Deal of The Day! Hurry Up, Grab the Special Discount - Save 25% - Ends In 00:00:00 Coupon code: SAVE25

- Free Preparation Discussions

Fortinet FCP_FAZ_AN-7.6 Exam - Topic 2 Question 4 Discussion

Actual exam question for Fortinet's FCP_FAZ_AN-7.6 exam

Question #: 4
Topic #: 2

[All FCP_FAZ_AN-7.6 Questions]

Which log will generate an event with the status Contained?

AAn AV log with action=quarantine.

BAn IPS log with action=pass.

CA WebFilter log will action=dropped.

DAn AppControl log with action=blocked.

Show Suggested Answer

Suggested Answer: A

by Marylou at Jan 26, 2026, 05:02 PM

Limited Time Offer

25%

Off

Get Premium FCP_FAZ_AN-7.6 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Marci

9 hours ago

No way, B just means it wasn't blocked. A is definitely the right choice.

upvoted 0 times

...

Harrison

6 days ago

But what about B? Pass could imply it's contained too.

upvoted 0 times

...

Myra

11 days ago

I agree, A makes sense. Quarantine is a containment action.

upvoted 0 times

...

Thurman

16 days ago

I think it's A. Quarantine means contained.

upvoted 0 times

...

Vivan

2 months ago

Seems like a tricky question, but A is definitely the right choice.

upvoted 0 times

...

Yesenia

2 months ago

I thought C) was the right answer, but I guess not!

upvoted 0 times

...

Dion

2 months ago

Wait, why would an IPS log with action=pass be contained?

upvoted 0 times

...

Jina

3 months ago

Totally agree, that makes sense!

upvoted 0 times

...

Hubert

3 months ago

A) An AV log with action=quarantine is correct.

upvoted 0 times

...

Anika

3 months ago

I think A is the way to go. Quarantining malware is the best way to keep it Contained.

upvoted 0 times

...

Billye

3 months ago

Haha, I bet the answer is C. A WebFilter log with action=dropped is just asking for trouble!

upvoted 0 times

...

Winfred

3 months ago

B is the right answer. An IPS log with action=pass means the traffic was allowed, so it should be Contained.

upvoted 0 times

...

Amie

3 months ago

I'm pretty sure it's D. An AppControl log with action=blocked should generate a Contained event.

upvoted 0 times

...

Geraldo

4 months ago

The correct answer is A. An AV log with action=quarantine will generate an event with the status Contained.

upvoted 0 times

...

Leota

4 months ago

I'm leaning towards D because blocking an app often means it's contained, but I could be mixing it up with another question I studied.

upvoted 0 times

...

Brittni

4 months ago

I feel like the WebFilter log could be a trick option, but "dropped" doesn't sound like it would indicate containment.

upvoted 0 times

...

Vilma

5 months ago

I remember practicing a question about IPS logs, but I don't think "pass" would mean contained.

upvoted 0 times

...

Jeffrey

5 months ago

I think the answer might be A, since quarantining usually means the item is contained, but I'm not completely sure.

upvoted 0 times

...

Shenika

5 months ago

I've got a strategy for this. I'm going to focus on the key details in the question, like the status "Contained", and try to match that up with the different log types and actions listed in the options.

upvoted 0 times

...

Annamae

5 months ago

I'm a bit confused by the wording of the question. Does "Contained" refer to the action taken, or the final status of the event? I'll need to think this through carefully.

upvoted 0 times

...

Hoa

5 months ago

Okay, let's see here. The question is asking which log will generate an event with the status "Contained". I'm going to eliminate the options that don't seem to match that criteria.

upvoted 0 times

...

Ronald

6 months ago

Hmm, this one seems a bit tricky. I'll need to carefully read through the options and think about the different log types and their associated actions.

upvoted 0 times

...

Miesha

6 months ago

I think I know the answer, but I want to double-check the details in the question to make sure I'm not missing anything.

upvoted 0 times

...