2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst is correlating events on a timeline and observes that a user logged in from a new device, then immediately accessed a sensitive file share, and then the file share was encrypted. What pattern does this sequence reveal?

   • AA network misconfiguration that caused the encryption
   • BA false positive caused by a scheduled backup job
   • CA likely attack narrative of credential compromise followed by data access and destructive action
   • DA normal user workflow that requires no further investigation
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An analyst is building a causality chain and sees that 'Process A' launched 'Process B', which then created a file. How should the analyst represent this relationship in the chain?

   • AProcess A → Process B → File creation
   • BProcess B → Process A → File creation
   • CFile creation → Process B → Process A
   • DProcess A → File creation → Process B
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When creating a timeline from alert evidence, which data point is most essential to include for each event?

   • AThe timestamp of when the event occurred
   • BThe name of the analyst who reviewed the alert
   • CThe color of the icon in the XDR interface
   • DThe severity rating of the alert
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has implemented ITDR to enhance its security posture. An analyst receives an alert about a user account that was used to access a sensitive database from an unusual location. The analyst wants to understand how ITDR contributes to the investigation. Which statement best describes ITDR's role in this scenario?

   • AITDR scans endpoints for malware signatures
   • BITDR provides real-time monitoring of authentication and access patterns to detect identity-based threats
   • CITDR manages firewall rules to block malicious IPs
   • DITDR analyzes network traffic to identify data exfiltration attempts
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does a causality chain help an analyst understand the progression of an attack?

   • ABy showing the physical location of servers in a data center
   • BBy showing the parent-child relationships between processes and their subsequent actions
   • CBy listing the IP addresses of all known threat actors
   • DBy providing a summary of the organization's security policies
   Reveal Solution Discussion Select an answer first