2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is accurate incident documentation important in incident handling?

   • AIt replaces the need for root cause analysis
   • BIt automatically prevents future incidents
   • CIt helps in identifying the attacker's identity
   • DIt supports investigation, reporting, and potential legal proceedings
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst discovers that a database containing customer payment information was accessed by an unauthorized user. The analyst determines that the data was likely exfiltrated. What should the analyst do to classify the incident?

   • AClassify it as high severity because of the sensitive data and potential regulatory impact.
   • BClassify it as low severity because the breach was detected quickly.
   • CClassify it as informational because no malware was involved.
   • DClassify it as medium severity because the unauthorized user was an internal employee.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of correlating security events from multiple sources?

   • ATo automatically patch vulnerabilities
   • BTo identify patterns that indicate coordinated or multi-stage attacks
   • CTo reduce the storage requirements for logs
   • DTo replace the need for manual analysis
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is investigating an alert about a suspicious process that is making outbound connections to an IP address that is not on any threat intelligence feed. The process is signed by a legitimate vendor. What should the analyst do to determine the nature of the threat?

   • ASearch the internet for the IP address to see if it is known.
   • BAnalyze the process's behavior in a sandbox environment to see what it does.
   • CTrust the process because it is signed by a legitimate vendor.
   • DBlock the IP address at the firewall to prevent further communication.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An analyst discovers a malware infection on a single non-critical workstation. The malware has not spread and no sensitive data has been accessed. According to common incident classification practices, how should this incident be categorized?

   • ALow severity because it is not a security incident
   • BInformational because no data was stolen
   • CMedium severity because it is a security incident but with limited impact
   • DHigh severity because any malware is a critical threat
   Reveal Solution Discussion Select an answer first