2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A SOC analyst is reviewing alerts from multiple sources: an email gateway flagged a phishing email, an endpoint detected a suspicious file download, and a firewall logged outbound connections to a known malicious IP. What should the analyst do to determine if these are related?

   • ATreat each alert as a separate incident and handle them independently.
   • BCorrelate the alerts by common indicators such as the sender address, file hash, and destination IP.
   • CEscalate all alerts to the highest severity without further analysis.
   • DBlock the malicious IP and the sender address immediately.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security operations center (SOC) analyst discovers that a single low-privilege user account was used to access a file share containing non-confidential marketing materials. The access occurred outside business hours and no data was exfiltrated. How should the analyst classify this incident?

   • AMedium severity, because the account is low-privilege and the data is non-confidential.
   • BLow severity, because the impact is limited to a non-sensitive resource and no data loss occurred.
   • CHigh severity, because any unauthorized access outside business hours indicates a compromised account.
   • DInformational, because no security control was bypassed.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which of the following best describes the purpose of event identification in security monitoring?

   • ATo assign a severity score to every log entry
   • BTo distinguish potential security incidents from benign network activity
   • CTo automatically remediate all detected anomalies
   • DTo document the final root cause of an incident
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An analyst notices multiple failed login attempts from different IP addresses against the same user account, followed by a successful login from a new IP address. What does correlating these events help the analyst identify?

   • AA misconfigured firewall rule
   • BA normal user behavior pattern
   • CA hardware failure on the authentication server
   • DA potential coordinated brute-force attack
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   A SOC analyst is triaging two incidents. Incident A involves a low-privilege user account that was used to access a file share containing non-confidential data. Incident B involves a compromised domain admin account that was used to access a database with customer PII. Both incidents occurred within the same hour. How should the analyst prioritize these incidents?

   • APrioritize both equally because they occurred at the same time.
   • BPrioritize Incident A because it involves a user account, which is more common.
   • CPrioritize Incident A because it occurred first.
   • DPrioritize Incident B because the domain admin account and customer PII indicate a higher potential impact.
   Reveal Solution Discussion Select an answer first