2.3 Respond to Incidents XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is investigating an incident where a user's endpoint is running a suspicious process that is beaconing to an external IP. The XDR platform suggests 'terminate the process' and 'block the IP'. The analyst wants to stop the immediate threat while preserving the ability to investigate the process's behavior. Which combination of actions should the analyst take?

   • AQuarantine the process executable
   • BOnly block the IP
   • CTerminate the process and block the IP
   • DOnly terminate the process
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following can trigger an automated response in the XDR platform?

   • AA manual analyst command
   • BA specific alert or incident condition
   • CA scheduled time of day
   • DA change in the firewall configuration
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   After reviewing the remediation suggestions for an incident, what is the typical next step an analyst can take to apply those suggestions?

   • AManually execute the steps on each endpoint
   • BWait for the system to auto-remediate
   • CCreate a support ticket
   • DRun the suggested action directly from the console
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is responding to an incident where a user's endpoint is infected with a trojan that is using a legitimate system tool (e.g., PowerShell) to download additional payloads. The XDR platform suggests 'terminate the process' and 'quarantine the file'. The analyst is concerned that terminating the process may disrupt other legitimate uses of the system tool. What should the analyst do?

   • AQuarantine the file only, and allow the process to continue
   • BTerminate the process and quarantine the file as suggested
   • CBlock the domain used for downloading payloads
   • DInvestigate the process to confirm it is malicious before taking action
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations center (SOC) wants to automatically contain a host as soon as the XDR platform detects a high-severity malware infection. The SOC wants to avoid manual intervention for this common scenario. What should the SOC configure in the XDR platform?

   • AA manual response playbook that guides analysts through containment
   • BA scheduled report that lists all high-severity infections
   • CAn automated response that triggers on the malware detection and isolates the host
   • DA firewall rule that blocks all traffic from the host
   Reveal Solution Discussion Select an answer first