1.1 Identify and Explain Different Types of Alerts and Alert Sources XDR-ANALYST Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   Which scenario best illustrates the benefit of alert correlation?

   • AA single firewall alert indicates a port scan from an external IP
   • BA third-party integration sends an alert about a vulnerability scan
   • CAn endpoint alert shows a malicious file, and a network alert shows a connection to a known command-and-control server, together indicating a compromise
   • DA cloud alert indicates an unusual API call from a legitimate user
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An XDR platform generates an alert for a suspicious PowerShell command on a workstation. The workstation is used by a developer and contains source code. The alert has a medium severity. Which additional factor would most likely increase the alert's priority?

   • AThe workstation has a public IP address.
   • BThe PowerShell command is a known benign administrative script.
   • CThe alert was generated during business hours.
   • DThe developer is a high-privileged user.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which alert source is primarily responsible for detecting malicious network traffic, such as port scans or intrusion attempts?

   • ANetwork
   • BEndpoint
   • CThird-party integration
   • DCloud
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which alert generation mechanism relies on predefined patterns or signatures of known threats to detect malicious activity?

   • AAnomaly-based detection
   • BSignature-based detection
   • CBehavioral detection
   • DHeuristic detection
   Reveal Solution Discussion Select an answer first