2.6 Interpret Incident Context Data XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   An analyst is investigating an incident where a user received a spear-phishing email. The analyst finds that the user then visited a malicious website and entered credentials. Which set of events should the analyst correlate to fully understand the attack?

   • AThe email delivery and the user's login history for the past month
   • BThe website visit and the user's browser version
   • CThe credential submission and the user's password change history
   • DThe email delivery, the website visit, and the credential submission
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   During an incident review, an analyst sees an alert for a suspicious PowerShell command that downloads a file from a known malicious domain. The analyst wants to understand the attacker's likely next steps. Which context would be most valuable to enrich the incident with?

   • AThreat intelligence reports detailing the TTPs associated with the malware family
   • BThe network traffic logs for the past hour
   • CThe full command-line arguments of the PowerShell process
   • DThe list of all files recently modified on the endpoint
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is assessing the impact of a malware infection on a file server that hosts both sensitive customer data and public marketing materials. The analyst must prioritize response actions. Which context is most critical to determine the severity of the incident?

   • AThe criticality of the file server and the sensitivity of the data it hosts
   • BThe malware's family and its known capabilities
   • CThe number of files that were encrypted by the malware
   • DThe time since the infection was first detected
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   An analyst is investigating an incident where a user clicked a link in a phishing email. The analyst sees an alert for the email and a separate alert for a suspicious outbound connection. The analyst wants to confirm if the outbound connection is related to the phishing email. Which approach would provide the strongest evidence of correlation?

   • AIsolate the user's workstation and wait for further alerts
   • BCheck if the user's browser history shows the phishing URL
   • CReview the email headers to see if the sender's IP matches the outbound connection's destination
   • DCompare the timestamps of the email click and the outbound connection, and check if the destination IP matches a known C2 server from threat intelligence
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security analyst in a hospital reviews an XSIAM incident triggered by an alert on a medical device. The alert metadata shows a source IP of 10.20.30.45, a destination IP of 203.0.113.10 on port 445, and a severity of 'high'. The analyst needs to quickly determine the potential impact on patient care. Which additional context is most critical to assess first?

   • AThe name of the vendor that manufactured the device
   • BThe geographic location of the destination IP address
   • CThe asset criticality and role of the medical device in the hospital network
   • DThe exact firmware version of the medical device
   Reveal Solution Discussion Select an answer first