1.1 Identify and Explain Different Types of Alerts and Alert Sources XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A SOC team is overwhelmed by a high volume of low-severity alerts from multiple sources. They want to reduce false positives and identify complex threats that span the network and endpoints. They have already implemented basic alert rules. Which approach would most effectively achieve their goal?

   • AIncrease the severity threshold for all alerts to reduce the volume.
   • BManually review all alerts to identify patterns.
   • CImplement alert correlation rules that combine related events from different sources.
   • DDisable alerts from sources that generate the most false positives.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company uses an XDR platform that ingests data from its firewall, endpoint agents, and a third-party cloud access security broker (CASB). An analyst notices an alert that was generated solely from the CASB's log of an anomalous file download from a sanctioned cloud app. The endpoint agent and firewall did not report any related activity. What is the most likely source of this alert?

   • ANetwork-based detection from the firewall
   • BCorrelated alert from multiple sources
   • CEndpoint-based detection from the agent
   • DCloud-based detection from the CASB integration
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A company's XDR platform receives alerts from its endpoint agents, network firewalls, and a third-party threat intelligence feed. An alert is generated when an endpoint's DNS query matches a domain from the threat intelligence feed. What is the primary source of this alert?

   • AThird-party threat intelligence feed
   • BNetwork firewall
   • CEndpoint agent
   • DCorrelated alert from multiple sources
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company uses an XDR platform that collects data from its network firewalls, endpoint agents, and a cloud access security broker (CASB). An alert is generated when a user uploads a file to a sanctioned cloud app that contains sensitive data. The alert is based on the CASB's data loss prevention (DLP) rules. What is the primary source of this alert?

   • AEndpoint agent
   • BCorrelated alert from multiple sources
   • CNetwork firewall
   • DCloud access security broker (CASB)
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security operations center (SOC) analyst is investigating an alert that was triggered when an endpoint executed a process that exactly matched a known malware signature. The alert is classified as critical. Which alert generation mechanism most likely produced this alert?

   • AAnomaly-based detection, because the process behavior deviated from the baseline.
   • BBehavioral detection, because the process exhibited malicious behavior patterns.
   • CCorrelation-based detection, because the alert was correlated with other events.
   • DSignature-based detection, because the process matched a known malware signature.
   Reveal Solution Discussion Select an answer first