2.3 Identify, Analyze, and Respond to Security Events and Incidents XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which scenario best describes a security incident rather than just a security event?

   • AA user receives a phishing email but does not click any links
   • BA malware infection encrypts files on several critical servers, disrupting business operations
   • CA firewall logs a blocked inbound connection attempt
   • DAn administrator changes a user's password after a routine request
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which XSIAM action is primarily used to contain an active security incident?

   • ADocumenting the incident timeline
   • BDeleting the affected user's account
   • CIsolating an affected endpoint from the network
   • DRestoring data from a backup
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   Following a phishing incident that compromised one user's credentials, the incident response team has contained the threat and restored the user's account. What is the most important next step in the post-incident phase?

   • ADelete all logs related to the incident to free up storage space.
   • BClose the incident without documenting the findings.
   • CImmediately implement a new security tool without testing it.
   • DConduct a lessons-learned review to identify gaps in detection and response processes.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An XSIAM analyst reviews a spike in alerts from a single endpoint: multiple process-creation events for 'powershell.exe' with encoded commands, followed by outbound connections to a known malicious IP. The user reports no unusual activity. What is the most appropriate initial response action?

   • ADisable the user's account immediately to prevent unauthorized access.
   • BDelete the malicious files from the endpoint to eradicate the threat.
   • CReboot the endpoint to clear any malicious processes from memory.
   • DIsolate the endpoint from the network to prevent further malicious activity while preserving evidence.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   During an incident investigation, an analyst discovers that a compromised account was used to access a database containing customer PII. The analyst needs to determine the root cause of the compromise. Which data source in XSIAM would be most useful for this analysis?

   • AEndpoint detection logs showing processes executed on the database server.
   • BNetwork traffic logs showing the volume of data transferred.
   • CAuthentication logs showing the login method and source IP for the account.
   • DDatabase access logs showing which records were read.
   Reveal Solution Discussion Select an answer first