2.6 Interpret Incident Context Data XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Which asset attribute is most useful for determining the criticality of an affected server?

   • AIts hardware manufacturer
   • BIts role in the business
   • CIts operating system version
   • DIts IP address
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which factor is most important when assessing the impact of an incident on a specific user?

   • AThe user's department
   • BThe user's last login time
   • CThe user's role and access level
   • DThe user's email address
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is investigating an alert about a compromised user account. The alert metadata shows the user's normal work hours are 9 AM to 5 PM, but the suspicious activity occurred at 3 AM. Which data source would provide the most direct evidence of the account's compromise?

   • AEmail logs showing the user's sent messages
   • BAuthentication logs showing the login location and device used at 3 AM
   • CThreat intelligence reports on recent phishing campaigns
   • DAsset inventory listing the user's assigned laptop
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary goal of synthesizing an incident narrative?

   • ATo delete irrelevant alerts
   • BTo replace the need for detailed logs
   • CTo assign blame for the incident
   • DTo provide a clear, concise summary for effective response
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   After investigating a series of alerts, an analyst has gathered the following: a phishing email, a malicious macro execution, a C2 beacon, and data exfiltration to an external IP. The analyst must present a summary to the incident response team. What is the most effective way to synthesize this information?

   • AFocus only on the data exfiltration alert because it has the highest impact
   • BList each alert separately with its severity and timestamp
   • CRecommend immediate isolation of all affected hosts without explaining the reasoning
   • DCreate a chronological narrative that links the phishing email to the macro, C2, and exfiltration as stages of the attack
   Reveal Solution Discussion Select an answer first