6.5 Explain Indicator Relationships XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In XSIAM's relationship graph, what do nodes and edges represent respectively?

   • ANodes represent relationships; edges represent indicators
   • BNodes represent indicators; edges represent relationships
   • CNodes represent files; edges represent IP addresses
   • DNodes represent threat actors; edges represent malware families
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   In XSIAM, an analyst is investigating a file hash. The graph shows the file hash node connected to a domain node, and that domain node is connected to an IP node. The analyst wants to see all indicators that are directly connected to the file hash. What should the analyst do?

   • ANavigate to the domain node and expand it
   • BCheck the file hash's reputation score
   • CExpand the file hash node to view its immediate neighbors
   • DRun a new search for the IP address
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An incident responder is analyzing a breach. The indicator graph shows that a malicious file is connected to a C2 domain, and that domain is connected to several internal IP addresses. How does this relationship information most help the responder?

   • AIt helps identify all internal hosts that communicated with the C2 domain
   • BIt automatically quarantines the internal hosts
   • CIt calculates the financial impact of the breach
   • DIt determines the root cause of the breach
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A threat intelligence platform links two different IP addresses because they are both used by the same malware family and have similar network behavior patterns. What is the most likely basis for this relationship?

   • AGeographic proximity
   • BShared behavioral attributes
   • CIdentical file hashes
   • DDirect parent-child action
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   In XSIAM, an analyst views the indicator graph for a suspicious IP address. The graph shows the IP as a node connected to several domain nodes, and those domains are connected to file hash nodes. What does this graph structure primarily represent?

   • AThe trust score of each indicator
   • BThe relationships between indicators, with nodes as indicators and edges as relationships
   • CThe chronological order of events in the attack chain
   • DThe geographic distribution of the threat actors
   Reveal Solution Discussion Select an answer first