2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is presenting an incident to management and wants to show how a single phishing email led to a ransomware deployment. The analyst has a list of events but needs to show the cause-and-effect relationships. Which approach should the analyst use?

   • AUse a pie chart to show the proportion of event types
   • BProvide a summary of the threat intelligence report
   • CCreate a causality chain that links the email to the ransomware deployment
   • DList the events in alphabetical order
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an investigation, an analyst identifies a series of events: a phishing email was opened, a macro executed, a payload was downloaded, and a backdoor was installed. The analyst wants to present this as a single narrative to management. Which concept best describes this linked sequence of events?

   • AAn incident response plan that outlines steps to contain the threat
   • BA threat intelligence report that provides context on the malware family
   • CA causality chain that links the initial infection vector to the final backdoor
   • DA timeline that lists events in chronological order without showing relationships
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is constructing a causality chain from an alert that shows a user clicked a link in an email, which led to a browser download, which then executed a script that created a scheduled task. The analyst needs to identify the root cause of the incident. Which element should be considered the root cause in this chain?

   • AThe browser download that occurred
   • BThe user clicking the link in the email
   • CThe scheduled task that was created
   • DThe script that executed
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices an alert for a user account that successfully authenticated from a new geographic location and then immediately attempted to access a high-privilege resource. The analyst wants to understand if this is an identity-based threat. Which XDR feature is specifically designed to detect and respond to such identity-related anomalies?

   • ANetwork traffic analysis to identify unusual data exfiltration patterns
   • BIdentity Threat Detection and Response (ITDR) to monitor authentication and access patterns
   • CEndpoint detection and response to analyze process execution on the user's device
   • DCloud security posture management to review misconfigured cloud resources
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   During an XDR alert investigation, an analyst needs to examine the original command-line arguments passed to a suspicious process. Which type of forensic evidence in the alert would most directly provide this information?

   • AUser authentication logs
   • BProcess execution telemetry
   • CFile hash reputation data
   • DNetwork session logs
   Reveal Solution Discussion Select an answer first