2.3 Identify, Analyze, and Respond to Security Events and Incidents XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary purpose of a lessons-learned review after a security incident?

   • ATo justify the cost of the incident to management
   • BTo assign blame to the individuals who caused the incident
   • CTo delete all evidence related to the incident
   • DTo identify what worked well and what can be improved in detection and response
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An organization has experienced a data breach where customer data was exfiltrated. The incident response team has identified the compromised server and the attacker's entry point. What is the most important action to take to prevent similar breaches in the future?

   • AIncrease the logging level on all servers.
   • BNotify the affected customers immediately.
   • CPatch the vulnerability that was exploited and implement additional monitoring for similar attack patterns.
   • DChange all passwords in the organization.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which activity is part of post-incident documentation?

   • AImmediately deleting all logs related to the incident
   • BWriting a detailed incident report that includes timeline, actions taken, and findings
   • CBlocking the attacker's IP address
   • DRestoring the affected systems to production
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An XSIAM analyst is reviewing alerts and notices that a user account has been locked out multiple times in the past hour. The user is in the office and reports that they have not had any login issues. What should the analyst do first?

   • AIgnore the alerts because the user is in the office and reports no issues.
   • BDisable the user's account to prevent further lockouts.
   • CReset the user's password and unlock the account.
   • DInvestigate the source of the lockout attempts in XSIAM to determine if they are coming from a malicious source.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst at a mid-sized company notices a single failed login attempt for a standard user account. The attempt came from a known internal IP address and no other suspicious activity is present. According to XSIAM incident-handling principles, how should the analyst classify this event?

   • AAs a non-security event, because failed logins are not recorded in XSIAM as security-relevant activity.
   • BAs a security incident, because all failed logins must be treated as incidents until proven otherwise.
   • CAs a security incident, because any failed login indicates a potential brute-force attack.
   • DAs a security event, because it is an observable occurrence that does not currently indicate a successful compromise or significant impact.
   Reveal Solution Discussion Select an answer first