2.3 Identify, Analyze, and Respond to Security Events and Incidents XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An XSIAM analyst notices a high volume of outbound traffic from a single workstation to a cloud storage service that the company does not use. The traffic occurs during business hours and the user is actively working. What should the analyst do first?

   • ABlock the workstation's internet access immediately.
   • BInvestigate the destination and the process generating the traffic in XSIAM.
   • CDisable the user's account to prevent data exfiltration.
   • DIgnore the traffic because the user is actively working.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   An analyst is investigating a malware outbreak. Which activity is part of root cause analysis?

   • ARestoring systems from backups
   • BIdentifying the initial infection vector, such as a phishing email or unpatched service
   • CListing all endpoints that show signs of infection
   • DQuarantining the infected endpoints
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   During an incident investigation, an analyst finds that a compromised account was used to access a file share containing confidential documents. The analyst needs to determine which specific files were accessed. Which data source in XSIAM would provide this information?

   • AFile access logs from the file server.
   • BAuthentication logs for the compromised account.
   • CEndpoint detection logs from the analyst's own workstation.
   • DNetwork traffic logs showing connections to the file server.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   During an incident investigation, an XSIAM analyst identifies that a specific user account was used to access a sensitive file share at 2:00 AM from an IP address outside the corporate network. The user is on vacation. What should the analyst do next to determine the scope of the incident?

   • ASearch XSIAM for other logins from the same external IP address and for any other activity by this user account.
   • BImmediately disable the user's account and reset the password.
   • CContact the user to confirm whether they accessed the file share.
   • DClose the investigation because the user is on vacation and could not have accessed the file share.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   During incident analysis in XSIAM, what does determining the 'scope' of an incident involve?

   • ACalculating the financial cost of the incident
   • BIdentifying which systems, data, and users are affected
   • CIdentifying the vulnerability that was exploited
   • DDetermining the attacker's identity and location
   Reveal Solution Discussion Select an answer first