Fortinet FCP_FAZ_AN-7.4 Exam - Topic 2 Question 9 Discussion

Actual exam question for Fortinet's FCP_FAZ_AN-7.4 exam

Question #: 9
Topic #: 2

What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

AFortiAnalyzer flags the associated host for further analysis.

BA new infected entry is added for the corresponding endpoint under Compromised Hosts.

CThe detection engine classifies those logs as Suspicious.

DThe endpoint is marked as Compromised and, optionally, can be put in quarantine.

Show Suggested Answer

Suggested Answer: B

by Harrison at Feb 06, 2025, 08:59 PM

Limited Time Offer

25%

Off

Get Premium FCP_FAZ_AN-7.4 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Johnson

3 months ago

Logs are classified as Suspicious, right?

upvoted 0 times

...

Stephaine

3 months ago

I think it adds a new entry for compromised hosts too.

upvoted 0 times

...

Ma

3 months ago

Wait, can it really quarantine the endpoint? Sounds a bit extreme.

upvoted 0 times

...

Brynn

4 months ago

Definitely agree with that!

upvoted 0 times

...

Linette

4 months ago

FortiAnalyzer flags the host for further analysis.

upvoted 0 times

...

France

4 months ago

I’m leaning towards the option that says a new infected entry is added under Compromised Hosts, but I might be mixing it up with another topic.

upvoted 0 times

...

Melodie

4 months ago

I feel like I saw a question similar to this where the logs were classified as suspicious, but I can't recall if that's the right answer here.

upvoted 0 times

...

Billi

4 months ago

I remember something about endpoints being marked as compromised, and maybe they can be quarantined too. That sounds familiar.

upvoted 0 times

...

Matilda

5 months ago

I think when the IOC engine finds a match, it might flag the host for further analysis, but I'm not entirely sure.

upvoted 0 times

...

I think the key here is understanding how the FortiAnalyzer IOC engine reacts to blacklisted IPs in the web logs. If I remember correctly, it flags the host for further analysis, but I'm not 100% sure about the other details. I'll have to review that part of the material.

upvoted 0 times

...

Rebbecca

5 months ago

Okay, I've got this. When the IOC engine finds web logs matching blacklisted IPs, it marks the associated host as compromised and can optionally put that endpoint in quarantine. I'm confident that's the right answer.

upvoted 0 times

...

Marnie

5 months ago

Hmm, I'm a bit unsure about this one. I know FortiAnalyzer has some kind of IOC functionality, but I can't quite recall the specifics of how it responds to blacklisted IPs. I'll have to think this through carefully.

upvoted 0 times

...

Doretha

5 months ago

This seems like a straightforward question about the FortiAnalyzer IOC engine. I'll need to remember the key details about how it handles blacklisted IP addresses in web logs.

upvoted 0 times

...

Antonio

12 months ago

Option D is the way to go. Quarantining the compromised endpoint is the best way to prevent further damage. Hopefully, the user has a good warranty on their device.

upvoted 0 times

...

Hillary

12 months ago

C is my pick. Classifying the logs as suspicious is a good first step, but I'd expect more actions to be taken as well.

upvoted 0 times

...

Gladis

12 months ago

Haha, I bet the correct answer is actually that the FortiAnalyzer orders a pizza for the suspicious user. Gotta keep those hackers fed, right?

upvoted 0 times

Alverta

11 months ago

D) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...

Gracia

11 months ago

C) The detection engine classifies those logs as Suspicious.

upvoted 0 times

...

Talia

11 months ago

B) A new infected entry is added for the corresponding endpoint under Compromised Hosts.

upvoted 0 times

...

Mila

11 months ago

A) FortiAnalyzer flags the associated host for further analysis.

upvoted 0 times

...

Pamela

12 months ago

I believe the answer is D) The endpoint is marked as Compromised and can be put in quarantine, to prevent further damage.

upvoted 0 times

...

Cheryl

1 year ago

I agree with Dean, because it makes sense to investigate further when a blacklisted IP address is detected.

upvoted 0 times

...

Gail

1 year ago

I'm going with B. Adding a new infected entry under Compromised Hosts helps keep track of the issue and take appropriate action.

upvoted 0 times

...

Stephanie

1 year ago

Option D seems like the most comprehensive response. Marking the endpoint as compromised and the ability to quarantine it is a crucial security measure.

upvoted 0 times