2.3 Respond to Incidents XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An analyst is responding to an incident where a user's endpoint is infected with a worm that is spreading to other hosts on the network. The XDR platform suggests 'isolate the endpoint' and 'block the worm's propagation ports'. The analyst wants to contain the worm while minimizing the impact on the user's ability to work. What should the analyst do?

   • AOnly isolate the endpoint
   • BTerminate the worm process and block the propagation ports
   • CIsolate the endpoint and block the propagation ports
   • DOnly block the propagation ports
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC manager wants to ensure that when a specific type of alert is generated, the affected endpoint is automatically isolated, and a ticket is created in the IT service management (ITSM) system. The SOC manager also wants to allow analysts to manually trigger the same response if needed. What should the SOC manager configure?

   • AA scheduled task that runs every hour to check for alerts and isolate endpoints
   • BA firewall rule that blocks the endpoint's traffic and an email notification
   • CA manual response playbook that includes isolation and ticket creation steps
   • DAn automated response with a trigger for the alert type, including isolation and ITSM ticket creation, and also make it available for manual triggering
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is handling an incident where the XDR platform provides a remediation suggestion to 'delete a scheduled task' on an affected endpoint. The scheduled task is associated with a known malware family. However, the analyst notices that the scheduled task name is similar to a legitimate task used by the company's IT department. What should the analyst do?

   • ADelete the scheduled task immediately to remediate the threat
   • BReview the scheduled task details to confirm it is malicious before deleting
   • CDisable the scheduled task instead of deleting it
   • DIgnore the remediation suggestion and manually investigate the task
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an incident investigation, the XDR platform provides a remediation suggestion to 'block the malicious IP address' for a host that is communicating with a known command-and-control server. The analyst wants to apply this suggestion to all affected hosts in the environment. What is the most efficient way to accomplish this?

   • AManually create a firewall rule for each affected host
   • BAsk the network team to block the IP at the perimeter firewall
   • CCreate a new security policy in the XDR platform to block the IP
   • DUse the XDR platform's remediation suggestion to apply the block to all affected hosts
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of configuring automated responses in the XDR platform?

   • ATo replace the need for human analysts
   • BTo improve network performance
   • CTo reduce manual effort and response time
   • DTo generate compliance reports
   Reveal Solution Discussion Select an answer first