2.5 Identify, Hunt, and Investigate Leads and IOCs XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which XSIAM feature would an analyst most likely use to proactively search for IOCs across historical data?

   • AThe firewall's block list
   • BThe incident response playbook
   • CThe XSIAM Query Builder
   • DThe alert triage queue
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is reviewing a series of events on a workstation: a USB device was plugged in, a new process (setup.exe) was created, and then the workstation made an outbound connection to a file-sharing site. The analyst needs to classify these events. Which classification is correct?

   • AThe setup.exe process is an IOC because it was created immediately after USB insertion.
   • BThe USB insertion, process creation, and outbound connection are all leads until further analysis confirms malicious intent.
   • CThe USB insertion is an IOC because it is the initial attack vector.
   • DThe outbound connection to the file-sharing site is an IOC because it indicates data exfiltration.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the primary goal of proactive hunting for IOCs in the XSIAM environment?

   • ATo confirm that all IOCs are blocked by the firewall.
   • BTo replace the need for automated alerting and detection rules.
   • CTo identify potential threats before they trigger automated alerts.
   • DTo generate new IOCs for every alert that fires.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is investigating an IOC: a file hash flagged by the threat intelligence feed. The hash was observed on a single endpoint in the environment. The analyst needs to determine whether this IOC is relevant to the current incident. Which investigation step provides the most decisive evidence of relevance?

   • AVerify that the file hash matches the vendor's published malware family name.
   • BConfirm the file was downloaded from the internet within the last 30 days.
   • CCount how many other endpoints have the same file hash stored on disk.
   • DCheck whether the file hash is present in the endpoint's running process list.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is reviewing an alert generated by XSIAM. The alert contains a source IP, a destination IP, and a file hash. The analyst wants to determine which of these artifacts are IOCs versus leads. The threat intelligence feed confirms the destination IP is a known C2 server, but the file hash is not found in any feed. Which classification is correct?

   • AThe source IP and file hash are IOCs; the destination IP is a lead.
   • BAll three artifacts are IOCs because they appear together in a single alert.
   • CAll three artifacts are leads because the alert has not yet been escalated to an incident.
   • DThe destination IP is an IOC; the source IP and file hash are leads.
   Reveal Solution Discussion Select an answer first