1.1 Identify and Explain Different Types of Alerts and Alert Sources XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which alert generation mechanism is most effective at detecting previously unknown threats by identifying deviations from a baseline of normal behavior?

   • AAnomaly-based detection
   • BSignature-based detection
   • CHeuristic detection
   • DBehavioral detection
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst at a financial firm reviews an alert generated by the XDR platform. The alert indicates that a single endpoint attempted to connect to a known malicious IP address. The endpoint is a domain controller, and the connection was blocked by the firewall. The analyst must classify the alert's severity for the incident response team. Which severity classification is most appropriate?

   • ACritical, because any alert on a domain controller must be treated as a critical incident.
   • BWarning, because the threat was not successful but the asset is critical.
   • CInformational, because the connection was blocked and no data was exfiltrated.
   • DInformational, because the alert is from a single source and not correlated with other events.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A SOC analyst is investigating a series of alerts: an endpoint alert for a suspicious file download, a network alert for a connection to a known command-and-control (C2) domain, and a cloud alert for an unusual data upload to a file-sharing service. Each alert individually has low severity. What should the analyst do to best assess the situation?

   • ACorrelate the alerts to determine if they are part of a single attack chain.
   • BWait for additional alerts before taking any action.
   • CTreat each alert as a separate low-priority incident and close them after review.
   • DEscalate the alert with the highest individual severity to incident response.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which alert type is most appropriate for a routine event that does not indicate a security threat, such as a successful user login?

   • AWarning
   • BError
   • CCritical
   • DInformational
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An XDR platform generates an alert for a possible credential theft on a domain controller. The alert is based on a behavioral detection that flags unusual logon activity. The domain controller is critical to the organization. What is the most appropriate severity classification?

   • ACritical, because any alert on a domain controller is automatically critical.
   • BInformational, because the alert is based on behavior, not a confirmed compromise.
   • CWarning, because the behavior is unusual but not confirmed malicious.
   • DCritical, because the asset is a domain controller and credential theft could have severe impact.
   Reveal Solution Discussion Select an answer first