2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A security analyst notices a high volume of outbound traffic from a server to a cloud storage provider. The traffic is encrypted and occurs during business hours. The server is not known to use cloud storage. What should the analyst do to determine if this is a security event?

   • ACorrelate the traffic with other events, such as new processes or scheduled tasks on the server, and check if the destination is a known legitimate service.
   • BIgnore the traffic because it is encrypted and the destination is a well-known provider.
   • CReboot the server to terminate any suspicious processes.
   • DBlock the cloud storage provider's IP range at the firewall to stop the traffic.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What is the primary goal of threat analysis in the context of incident handling?

   • ATo document the incident timeline
   • BTo assign a severity score to the incident
   • CTo restore affected systems to normal operation
   • DTo determine the nature of the threat, including the attack vector and IOCs
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A company experienced a ransomware attack. The investigation reveals that the attacker gained access through a VPN account that did not have multi-factor authentication (MFA) enabled. The VPN account belonged to a former employee. What is the root cause of this incident?

   • AThe lack of monitoring on the VPN gateway.
   • BThe lack of MFA on the VPN account, which allowed the attacker to use stolen credentials.
   • CThe attacker's use of a sophisticated phishing campaign to steal the credentials.
   • DThe former employee's failure to change their password after leaving the company.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An organization is experiencing a series of low-severity alerts: failed logins, port scans, and phishing emails. Individually, these are not significant. However, the analyst notices that they all originate from the same external IP range. What should the analyst do?

   • ACorrelate the alerts to determine if they are part of a coordinated attack campaign.
   • BEscalate all alerts to high severity because they share a common source.
   • CBlock the entire IP range at the firewall to prevent further activity.
   • DContinue to treat each alert as a low-severity incident and close them individually.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst observes a series of outbound connections from a single host to a known malicious IP address on port 443. The connections occur every 5 minutes and the payloads are encrypted. What should the analyst do to determine the nature of the threat?

   • ABlock the malicious IP at the firewall and move on to other alerts.
   • BDisable the host's network adapter to stop the communication.
   • CSearch for other hosts communicating with the same IP to identify a coordinated attack.
   • DCheck the host for associated indicators of compromise, such as new scheduled tasks or registry entries.
   Reveal Solution Discussion Select an answer first