2.4 Apply the Native Automation Response Action XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An analyst notices that a Block IP action completed successfully but the IP address is still reachable from the network. What should the analyst check to troubleshoot this unexpected behavior?

   • AWhether the action was applied to the correct enforcement point
   • BThe analyst's role permissions
   • CThe incident's creation time
   • DThe playbook's description
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst is responding to an incident where a user's account has been compromised and is being used to send phishing emails internally. The analyst needs to stop the attacker from using the account and prevent further malicious emails from being sent. Which native automation action should the analyst use first?

   • ABlock the sender's email address
   • BReset the user's password
   • CDisable the user account
   • DDelete the phishing emails
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   During a ransomware incident, an analyst has identified the affected endpoint and wants to prevent the malware from spreading to other systems. The analyst needs to take immediate action while the incident is still being investigated. Which native automation action should the analyst execute?

   • AReset the user's password
   • BDelete the malicious file
   • CIsolate the endpoint
   • DBlock the attacker's IP address
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is troubleshooting a playbook that is supposed to block a malicious IP address on the firewall. The playbook runs successfully, but the IP address is not actually blocked. The analyst checks the execution logs and sees that the 'block IP' action returned a success status. What should the analyst investigate next?

   • ARe-run the playbook to see if the block is applied
   • BVerify that the firewall integration is correctly configured and that the action is targeting the correct firewall
   • CCheck if the playbook is using the correct IP address
   • DCheck if the IP address is already blocked
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Before deploying a new playbook that uses the Block IP action, an analyst wants to verify that the action correctly blocks the intended IP. What is the most appropriate way to test this in a controlled environment?

   • AUse a sandbox or test environment with a non-production IP address
   • BRun the playbook in production on a low-severity incident
   • CReview the playbook code without executing it
   • DAsk another analyst to confirm the configuration
   Reveal Solution Discussion Select an answer first