During an incident investigation, an analyst collects logs, captures memory, and interviews the user who reported the issue. What should the analyst do to ensure the documentation supports the investigation?

Delete the logs after analysis to reduce clutter.

Record the timeline of events, evidence collected, and actions taken in a secure incident log.

Email the findings to the incident response team without a formal record.

Store the evidence in a shared folder so all team members can access it.

A malware infection on a single workstation has spread to the file server, encrypting files. The organization's backup is from the previous night. What should the analyst include in the impact assessment?

The name of the user who opened the malicious attachment.

The type of malware and its family.

The IP address of the attacker's command-and-control server.

The number of affected systems and the estimated downtime for restoring from backup.

Which of the following is a key factor to consider when assessing the impact of a security incident?

The color of the alert in the SIEM

The number of security tools deployed

The attacker's country of origin

The criticality of the affected systems and data

Which factor is most important when classifying the severity of a security incident?

The time of day the incident occurred

The number of alerts generated by the SIEM

The potential impact on business operations and data

During root cause analysis of a security incident, an analyst traces the event chain back to an unpatched vulnerability in a web application. What is the root cause in this scenario?

The lack of intrusion detection alerts

The unpatched vulnerability in the web application

The time of day the attack occurred

The attacker's use of a known exploit

Palo Alto NetworksCertified XDR Analyst

Domain 2Objective 2

2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 1)

Part of the Incident Handling and Response domain, which accounts for 34% of the XDR-ANALYST exam.

34questions here

7free pages

7concepts

34%of the exam

Questions 1–5

1application · medium
During an incident investigation, an analyst collects logs, captures memory, and interviews the user who reported the issue. What should the analyst do to ensure the documentation supports the investigation?
Select an answer first
2application · medium
A malware infection on a single workstation has spread to the file server, encrypting files. The organization's backup is from the previous night. What should the analyst include in the impact assessment?
Select an answer first
3foundation · easy
Which of the following is a key factor to consider when assessing the impact of a security incident?
Select an answer first
4foundation · easy
Which factor is most important when classifying the severity of a security incident?
Select an answer first
5foundation · easy
During root cause analysis of a security incident, an analyst traces the event chain back to an unpatched vulnerability in a web application. What is the root cause in this scenario?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.