3.5 Identify, Hunt, and Investigate Leads and Indicators of Compromise (IOCs) XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During a hunt, an analyst discovers a domain that is used by multiple malware families. The analyst wants to understand the threat landscape better. Which action would provide the most insight?

   • AReview threat intelligence reports that discuss the domain's use by different malware families
   • BSearch for the domain in public blocklists
   • CCheck the domain's WHOIS information
   • DBlock the domain immediately to prevent further infections
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is the best example of an indicator of compromise (IOC)?

   • AA scheduled maintenance window
   • BA user's password reset request
   • CA user's job title change
   • DA known malicious file hash observed in the environment
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst has finished investigating a series of alerts related to a phishing campaign. The analyst needs to document the findings so that other team members can understand the investigation. Which documentation approach is most effective?

   • AVerbally explain the findings to the team during a meeting
   • BCreate a structured report that includes the IOCs, the investigation steps, and the conclusion
   • CSave the raw logs in a shared folder without any analysis
   • DSend an email to the team summarizing the findings
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security team wants to proactively hunt for signs of a new malware that uses a specific DNS query pattern. The team has access to DNS logs and endpoint logs. Which search would be most effective?

   • ASearch both DNS and endpoint logs for any suspicious activity
   • BSearch DNS logs for the specific query pattern
   • CSearch firewall logs for the DNS query pattern
   • DSearch endpoint logs for the DNS query pattern
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   An analyst has completed an investigation into a series of alerts and concluded that they are false positives. The analyst needs to document the findings so that future analysts can avoid repeating the same investigation. What is the most important element to include in the documentation?

   • AThe time spent on the investigation
   • BThe number of alerts that were investigated
   • CThe specific evidence that led to the false positive conclusion
   • DThe names of the systems that generated the alerts
   Reveal Solution Discussion Select an answer first