2.3 Respond to Incidents XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   During an incident investigation, an analyst identifies a malicious file on an endpoint. Which XDR response action is designed to remove the malicious file from the affected system?

   • ABlock the file's hash
   • BQuarantine the file
   • CDisable the user account
   • DTerminate the process
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   An analyst is investigating a compromised endpoint in the XDR console. Which response action can be taken directly from the incident details page to immediately stop further malicious activity on that endpoint?

   • ARestart the endpoint
   • BModify the firewall security policy
   • CReimage the endpoint
   • DIsolate the endpoint
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an incident, the XDR platform provides a remediation suggestion to 'delete the malicious registry key' on an affected endpoint. The analyst wants to apply this suggestion, but is concerned about the impact on the endpoint's stability. What should the analyst do before applying the remediation?

   • AIgnore the suggestion and manually delete the registry key
   • BAsk the user if the registry key is important
   • CApply the remediation immediately to minimize the threat
   • DReview the remediation suggestion details and assess the potential impact
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is handling an incident where a user's endpoint has a malicious file that is scheduled to run at startup. The XDR platform suggests 'delete the file' and 'remove the startup entry'. The analyst wants to ensure the malware does not persist after the next reboot. Which actions should the analyst take?

   • AOnly remove the startup entry
   • BOnly delete the file
   • CQuarantine the file and leave the startup entry
   • DDelete the file and remove the startup entry
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst at a financial firm is handling a confirmed ransomware incident. The XDR platform has identified a single compromised endpoint that is actively encrypting files. The analyst must stop the encryption immediately while preserving forensic evidence for later analysis. Which response action should the analyst take first?

   • AQuarantine the file that is being encrypted
   • BTerminate the malicious process on the endpoint
   • CIsolate the endpoint from the network
   • DDelete the malicious file from the endpoint
   Reveal Solution Discussion Select an answer first