2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization detects a phishing email that was delivered to several users. Over the next hour, multiple endpoints exhibit unusual outbound connections to the same external IP. What should the analyst do to determine if these events are part of a coordinated attack?

   • AIsolate all affected endpoints immediately to prevent further spread.
   • BBlock the external IP at the firewall and assume the threat is contained.
   • CCorrelate the phishing email indicators with the network connections to identify a common campaign.
   • DIgnore the outbound connections because the phishing email was already quarantined.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating an alert about a suspicious PowerShell command that was executed on a server. The command is encoded and the analyst decodes it to reveal a script that downloads a payload from a remote server. What should the analyst do next to analyze the threat?

   • ARetrieve the payload in a sandbox environment and analyze its behavior.
   • BBlock the remote server's IP at the firewall.
   • CSearch the internet for the encoded command to see if it is a known threat.
   • DDelete the PowerShell script from the server to prevent further execution.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   During impact assessment, an analyst determines that a ransomware attack encrypted files on a file server, but the organization has recent backups and can restore the data. What is the most accurate impact assessment?

   • ALow impact because backups exist
   • BNo impact because the data can be restored
   • CMedium impact because data is recoverable but there is downtime and potential data loss
   • DHigh impact because ransomware is always catastrophic
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization experienced a data breach. The investigation reveals that the attacker gained access through a phishing email that led to credential theft. The credentials were then used to access a sensitive database. What is the root cause of this incident?

   • AThe attacker's sophisticated social engineering techniques.
   • BThe phishing email itself, because it was the initial attack vector.
   • CThe database administrator's failure to monitor access logs.
   • DThe lack of multi-factor authentication (MFA) on the database access.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   An analyst notices a sudden spike in outbound traffic from a single workstation to an external IP address on port 443 during off-hours. Which step should the analyst take first to determine whether this is a security event or normal activity?

   • AEscalate the alert to a senior incident responder
   • BDisable the user's account to prevent further activity
   • CCompare the traffic pattern against the user's historical baseline and known application behavior
   • DBlock the external IP address immediately
   Reveal Solution Discussion Select an answer first