5.3 Monitor Endpoint Activities XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst has identified a malicious file on an endpoint that is not currently executing but is present on disk. The analyst wants to prevent the file from being executed in the future while allowing the endpoint to remain operational. Which response action in XSIAM is most appropriate?

   • ATerminate the process associated with the file, even though it is not running.
   • BQuarantine the file to isolate it from the system and prevent execution.
   • CIsolate the entire endpoint from the network to prevent any potential communication.
   • DDelete the file from the endpoint to remove the threat completely.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   During an investigation, an analyst finds that a user's endpoint executed a PowerShell script that downloaded a binary from a file-sharing site. The analyst wants to determine if this binary was executed on any other endpoints in the organization. The analyst has already identified the SHA256 hash of the binary. Which XSIAM workflow would most efficiently accomplish this?

   • ACheck the firewall logs for connections to the file-sharing site from other internal IP addresses.
   • BInitiate a containment action on the original endpoint and then review the alert details for related events.
   • CReview the user's email logs to see if the file-sharing link was sent to other users.
   • DUse the hash in a global search across endpoint activity logs to find all executions of that file, then pivot to the affected hosts to assess the impact.
   Reveal Solution Discussion Select an answer first
4. 3application · easy

   A security team wants to monitor for unusual outbound network connections from endpoints. They are configuring XSIAM to collect the necessary data. Which type of endpoint activity data is most directly relevant for this monitoring goal?

   • AProcess execution logs that record the command line arguments of each running process.
   • BFile integrity monitoring logs that record changes to critical system files.
   • CWindows Event Logs for user logon and logoff events.
   • DNetwork connection logs that record the source and destination IP addresses and ports for each connection attempt.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following is a response action that can be initiated from XSIAM based on endpoint activity?

   • AChanging the endpoint’s operating system
   • BReplacing the endpoint’s hard drive
   • CUpdating the endpoint’s BIOS firmware
   • DIsolating the endpoint from the network
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   An analyst is investigating a suspicious process that was observed on one endpoint. The process has a valid digital signature from a known software vendor, but its behavior is anomalous (e.g., it is writing to unusual registry keys and making outbound connections). The analyst wants to determine if this process is part of a larger campaign affecting other endpoints. Which XSIAM investigation technique would be most effective?

   • ASearch for the process name and its associated file hash across all endpoint activity logs to find other executions.
   • BReview the digital signature details to confirm the vendor and check if the certificate has been revoked.
   • CExamine the process's parent process to understand how it was launched on the original endpoint.
   • DInitiate a quarantine action on the file to prevent it from executing on other endpoints.
   Reveal Solution Discussion Select an answer first