2.1 Explain the Incident Creation Process XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What is the purpose of incident data enrichment in XSIAM?

   • ATo delete unnecessary data from the incident record
   • BTo add contextual information to raw alerts, making them more useful for analysis
   • CTo automatically close incidents that are false positives
   • DTo encrypt the incident data for security
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   Within a short time window, XSIAM generates three alerts: two for the same malware hash on different endpoints and one for a phishing email that delivered the same malware. The SOC wants to handle these as a single incident. What should be configured in XSIAM?

   • AAn enrichment rule that adds the malware hash to each alert.
   • BA grouping rule that correlates alerts by the shared malware hash and campaign.
   • CA playbook that closes two of the alerts as duplicates.
   • DA manual merge of the three alerts into one incident after they are created.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which event is most likely to automatically initiate the creation of an incident in XSIAM?

   • AA user changing their password
   • BA detection rule matching a suspicious behavior pattern
   • CAn administrator reviewing audit logs
   • DA system performing a scheduled maintenance reboot
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   An alert is generated, and the correlation engine determines that it should be added to an existing incident. However, the analyst notices that the incident does not include all the context from the new alert, such as the affected user's department. What is the most likely reason for this?

   • AThe incident enrichment did not run or did not include the department field for this alert.
   • BThe alert was added to the wrong incident.
   • CThe incident was closed before the alert was added.
   • DThe grouping rule did not include the department field.
   Reveal Solution Discussion Select an answer first
6. 30expert · hard

   An incident is created from an alert about a compromised user account. The user is a low-privilege employee, but the alert indicates that the account was used to access a sensitive file share. How should the severity be assigned in XSIAM?

   • AHigh, because the account accessed sensitive data, indicating a high impact.
   • BCritical, because any account compromise is critical.
   • CLow, because the user is low-privilege.
   • DMedium, because the account is compromised but the user is low-privilege.
   Reveal Solution Discussion Select an answer first