6.5 Explain Indicator Relationships XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   An analyst is examining the indicator graph for a phishing campaign. The graph shows a phishing email node connected to an attachment node. The attachment node is connected to a malware sample node. The malware sample node is connected to a C2 domain. What is the relationship between the phishing email and the malware sample?

   • ADirect parent-child relationship
   • BNo relationship
   • CIndirect relationship through the attachment
   • DPeer relationship
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   In XSIAM, an analyst is viewing the indicator graph for a domain. The graph shows the domain node with edges to several IP nodes and a file hash node. What does the analyst learn from the edges?

   • AThe reputation scores of the connected indicators
   • BThe specific relationships between the domain and each connected indicator
   • CThe chronological order of the connections
   • DThe geographic location of the IPs
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security team notices that two different malware samples use the same unique encryption key and similar code obfuscation techniques. In XSIAM, the system automatically links these two samples. What type of relationship is most likely being inferred?

   • ANo relationship; the system is making an error
   • BDerived relationship based on shared attributes
   • CParent-child relationship based on one dropping the other
   • DPeer relationship based on same C2 server
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How does understanding indicator relationships primarily enhance threat hunting?

   • AIt reduces the number of false positives to zero
   • BIt guarantees the identification of all malicious activity
   • CIt allows analysts to identify related indicators and expand the scope of a hunt
   • DIt eliminates the need for manual analysis
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations center (SOC) is using XSIAM to prioritize alerts. An alert is generated for a suspicious file. The indicator graph shows that the file is connected to a known C2 domain and also shares a rare import table with a file that was previously associated with a targeted attack. How should the SOC prioritize this alert?

   • AHigh priority, because the file has both direct and inferred relationships to known malicious infrastructure and a targeted attack
   • BNo priority, because relationships are not reliable
   • CMedium priority, because only the C2 connection matters
   • DLow priority, because the file is not directly connected to the targeted attack file
   Reveal Solution Discussion Select an answer first