2.1 Review and Investigate Alert Evidence XDR-ANALYST Practice Questions (Page 7)

Questions 31–33

1. 31expert · hard

   An analyst is building a causality chain for an incident and has identified the following events: a user received a phishing email, clicked a link, downloaded a file, executed the file, and the file established a C2 connection. The analyst needs to determine the most critical point for prevention. Which event should be considered the best target for preventive controls?

   • AThe execution of the downloaded file
   • BThe C2 connection establishment
   • CThe user clicking the link
   • DThe user receiving the phishing email
   Reveal Solution Discussion Select an answer first
2. 32application · medium · select all that apply

   An analyst is investigating an alert that involves a compromised user account. The analyst needs to collect forensic evidence to determine the scope of the compromise. Which of the following evidence sources should the analyst collect? (Select all that apply.)

   • AAuthentication logs for the user account
   • BEndpoint process execution logs
   • CNetwork connection logs for the user's workstation
   • DThe user's browser history
   • EThe user's social media posts
   Check answers Discussion Select an answer first
3. 33foundation · easy

   While correlating events on an investigation timeline, an analyst notices a 30-minute gap between the initial compromise and the next observed action. What is the most likely significance of this gap?

   • AIt proves that the attack was automated and had no human involvement
   • BIt indicates that the incident is a false positive and can be closed
   • CIt means the attacker was disconnected from the network during that time
   • DIt may indicate a period of stealthy activity or a gap in visibility where the attacker was active but not detected
   Reveal Solution Discussion Select an answer first