2.5 Identify, Hunt, and Investigate Leads and IOCs XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A threat hunter is proactively searching for signs of a known adversary group that uses unique user-agent strings in HTTP requests. The hunter wants to find any host in the environment that has made such a request in the past 90 days. Which XSIAM search approach is most efficient for this hunt?

   • ASearch DNS logs for domains that are commonly associated with the adversary group.
   • BSearch authentication logs for users who logged in from IP addresses known to be used by the adversary.
   • CSearch endpoint process-creation logs for browsers that were launched with unusual command-line arguments.
   • DSearch proxy or firewall logs for HTTP requests containing the known user-agent string.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A threat hunter is looking for signs of a data-exfiltration campaign. The hunter has a confirmed IOC: a unique file size (exactly 4,194,304 bytes) that the adversary uses as a marker for compressed archives. The hunter wants to find all files of this size that were transferred out of the network in the last 30 days. Which combination of data sources will yield the most complete and reliable results?

   • ASearch endpoint process-creation logs for archiving tools and correlate with DNS logs for unusual domain queries.
   • BSearch email gateway logs for outbound messages with attachments of that size.
   • CSearch file-integrity monitoring logs for files of that size and correlate with firewall logs for outbound transfers.
   • DSearch proxy logs for HTTP POST requests and correlate with authentication logs for the sending user.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During a threat-hunting exercise, an analyst wants to discover whether any hosts in the environment have communicated with a newly published command-and-control (C2) domain. The analyst has the domain name but no associated IP addresses or file hashes. Which XSIAM hunting approach is most appropriate to start with?

   • ASearch authentication logs for users who recently visited the domain in a web browser.
   • BSearch endpoint logs for files containing the domain string in their metadata.
   • CSearch firewall logs for traffic to the domain's registered IP range.
   • DSearch DNS logs for queries resolving the domain and pivot to the responding hosts.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is reviewing a series of events: a user received a phishing email, clicked a link, and then downloaded a file. The file hash is not in any threat intelligence feed, and the file has not executed. Which statement correctly classifies these events in the context of XSIAM incident handling?

   • AThe email and link are leads, but the file hash is automatically an IOC because it came from a phishing campaign.
   • BNone of these events are leads because no compromise has been confirmed.
   • CThe phishing email, link, and file download are leads, and the file hash becomes an IOC only if analysis confirms it is malicious.
   • DThe file hash is an IOC because it was downloaded from a suspicious email.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat hunter is proactively searching for IOCs related to a newly discovered ransomware family. The family is known to create scheduled tasks with a specific name pattern (e.g., 'Updater_[random]'). Which XSIAM hunt would most effectively discover infected hosts?

   • ASearch endpoint telemetry for scheduled-task creation events with names matching the pattern.
   • BSearch authentication logs for failed logins from unknown IP addresses.
   • CSearch firewall logs for outbound connections to known ransomware C2 domains.
   • DSearch DNS logs for queries to domains that resemble the ransomware family's name.
   Reveal Solution Discussion Select an answer first