2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An analyst is investigating an alert that shows a user account was used to reset a password and then log into a domain controller. The analyst suspects privilege escalation. Which additional evidence would most strongly confirm the privilege escalation?

   • AThe user account was recently added to the Domain Admins group
   • BThe password reset was performed by a helpdesk administrator
   • CThe user account had not logged in for 30 days
   • DThe domain controller was recently patched
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   An analyst is examining a suspicious PowerShell script captured in an XDR alert. Which forensic analysis technique would be most effective for understanding the script's obfuscated logic and its potential impact?

   • ANetwork traffic analysis of the host's connections
   • BDynamic analysis by running the script in a sandbox
   • CReviewing the user's browser history
   • DStatic analysis of the script's source code
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary role of Identity Threat Detection and Response (ITDR) in an organization's security posture?

   • ATo detect and respond to threats that specifically target identity infrastructure and credential abuse
   • BTo provide a single sign-on (SSO) portal for all enterprise applications
   • CTo manage the lifecycle of user accounts and passwords within an organization
   • DTo replace the need for traditional endpoint detection and response (EDR) solutions
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How does ITDR integrate with XDR investigations to enhance the analysis of a potential identity-based attack?

   • ABy isolating the identity provider from the network during an investigation
   • BBy automatically resetting all user passwords when an alert is triggered
   • CBy replacing the need for endpoint telemetry in the investigation
   • DBy providing identity-focused telemetry, such as authentication logs and privilege changes, alongside endpoint and network data in a single investigation view
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An analyst is reviewing an alert and has collected the following events: a logon at 10:00, a file download at 10:05, a process execution at 10:10, and a network connection at 10:15. The analyst needs to present these events in a way that shows the sequence of the attack. Which action should the analyst take?

   • ACorrelate the events with threat intelligence feeds
   • BBuild a causality chain that links events by parent-child relationships
   • CGenerate a hash of each event's associated file
   • DCreate a timeline that plots each event with its timestamp
   Reveal Solution Discussion Select an answer first