2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A ransomware attack encrypts files on a file server. The backup system was also affected, and the last good backup is from two weeks ago. The organization estimates that restoring from this backup will result in the loss of two weeks of work. What should the analyst include in the impact assessment?

   • AThe number of files encrypted and the type of ransomware used.
   • BThe IP address of the attacker and the attack vector used.
   • CThe time required to restore the backup and the number of IT staff needed.
   • DThe estimated cost of lost productivity and the potential revenue impact from the lost work.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   During an incident investigation, an analyst collects network captures, system logs, and memory dumps. The analyst also interviews the affected user. What should the analyst do to ensure the documentation is complete and accurate?

   • ACreate a detailed incident report that includes the timeline, evidence, and actions taken.
   • BStore the evidence in a secure location and share it only with the incident response team.
   • CDelete any irrelevant logs to streamline the investigation.
   • DVerbally summarize the findings to the incident commander without a written record.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security analyst notices a single workstation generating multiple failed login attempts against a domain controller over the past hour. The source IP is internal and the account names are random. Which step should the analyst take first to determine if this is a security event or normal activity?

   • AIsolate the workstation from the network immediately to prevent further damage.
   • BCorrelate the failed logins with other events from the same source and check for any successful logins afterward.
   • CReset the passwords of all accounts that were targeted in the failed attempts.
   • DBlock the source IP at the firewall to stop the failed login attempts.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A server was compromised through a vulnerable web application. The analyst traces the attack back to a specific unpatched plugin. What should the analyst do to address the root cause?

   • ABlock the attacker's IP address at the firewall.
   • BRebuild the server from a known-good backup.
   • CApply the vendor's security patch to the vulnerable plugin.
   • DDisable the web application until further notice.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A network administrator notices a sudden spike in DNS queries from a single workstation to many different domains. The domains are not on any blocklist. What should the analyst do to determine if this is a security event?

   • AReboot the workstation to clear any temporary DNS cache.
   • BBlock all DNS queries from the workstation to prevent potential data exfiltration.
   • CCompare the DNS queries with known domain generation algorithms (DGAs) and check for other suspicious activity on the host.
   • DIgnore the spike because the domains are not on any blocklist.
   Reveal Solution Discussion Select an answer first