2.6 Interpret Incident Context Data XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is reviewing an alert that shows a connection from an internal IP to an external IP on port 22. The alert metadata includes a severity of 'medium' and a threat intelligence match for the external IP. What does the threat intelligence match add to the alert context?

   • AIt confirms that the internal IP is compromised
   • BIt provides the exact command executed on the internal host
   • CIt indicates that the external IP is known to be associated with malicious activity
   • DIt automatically blocks the connection
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which attribute is commonly used to correlate multiple events as part of the same incident?

   • AAlert severity
   • BLog source type
   • CShared source IP address
   • DUser role
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which data source provides external context about known malicious IP addresses and domains that can be used to enrich an incident?

   • AFirewall logs
   • BThreat intelligence feeds
   • CAlert metadata
   • DUser activity reports
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   An analyst sees an alert for a malware signature on a workstation. The analyst also notices a related alert for a suspicious outbound connection from the same workstation to an IP address listed in a threat intelligence feed as a known C2 server. What is the most appropriate next step to confirm the correlation?

   • AReview the threat intelligence report for the C2 server's malware family
   • BSearch for other workstations with the same malware signature
   • CCheck the timeline of both alerts to see if the outbound connection occurred after the malware detection
   • DImmediately block the C2 IP address in the firewall
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security analyst is reviewing an incident where a domain controller was compromised. The analyst needs to determine the potential impact on the organization. Which information would be most critical to include in the impact assessment?

   • AThe brand and model of the server hardware
   • BThe IP address of the domain controller
   • CThe number of users and systems that rely on the domain controller for authentication
   • DThe physical location of the domain controller
   Reveal Solution Discussion Select an answer first