2.4 Apply the Native Automation Response Action XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An XSIAM analyst wants to automatically block a malicious IP address across all enforcement points when a phishing incident is confirmed. Which native automation action is designed for this purpose?

   • ACollect Forensic Evidence
   • BBlock IP
   • CIsolate Endpoint
   • DQuarantine File
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security operations center (SOC) analyst is building a playbook to automatically respond to a confirmed phishing email that has been reported by multiple users. The analyst needs to remove the email from all affected mailboxes and prevent the sender from sending further emails. Which combination of native automation actions should the analyst use?

   • ADelete the email and block the sender
   • BTag the email and add a note to the incident
   • CQuarantine the email and create an incident
   • DIsolate the affected endpoints and reset passwords
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An analyst is monitoring a playbook that automatically quarantines emails. The analyst notices that the playbook is taking longer than expected to complete and some actions are timing out. What should the analyst do to troubleshoot this issue?

   • ACheck the execution logs for the specific actions that are timing out and review their configuration
   • BIncrease the timeout value for all actions in the playbook
   • CDisable the playbook and handle incidents manually
   • DRe-run the playbook and hope it completes successfully
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An analyst uses a playbook that runs the Quarantine File action on a malicious executable detected on several endpoints. This action primarily contributes to which incident response goal?

   • ADetection
   • BEradication
   • CRecovery
   • DPreparation
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A SOC team is configuring an automation rule that triggers on high-severity incidents. The rule should run a playbook that isolates an infected endpoint. The team wants to ensure that the isolation action only runs for endpoints that are online and that the playbook does not fail if an endpoint is already isolated. What should the team configure in the playbook?

   • ASet the automation rule to run on all incidents without conditions
   • BAdd a condition to check endpoint connectivity and use an 'if already isolated' branch
   • CUse the 'isolate endpoint' action without any additional steps
   • DConfigure the playbook to run only on weekdays during business hours
   Reveal Solution Discussion Select an answer first