and operator changes. No downstream tasks execute if an eligible trigger has not started the workflow.
Incorrect Answers
B:A connector listed in inventory always has valid permissions and network reachability. That generalization is incorrect in the context of playbook disabled or unmatched trigger diagnosis. The relevant behavior is no downstream tasks execute if an eligible trigger has not started the workflow. Check playbook status, trigger condition, matching incident ID, job history and operator changes.
C:Every IOC match is confirmed active malware compromise. That generalization is incorrect in the context of playbook disabled or unmatched trigger diagnosis. The relevant behavior is no downstream tasks execute if an eligible trigger has not started the workflow. Check playbook status, trigger condition, matching incident ID, job history and operator changes.
D:An incident marked resolved proves a remote firewall policy change succeeded. That generalization is incorrect in the context of playbook disabled or unmatched trigger diagnosis. The relevant behavior is no downstream tasks execute if an eligible trigger has not started the workflow. Check playbook status, trigger condition, matching incident ID, job history and operator changes.
Question 989
A playbook was disabled during change control and the team mistakenly reports active enforcement. An operator instead chooses this incorrect shortcut: Delete all existing event logs because the playbook did not run. What technical weakness does this incorrect change introduce?
- The material failure is that preserving the task audit trail created all earlier endpoint infections.
- The material failure is that assuming a saved playbook always runs can conceal a detection-to-response gap.
- The material failure is that an accurate incident assignment caused the missing log source.
- The material failure is that an approved narrow connector scope caused every unrelated Internet outage.
Explanation
Correct Answer
B:The intended preventive choice is check enabled state, trigger type and actual event or incident match before debugging downstream tasks. Assuming a saved playbook always runs can conceal a detection-to-response gap.
Incorrect Answers
A:This does not account for the actual playbook disabled or unmatched trigger diagnosis weakness. Preserving the task audit trail created all earlier endpoint infections.
C:This does not account for the actual playbook disabled or unmatched trigger diagnosis weakness. An accurate incident assignment caused the missing log source.
D:This does not account for the actual playbook disabled or unmatched trigger diagnosis weakness. An approved narrow connector scope caused every unrelated Internet outage.
Question 990
A playbook was disabled during change control and the team mistakenly reports active enforcement. The observed fault is: Assuming a saved playbook always runs can conceal a detection-to-response gap. What corrective action restores the target behavior with validation?
- The corrective action is to assume a connected external connector causes every playbook to launch automatically.
- The corrective action is to enable only after approval and test trigger delivery to a real job record.
- The corrective action is to delete all existing event logs because the playbook did not run.
- The corrective action is to set an unrelated report schedule as the incident trigger.
Explanation
Correct Answer
B:Recheck playbook status, trigger condition, matching incident ID, job history and operator changes.
Incorrect Answers
A:Assume a connected external connector causes every playbook to launch automatically. Assuming a saved playbook always runs can conceal a detection-to-response gap. Instead, enable only after approval and test trigger delivery to a real job record.
C:Delete all existing event logs because the playbook did not run. Assuming a saved playbook always runs can conceal a detection-to-response gap. Instead, enable only after approval and test trigger delivery to a real job record.
D:Set an unrelated report schedule as the incident trigger. Assuming a saved playbook always runs can conceal a detection-to-response gap. Instead, enable only after approval and test trigger delivery to a real job record.
