6.5 Explain Indicator Relationships XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A security team is analyzing two separate malware samples. Sample A and Sample B are not directly connected in the indicator graph, but both use the same rare encryption key and have similar code structure. The team wants to determine if they are related. What is the most appropriate action?

   • ATreat them as peers because they are both malware
   • BTreat them as unrelated because there is no direct edge
   • CTreat them as parent-child because they share code structure
   • DTreat them as related based on the shared attributes, and investigate further for common origin
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   An analyst is using the XSIAM indicator graph to investigate a malware outbreak. The graph shows a central node (the dropper) with edges to multiple file hashes. Each file hash has edges to different C2 domains. What does this graph structure indicate about the outbreak?

   • AThe file hashes are all identical
   • BMultiple droppers are responsible for a single malware variant
   • CThe C2 domains are all controlled by the same actor
   • DA single dropper is responsible for multiple malware variants, each with its own C2 infrastructure
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Two malware samples are linked because they share the same packing algorithm and similar code structure. Which type of data is most directly used to infer this relationship?

   • AShared attributes
   • BThreat actor profiles
   • CBehavioral data
   • DContextual data
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security analyst notices that a new malware sample uses the same packing algorithm as a known threat group's malware. The system automatically links the new sample to the known threat group's indicators. What is the most likely basis for this relationship?

   • AShared behavioral or code attributes
   • BDirect communication between the samples
   • CGeographic location of the servers
   • DSame file size
   Reveal Solution Discussion Select an answer first