3.5 Identify, Hunt, and Investigate Leads and Indicators of Compromise (IOCs) XDR-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the value of linking an IOC to a known threat actor or campaign?

   • AIt helps predict the actor's likely next steps based on known tactics, techniques, and procedures (TTPs)
   • BIt automatically removes the IOC from all systems
   • CIt guarantees the IOC is malicious in the current environment
   • DIt eliminates the need for endpoint detection
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst has completed an investigation into a suspicious domain and determined it is benign. The analyst needs to document the findings for future reference. What is the most important information to include in the documentation?

   • AThe reasoning behind the conclusion that the domain is benign
   • BThe date and time the investigation was started
   • CThe name of the analyst who performed the investigation
   • DThe number of alerts that were generated during the investigation
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An analyst is investigating an alert about a suspicious process that is making outbound connections to an IP address. The IP is not on any blocklist, but it is in a country where the company has no business operations. The process is a legitimate system tool that is often abused by attackers. What should the analyst do next?

   • ACorrelate the IP with threat intelligence to see if it is associated with any known campaigns
   • BBlock the IP immediately to prevent potential data exfiltration
   • CQuarantine the system to contain the potential threat
   • DIgnore the alert because the process is a legitimate system tool
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is investigating an alert about a user account that was locked out multiple times. The analyst suspects a brute-force attack. Which evidence would most strongly support this suspicion?

   • AThe user recently changed their password
   • BThe lockouts occurred during business hours
   • CThe user was accessing the system from a new device
   • DThe lockouts originated from multiple IP addresses in different countries
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An analyst receives an alert about a file hash that matches a known malware signature. The file was detected on a single workstation that is used by the marketing department. Before taking action, the analyst wants to assess the potential impact. Which step should the analyst take first?

   • AReview the marketing department's access permissions to sensitive data
   • BSearch the file hash on public threat intelligence platforms
   • CCheck if the workstation has communicated with any known command-and-control (C2) infrastructure
   • DQuarantine the workstation immediately to prevent further spread
   Reveal Solution Discussion Select an answer first