1.1 Identify and Describe the Different Types of Analytic Alerts XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst notices a recurring pattern where a single user account authenticates successfully from a new geographic location every few hours, then immediately performs a large data download from an internal file share. The analyst needs an alert that will fire only when this specific combination of behaviors occurs together, rather than when either behavior happens alone. Which type of analytic alert should the analyst configure?

   • ACorrelation alert that combines the authentication and data-download events
   • BThreshold alert that counts all authentication events from new locations
   • CStatistical baseline alert on normal data-download volume
   • DSignature-based alert matching a known malware download pattern
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A security analyst is reviewing an alert that was generated because a single user account attempted to authenticate 50 times within 10 minutes, all with incorrect passwords. The analyst wants to understand what type of alert this is. Which description best matches the alert that fired?

   • AA threshold alert that triggered because the failed login count exceeded a defined limit
   • BA correlation alert that joined failed logins with successful logins
   • CA statistical baseline alert that flagged an unusual number of failed logins for this user
   • DA signature-based alert that matched a known password-spraying tool
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An analyst notices an alert that was triggered because the number of failed login attempts for a single user exceeded 10 within a 5-minute window. Which analytic alert type does this represent?

   • ASignature-based alert
   • BStatistical anomaly alert
   • CThreshold alert
   • DCorrelation alert
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security analyst is investigating an alert that was generated when a user's account was used to log in from two different countries within 30 minutes. The analyst wants to understand what type of alert this is and how it was likely generated. Which description best matches the alert that fired?

   • AA threshold alert that counted authentication events from the same country
   • BA correlation alert that joined two authentication events from different locations for the same user
   • CA statistical baseline alert that flagged a login from an unusual country
   • DA signature-based alert that matched a known VPN client fingerprint
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst needs to detect a multi-stage attack where an attacker first exploits a web application vulnerability, then uses the compromised session to access a database, and finally attempts to exfiltrate data via an external connection. The analyst wants a single alert that will fire only when all three stages occur in sequence. Which type of analytic alert is most appropriate?

   • AThreshold alert that counts the total number of security events
   • BCorrelation alert that chains the three events in a defined sequence
   • CStatistical baseline alert that flags unusual database access patterns
   • DSignature-based alert that matches the exploit payload
   Reveal Solution Discussion Select an answer first