6.5 Explain Indicator Relationships XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In what way does understanding indicator relationships improve incident response?

   • AIt automatically contains the incident
   • BIt ensures the root cause is always identified
   • CIt removes the need for threat intelligence feeds
   • DIt helps responders identify all affected systems by tracing related indicators
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A threat analyst is reviewing two indicators: a domain and a file hash. The domain is known to be malicious, and the file hash is new. The file hash was observed communicating with the domain. However, the file hash also shares a unique packing routine with a known malware family. What is the most accurate set of relationships for the file hash?

   • ADirect relationship with the domain and inferred derived relationship with the known malware family
   • BNo relationship with the domain because it is new
   • CParent-child relationship with the domain and peer relationship with the malware family
   • DDerived relationship with the domain and direct relationship with the malware family
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A threat hunter is investigating a series of phishing campaigns. The indicator graph shows that all phishing emails contain attachments that are linked to the same malware family. How does this relationship information most benefit the threat hunter?

   • AIt automatically blocks all phishing emails
   • BIt determines the exact sender of the emails
   • CIt calculates the success rate of the phishing campaign
   • DIt allows the hunter to identify all phishing emails associated with the same malware family
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An incident response team is dealing with a breach. The indicator graph shows that a compromised internal host is connected to a C2 domain, which is also connected to a file hash that is known to be a dropper. The team wants to identify all other internal hosts that may have been affected by the same dropper. What is the most effective approach using the graph?

   • AFocus only on the C2 domain and block it
   • BTraverse the graph from the file hash to find all connected internal hosts
   • CSearch for other hosts with the same IP address
   • DIgnore the graph and manually check all hosts
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An analyst is viewing a relationship graph in XSIAM. What does the graph structure primarily enable the analyst to do?

   • AAutomatically block all malicious indicators
   • BVisualize and traverse the connections between indicators
   • CGenerate new indicators from existing ones
   • DReplace the need for threat intelligence feeds
   Reveal Solution Discussion Select an answer first