2.6 Interpret Incident Context Data XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   An analyst is writing an incident summary for a ransomware attack that encrypted files on a file server. The analyst has identified the initial access vector (phishing email), the malware used, and the affected server's criticality. What is the most important element to include in the summary to guide the response?

   • AThe recommended containment actions based on the attack vector and affected assets
   • BThe name of the antivirus product that detected the malware
   • CThe IP address of the file server
   • DThe exact number of files encrypted
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is investigating a series of alerts that show multiple internal hosts communicating with the same external IP. Threat intelligence indicates the IP is a known C2 server for a specific malware family. What does this correlation reveal about the incident?

   • AThe external IP is a legitimate service used by the organization
   • BThe incident likely involves a coordinated compromise of multiple hosts by the same malware
   • CThe internal hosts are all running the same operating system
   • DThe incident is a false positive and can be closed
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   How does threat intelligence enrich incident data with attacker tactics, techniques, and procedures (TTPs)?

   • ABy automatically blocking all malicious traffic
   • BBy providing a list of all affected users
   • CBy mapping observed behaviors to known adversary frameworks
   • DBy replacing the need for log analysis
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   An analyst is investigating an alert that shows a user logged in from an unusual location. The analyst has access to authentication logs, threat intelligence, and asset inventory. The user is a high-privilege administrator. Which combination of data sources would provide the most comprehensive context to determine if this is a real threat?

   • AThreat intelligence and asset inventory only
   • BAuthentication logs to verify the login event, threat intelligence to check the source IP, and asset inventory to confirm the user's assigned device
   • CAuthentication logs and asset inventory only
   • DAuthentication logs and threat intelligence only
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   In an alert, which metadata field indicates the relative importance or urgency of the alert?

   • ASource IP
   • BTimestamp
   • CSeverity
   • DAlert ID
   Reveal Solution Discussion Select an answer first