2.3 Identify, Analyze, and Respond to Security Events and Incidents XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   An XSIAM analyst sees an alert about multiple failed logins followed by a successful login from a new location. What is the most appropriate initial step to identify whether this is a security incident?

   • AEscalate the alert to law enforcement immediately
   • BIgnore the alert because failed logins are common
   • CCorrelate the alert with related logs and indicators to assess context and severity
   • DImmediately block the user's account
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An XSIAM analyst is investigating an alert about a user account that has been sending emails with attachments to external addresses. The user denies sending these emails. What should the analyst do to determine if this is a security incident?

   • ADisable the user's email account immediately.
   • BCheck the user's email logs to see if the emails were sent from the user's device or from a different source.
   • CIgnore the alert because the user denies sending the emails.
   • DReset the user's password and move on.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An incident response team is investigating a potential data exfiltration incident. They have identified that a large amount of data was transferred from a database server to an external IP address. The team needs to determine the root cause and scope of the incident. Which combination of data sources in XSIAM would provide the most comprehensive analysis?

   • AAuthentication logs for the database server, network traffic logs, and database access logs.
   • BDatabase access logs only, because they show which data was accessed.
   • CEndpoint detection logs from the database server only.
   • DNetwork traffic logs only, because they show the data transfer.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   After containing a malware infection, which action is part of the eradication phase?

   • ANotifying affected users
   • BMonitoring network traffic for signs of re-infection
   • CConducting a lessons-learned meeting
   • DRemoving the malware from all affected systems
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   An organization has identified a ransomware outbreak on several file servers. The incident response team has isolated the affected servers. What is the next appropriate response action?

   • AImmediately power off the servers to stop the encryption.
   • BPay the ransom to decrypt the files quickly.
   • CRestore the servers from backups that are known to be clean.
   • DDelete the encrypted files to free up space.
   Reveal Solution Discussion Select an answer first