3.5 Identify, Hunt, and Investigate Leads and Indicators of Compromise (IOCs) XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is investigating an alert about a suspicious PowerShell command that was executed on a server. The command is not on any blocklist, but it does download a file from an external IP. The analyst wants to determine if this is a true positive. Which evidence would be most convincing?

   • AThe downloaded file has a low reputation score on one antivirus engine
   • BThe server has a history of running legitimate PowerShell scripts
   • CThe external IP is associated with a known threat actor's infrastructure
   • DThe PowerShell command was executed during business hours
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does threat intelligence help an analyst correlate an IOC with a known threat actor?

   • ABy providing context on whether the IOC has been associated with specific actors or campaigns
   • BBy automatically blocking the IOC without analyst input
   • CBy generating a report for senior management
   • DBy replacing the need for any further investigation
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is a key characteristic of well-structured documentation for an IOC investigation?

   • AIt includes the evidence, analysis, and conclusion in a logical order
   • BIt is written in a way that only the original analyst can understand
   • CIt contains only the final conclusion without supporting details
   • DIt omits any mention of false positives
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A threat intelligence report mentions a new malware family that uses a specific user-agent string and communicates with a set of command-and-control (C2) domains. An analyst wants to proactively hunt for this malware in the network. Which approach would be most effective?

   • ASearch email logs for messages with the user-agent string
   • BSearch DNS logs for any domain that is less than 30 days old
   • CSearch firewall logs for connections to the C2 domains and proxy logs for the user-agent string
   • DSearch endpoint logs for the malware's file hash
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   When investigating a lead, what is the first step an analyst should take to determine its relevance?

   • AGather additional context about the lead, such as the affected assets and timeline
   • BEscalate the lead to management without any analysis
   • CImmediately block all IP addresses associated with the lead
   • DDelete the lead from the queue to reduce noise
   Reveal Solution Discussion Select an answer first