2.5 Identify, Hunt, and Investigate Leads and IOCs XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is investigating a lead: an unusual outbound connection from a workstation to a foreign IP address. The analyst checks the workstation's process list and finds a legitimate-looking process (svchost.exe) is the source of the connection. Which next step is most appropriate to determine if this lead is a true IOC?

   • AClose the investigation because svchost.exe is a legitimate Windows process.
   • BVerify whether the svchost.exe process is running from the expected system directory.
   • CCheck the workstation's patch level to ensure it is up to date.
   • DBlock the foreign IP address in the firewall immediately.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which of the following is an example of an indicator of compromise (IOC) that an XSIAM analyst might use to identify a security incident?

   • AA user report of a slow computer.
   • BA known malicious file hash that matches a file found on an endpoint.
   • CA suspicious email subject line that appears in a user's inbox.
   • DA new employee's username being added to a security group.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When investigating a lead in XSIAM, what is the primary purpose of correlating it with other data sources?

   • ATo automatically block the lead's source IP address.
   • BTo generate a new incident for every lead.
   • CTo delete the lead from the system.
   • DTo determine the lead's relevance and impact on the security incident.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A threat-hunting team is investigating a suspected intrusion. They have a confirmed IOC: a malicious IP address. They want to identify all internal hosts that communicated with this IP, but the firewall logs only retain 7 days of data and the suspected activity occurred 10 days ago. The team has endpoint logs retained for 30 days. Which approach will most effectively identify the affected hosts?

   • AQuery the threat intelligence feed for other domains hosted on the same IP and search for those in proxy logs.
   • BUse the firewall logs to identify hosts that communicated with the IP in the last 7 days and extrapolate to the earlier period.
   • CSearch DNS logs for queries to the malicious IP's reverse-DNS name.
   • DSearch endpoint network-connection logs for connections to the malicious IP over the full 30-day retention window.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is reviewing an alert that contains a registry key modification on a server. The registry key is not in any threat intelligence feed, but the modification occurred at the same time as a known brute-force attack on the server. Which classification is most accurate for the registry key modification?

   • AIt is an IOC because the registry key is a persistence mechanism.
   • BIt is a lead because it is suspicious but has not been confirmed as malicious.
   • CIt is neither a lead nor an IOC because registry changes are common on servers.
   • DIt is an IOC because it occurred during a known attack.
   Reveal Solution Discussion Select an answer first