Exam NSE5_FAZ-7.2 topic 1 question 31 discussion

Answer is B Event status Description Unhandled The security event risk is not mitigated or contained, so it is considered open. Example: an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled. Contained The risk source is isolated. Example: an AV log with action=quarantine will have the event status Contained. Mitigated The security risk is mitigated by being blocked or dropped. Example: an IPS/AV log with action=block/drop will have the event status Mitigated. (Blank) Other scenarios.

FortiAnalyzer Analyst Study Guide for FortiAnalyzer 7.2 page 111

B is correct

Answer is B Event status Description Unhandled The security event risk is not mitigated or contained, so it is considered open. Example: an IPS/AV log with action=pass will have the event status Unhandled. Botnet and IoC events are also considered Unhandled. Contained The risk source is isolated. Example: an AV log with action=quarantine will have the event status Contained. Mitigated The security risk is mitigated by being blocked or dropped. Example: an IPS/AV log with action=block/drop will have the event status Mitigated. (Blank) Other scenarios.