2.6 Interpret Incident Context Data XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–28

1. 26application · medium

   An analyst is investigating an incident where a user clicked a phishing link. XSIAM shows a single alert for the email, but the analyst suspects lateral movement. Which action would best help build a coherent timeline of the incident?

   • AReview the email header to identify the sender's IP address
   • BSearch for related events from the same source user and host around the time of the email click
   • CIsolate the user's workstation immediately to prevent further spread
   • DCheck the threat intelligence feed for the phishing URL's reputation
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   Which data source is most likely to contain the raw network session details, such as source and destination IP addresses, for an incident?

   • AAsset inventory databases
   • BLogs from network security devices
   • CUser directory services
   • DThreat intelligence reports
   Reveal Solution Discussion Select an answer first
3. 28application · medium

   An analyst is preparing an incident summary for a data breach involving customer records. The analyst has gathered alerts, logs, and threat intel. Which element is most important to include in the narrative to guide the response team's prioritization?

   • AThe number of alerts generated during the incident
   • BThe criticality of the affected systems and the sensitivity of the data involved
   • CThe names of the security tools that generated the alerts
   • DThe exact byte size of the exfiltrated data
   Reveal Solution Discussion Select an answer first