6.4 Explain the Process of Verdict Management XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security team is investigating a file that was flagged by an internal sandbox. The file is also listed in a third-party threat intelligence feed as malicious. The sandbox verdict is 'malicious' with medium confidence, and the feed verdict is 'malicious' with high confidence. What is the most appropriate action?

   • ARely only on the threat intelligence feed because it has higher confidence.
   • BOverride the verdict to 'benign' because the confidence levels are inconsistent.
   • CCombine the evidence from both sources to raise the overall confidence and treat the file as malicious.
   • DRely only on the sandbox verdict because it is based on direct analysis.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   How does a high confidence level on a verdict typically influence response actions?

   • AIt delays the response until manual review
   • BIt has no effect on response actions
   • CIt reduces the need for further investigation
   • DIt increases the severity rating
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company uses XSIAM to protect its endpoints. A new malware variant is detected in one customer's sandbox and gets a malicious verdict with high confidence. How does this verdict influence detection on other endpoints that have not yet seen the file?

   • AThe verdict is shared only with endpoints in the same geographic region to comply with data residency.
   • BThe verdict is stored in the threat intelligence feed but requires manual approval before it can be used by other endpoints.
   • CThe verdict only affects the endpoint where the file was analyzed; other endpoints remain unprotected until they run their own sandbox analysis.
   • DThe verdict is propagated to all XSIAM components, so other endpoints will block the file based on the shared verdict.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In the verdict lifecycle, which stage occurs immediately after an initial determination is made by an automated detection engine?

   • AConfidence and severity assignment
   • BFinal disposition
   • CPropagation to other components
   • DManual review
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst overrides an automated 'malicious' verdict to 'benign' for a file that was flagged by a sandbox. Later, the same file is found to be actively exploited in the environment. What is the most likely reason the override was problematic?

   • AThe override was not propagated to other components, so only the local endpoint was affected.
   • BThe override was not logged, so the security team could not review the decision.
   • CThe override was made without sufficient evidence to contradict the high-confidence sandbox verdict.
   • DThe override changed the severity but not the confidence, so the verdict remained 'malicious'.
   Reveal Solution Discussion Select an answer first