2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is explaining to a colleague why a causality chain is useful in an investigation. The colleague asks, 'How does a causality chain differ from a simple list of events?' Which response is most accurate?

   • AA causality chain shows the relationships between events, while a list only shows the events themselves
   • BA causality chain is used only for identity-based attacks
   • CA causality chain is always shorter than a list of events
   • DA causality chain includes only network events, while a list includes all events
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During an investigation of a privilege escalation alert, an analyst sees that a standard user account was added to the 'Domain Admins' group. Which piece of identity-focused evidence would be most important to correlate with this event to understand the attack?

   • AThe source IP address and the process or tool used to perform the group modification
   • BThe model of the user's keyboard
   • CThe user's favorite color as listed in their profile
   • DThe total number of files in the user's home directory
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating an alert that indicates a process injected code into another process. The analyst needs to preserve the evidence for further analysis. Which forensic evidence should the analyst collect first to ensure the injected code is preserved?

   • AA memory dump of the affected process
   • BThe file hash of the injecting process executable
   • CThe network connections made by the process
   • DThe Windows event logs for process creation
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is correlating events across a timeline and finds that a user logged in at 10:00, a file was downloaded at 10:05, and a process executed at 10:10. However, the analyst also finds a network connection to an external IP at 09:55, before the logon. What should the analyst conclude from this correlation?

   • AThe network connection may indicate a different attack vector or a precursor to the logon
   • BThe timeline is incorrect because the connection is before the logon
   • CThe logon is the root cause of the network connection
   • DThe network connection is unrelated to the attack
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   When constructing a causality chain from alert evidence, what is the first step an analyst should take?

   • ADocument the final impact of the attack on the business
   • BIsolate the affected endpoint from the network
   • CCollect all network logs from the firewall
   • DIdentify the initial entry point or root cause event that started the attack
   Reveal Solution Discussion Select an answer first