2.3 Respond to Incidents XDR-ANALYST Practice Questions (Page 4)

Questions 16–17

1. 16expert · hard

   A security analyst is responding to a ransomware incident that has affected multiple endpoints. The XDR platform suggests isolating the endpoints, but the affected endpoints are domain controllers. The analyst must balance the need to contain the ransomware with the need to maintain authentication services for the rest of the network. What should the analyst do?

   • AIsolate all affected domain controllers immediately
   • BIsolate the domain controllers one at a time, starting with the least critical, while monitoring the impact
   • CTerminate the ransomware process on the domain controllers instead of isolating them
   • DBlock the ransomware's command-and-control IP at the firewall instead of isolating
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An analyst is reviewing an incident and wants to see the recommended steps to remediate the identified threat. Where in the XDR console would the analyst find these remediation suggestions?

   • AIn the firewall logs
   • BOn the incident details page
   • CIn the global settings menu
   • DIn the user profile page
   Reveal Solution Discussion Select an answer first