2.5 Identify, Hunt, and Investigate Leads and IOCs XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–19

1. 16foundation · easy

   What is the primary outcome of a thorough investigation of an IOC in XSIAM?

   • AA determination of whether the IOC is relevant to the incident and what response is needed.
   • BThe automatic escalation of the incident to a higher severity level.
   • CThe creation of a new firewall rule to block the IOC.
   • DThe immediate deletion of all logs related to the IOC.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An incident responder is investigating a confirmed IOC: a malicious PowerShell command that was executed on a server. The command is obfuscated, and the responder cannot determine its full intent. The responder has access to process-creation logs, network logs, and file-system logs. Which investigation step is most likely to reveal the command's true purpose?

   • AAttempt to decode the obfuscated command using a known decoding script.
   • BSearch the internet for the exact command string to find a known malware analysis.
   • CCorrelate the PowerShell execution with subsequent network connections and file creations to observe the command's effects.
   • DCheck the server's patch level to determine if the PowerShell version is vulnerable.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A threat hunter wants to proactively discover IOCs related to a phishing campaign. The campaign uses email attachments with a specific file extension (.docm) and a specific subject line. The hunter has access to email gateway logs and endpoint telemetry. Which hunt strategy is most effective?

   • ASearch firewall logs for outbound connections from all users who received any email in the last 24 hours.
   • BSearch endpoint telemetry for any .docm file creation, regardless of the email subject.
   • CSearch email gateway logs for emails with the subject line and .docm attachments, then pivot to endpoint telemetry for those recipients.
   • DSearch DNS logs for domains mentioned in the email body.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices a single authentication failure for a service account at 02:17 AM, followed by a successful login from the same source IP three minutes later. The account is not normally used outside business hours. The analyst needs to determine whether this is a lead worth escalating or a benign event. Which action best aligns with XSIAM's lead identification process?

   • ACreate an incident immediately because any off-hours authentication is a confirmed IOC.
   • BBlock the source IP in the firewall because the failed-then-successful pattern is a definitive indicator of compromise.
   • CTreat the event as a lead and pivot to hunt for related activity from the same source IP and account over a broader time window.
   • DIgnore the event because a successful login means the credentials were valid and therefore the activity is authorized.
   Reveal Solution Discussion Select an answer first