2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   During an incident investigation, an analyst finds a suspicious process that spawned multiple child processes, each connecting to different external IPs. The analyst needs to determine the full scope of the attack. Which forensic analysis technique would be most effective in revealing the complete attack narrative?

   • AHash the suspicious process executable and search for the hash in threat intelligence feeds
   • BIsolate the endpoint from the network and capture a memory dump for offline analysis
   • CReview the Windows Event Logs for logon events around the time of the attack
   • DBuild a process tree from the parent-child relationships and correlate with network connections
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   During a forensic analysis of a Windows endpoint alert, an analyst examines the memory dump of a compromised host. What type of information is most likely to be found in this memory analysis that is not typically available in disk-based logs?

   • AThe historical DNS query logs from the network firewall
   • BThe content of a malicious process's decrypted payload in memory
   • CThe original installation date of the operating system
   • DThe list of files that were deleted from the filesystem
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An XDR alert shows a user account successfully authenticating from a new geographic location at 3:00 AM, followed by a request to reset the account's password. Which identity-focused evidence is most critical to examine first to determine if this is a compromised credential?

   • AThe version of the operating system on the user's laptop
   • BThe user's recent authentication history and the context of the new location
   • CThe user's manager's approval for the password reset
   • DThe IP address of the user's email server
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst is investigating an XDR alert and needs to preserve the original, unmodified alert data for potential legal proceedings. Which practice is most appropriate for preserving this forensic evidence?

   • ATaking screenshots of the alert details and saving them as PDFs
   • BExporting the raw alert data and associated logs to a secure, immutable storage location
   • CCopying the alert details into a shared spreadsheet for the incident response team
   • DDeleting the alert after documenting the key findings in the case notes
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is examining a timeline of events and notices that a user logged in at 09:00, but the next event is a file exfiltration at 14:00. The analyst suspects there may be missing events that would explain the gap. What should the analyst do to investigate this gap?

   • AIgnore the gap because the timeline is complete
   • BReport the incident as contained because no other events occurred
   • CConclude that the user was idle during that period
   • DSearch for additional logs from other sources, such as network or endpoint logs, to fill the gap
   Reveal Solution Discussion Select an answer first