6.4 Explain the Process of Verdict Management XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst at a financial firm reviews a verdict for a suspicious file that was flagged by an automated sandbox. The sandbox reported the file as malicious with high confidence, but the analyst notices the file is a digitally signed internal tool that was recently updated. The analyst manually changes the verdict to benign. What is the immediate next step in the verdict lifecycle after this manual override?

   • AThe verdict is sent to the threat intelligence team for a second manual review before it can be used.
   • BThe verdict is reverted to the original automated verdict after a 24-hour waiting period.
   • CThe verdict is logged in the audit trail, but no further action is taken until the next scheduled report.
   • DThe verdict is automatically propagated to all XSIAM components and integrated into detection workflows.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security operations manager needs to demonstrate to auditors that all verdict changes were justified and traceable. Which XSIAM feature directly supports this requirement?

   • AThe threat intelligence feed that provides the original verdict source.
   • BThe propagation settings that show where the verdict was distributed.
   • CThe verdict audit log that records who changed a verdict, when, and why.
   • DThe sandbox analysis report that shows the original automated decision.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst sees a verdict for a domain that is 'malicious' with low confidence. The domain is not in any blocklist, and the only evidence is a single sandbox detonation. What should the analyst do first?

   • ATreat the verdict as informational and investigate further before taking blocking action.
   • BEscalate the verdict to a high-severity incident because it is malicious.
   • CImmediately block the domain across all endpoints because the verdict is malicious.
   • DOverride the verdict to 'benign' because the confidence is low.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the final stage of the verdict lifecycle?

   • AConfidence assignment
   • BPropagation
   • CFinal disposition
   • DInitial determination
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the benefit of verdict propagation into detection workflows?

   • AIt eliminates the need for manual review
   • BIt ensures consistent enforcement across all integrated tools
   • CIt increases the confidence of the verdict
   • DIt reduces the need for threat intelligence feeds
   Reveal Solution Discussion Select an answer first