1.1 Identify and Describe the Different Types of Analytic Alerts XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–13

1. 11expert · hard

   A security operations center is evaluating alert types for a new detection use case. They need to detect a slow and low data exfiltration attack where an attacker gradually uploads small amounts of data to an external cloud storage service over several days. The attacker's activity is designed to stay under any fixed threshold. Which type of analytic alert would be most effective for detecting this activity?

   • AA statistical baseline alert that learns normal data-upload patterns for each user and triggers when cumulative upload volume over a rolling window deviates significantly from the baseline
   • BA signature-based alert that matches the specific cloud storage service's API
   • CA correlation alert that joins upload events with login events from the same user
   • DA threshold alert that triggers when a user uploads more than 100 MB in a single hour
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security analyst is investigating an alert that fired for a user who logged in from a new device and then immediately accessed a sensitive database. The analyst determines that the user is a remote employee who frequently uses new devices and accesses the database as part of their normal job. The analyst wants to reduce false positives for this user while still detecting genuinely anomalous behavior. Which approach would be most effective?

   • ASwitch to a signature-based alert that matches the specific database access pattern
   • BIncrease the threshold for the correlation alert to require three new devices before triggering
   • CCreate a statistical baseline alert that learns this user's normal device usage and database access patterns, and trigger only when the combination of a new device and database access deviates significantly from the baseline
   • DDisable the alert for this user entirely because the behavior is normal for them
   Reveal Solution Discussion Select an answer first
3. 13application · medium

   An organization's security team is concerned about a specific malware family that is known to create a registry key with a unique name and then contact a specific command-and-control domain. The team wants to generate an alert whenever either of these two indicators is observed in the environment. Which type of analytic alert should they use?

   • ACorrelation alert that requires both the registry key and the C2 domain to appear together
   • BSignature-based alert that matches the registry key name or the C2 domain
   • CThreshold alert that counts registry key creations across the environment
   • DStatistical baseline alert that flags unusual registry modifications
   Reveal Solution Discussion Select an answer first