1.1 Identify and Describe the Different Types of Analytic Alerts XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security team wants to detect a potential data exfiltration scenario where a user downloads an unusually large amount of data from a file share compared to their historical behavior. The team wants the alert to adapt to each user's normal patterns rather than using a fixed threshold. Which type of analytic alert is best suited for this requirement?

   • AStatistical baseline alert that learns each user's typical download volume
   • BSignature-based alert that matches a known data exfiltration tool
   • CThreshold alert that triggers when any user downloads more than 1 GB in an hour
   • DCorrelation alert that joins download events with login events
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security operations team wants to detect a potential brute-force attack against their VPN gateway. They know that legitimate users occasionally mistype their passwords, so they need an alert that will only trigger when the number of failed authentication attempts from a single source IP exceeds a reasonable threshold within a short time window. Which type of analytic alert is most appropriate for this requirement?

   • AStatistical baseline alert that flags any failed login outside normal hours
   • BSignature-based alert that matches a known brute-force tool's user-agent string
   • CThreshold alert that triggers when failed logins from one source IP exceed 10 in 5 minutes
   • DCorrelation alert that joins failed logins with successful logins from the same IP
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which analytic alert type is typically generated when a detection rule matches a specific sequence of events or behaviors that are known to indicate malicious activity?

   • ABehavioral alert
   • BCorrelation alert
   • CThreshold alert
   • DStatistical anomaly alert
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An organization has a policy that requires an alert to be generated whenever a user accesses a specific sensitive folder on a file server. The alert must fire on every single access, regardless of how often it occurs. Which type of analytic alert should be configured to meet this requirement?

   • AA rule-based alert that triggers on every event matching the sensitive folder path
   • BA correlation alert that joins folder access with user login events
   • CA threshold alert that triggers after 5 accesses to the sensitive folder
   • DA statistical baseline alert that flags unusual access patterns to the folder
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security team wants to detect a specific type of malware that is known to create a file named 'update.exe' in the temp directory and then modify a specific registry key. The team wants an alert that will fire only when both of these actions are observed on the same host within a 5-minute window. Which type of analytic alert is most appropriate?

   • AStatistical baseline alert that flags unusual registry modifications
   • BThreshold alert that counts file creations in the temp directory
   • CCorrelation alert that joins the file creation and registry modification events on the same host
   • DSignature-based alert that matches the file name 'update.exe'
   Reveal Solution Discussion Select an answer first