2.4 Apply the Native Automation Response Action XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A SOC analyst is responding to an incident where a malicious file has been detected on multiple endpoints. The analyst needs to remove the file from all affected endpoints and prevent it from executing again. Which native automation action should the analyst use?

   • ABlock the file's hash on the firewall
   • BDelete the file from one endpoint and replicate the action
   • CQuarantine the file on all affected endpoints
   • DIsolate all affected endpoints
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During an active ransomware incident, an analyst runs a playbook that uses the Isolate Endpoint action on all affected hosts. This step is part of which phase of the incident response lifecycle?

   • APreparation
   • BDetection and Analysis
   • CContainment, Eradication, and Recovery
   • DPost-Incident Activity
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC team is responding to a ransomware incident that has affected several endpoints. The team has a playbook that isolates endpoints and blocks the ransomware's command-and-control (C2) IP addresses. However, the team is concerned that isolating the endpoints will disrupt business operations. What should the team do to balance containment and business continuity?

   • AIsolate all affected endpoints immediately
   • BBlock the C2 IP addresses and do not isolate endpoints
   • CIsolate only the endpoints that are actively communicating with the C2 IP addresses
   • DIsolate the endpoints only during non-business hours
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A SOC team is responding to a widespread phishing campaign that has delivered malicious emails to hundreds of users. The team has a playbook that quarantines emails and blocks the sender. However, the playbook is running slowly because it processes emails one by one. The team needs to speed up the response while ensuring that all emails are handled. What should the team do?

   • AModify the playbook to use a loop that processes emails in parallel
   • BManually quarantine the emails for the most critical users
   • CIncrease the timeout for the playbook
   • DCreate a new playbook for each user
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   An analyst notices that a playbook designed to isolate endpoints on high-severity incidents has failed for the last three incidents. The analyst checks the execution logs and sees that the 'isolate endpoint' action is failing with an 'endpoint not found' error. What is the most likely cause of this failure?

   • AThe endpoint is already isolated
   • BThe endpoint ID is not being passed correctly to the action
   • CThe endpoint is offline
   • DThe playbook is not triggered on high-severity incidents
   Reveal Solution Discussion Select an answer first