2.2 Identify and Analyze Security Events and Incidents XDR-ANALYST Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   During threat analysis, an analyst identifies a file hash, a malicious IP address, and a registry key modification associated with a security event. Which of the following best describes these items?

   • AAttack vectors
   • BIncident classification tags
   • CMitigation controls
   • DIndicators of compromise (IOCs)
   Reveal Solution Discussion Select an answer first
2. 32expert · hard

   A data breach exposed customer credit card numbers. The organization is legally required to notify affected customers and regulators. The investigation is ongoing, and the full scope of the breach is not yet known. What should the analyst include in the impact assessment?

   • AOnly the number of affected records, because it is the most objective measure.
   • BThe technical details of the attack, such as the vulnerability exploited.
   • CThe potential regulatory fines, legal liabilities, and reputational damage, in addition to the number of affected records.
   • DThe time required to complete the investigation.
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the primary goal of root cause analysis in incident handling?

   • ATo document the incident timeline for reporting
   • BTo identify the underlying vulnerability or weakness that allowed the incident to occur
   • CTo assign blame to the responsible party
   • DTo contain the incident as quickly as possible
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   An analyst is documenting a security incident. Which of the following should be included in the incident documentation?

   • AThe personal opinions of the analysts involved
   • BA timeline of events, evidence collected, and actions taken
   • COnly the final remediation steps
   • DOnly the alerts generated by the SIEM
   Reveal Solution Discussion Select an answer first