5.3 Monitor Endpoint Activities XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A junior analyst is investigating a potential malware infection on a laptop. The analyst needs to see a chronological list of all processes that ran on the machine in the last 24 hours, including those that have already terminated. In XSIAM, where should the analyst look to find this information?

   • AThe Live Terminal session for the laptop, running the 'ps -ef' command to list running processes.
   • BThe Assets page for the laptop, reviewing the installed software inventory.
   • CThe Endpoint Activity Logs view, filtered by the hostname and a time range of the last 24 hours.
   • DThe Alerts page, filtered by severity, to see if any malware alerts were generated for the host.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which action is commonly used to narrow down endpoint activity logs in XSIAM?

   • AApplying a filter on the endpoint hostname or user
   • BChanging the endpoint’s IP address
   • CRebooting the endpoint to refresh the logs
   • DDeleting logs that are not relevant
   Reveal Solution Discussion Select an answer first
4. 8application · easy

   An analyst needs to review all endpoint activity for a specific user over the past week to prepare a report for a manager. The analyst wants to focus only on file-related activities (e.g., file creation, modification, deletion) and exclude process and network activities. How should the analyst configure the view in XSIAM?

   • ANavigate to the Assets page, select the user's host, and review the 'File Inventory' tab.
   • BApply a filter for the user's hostname and select the 'File' activity type in the Endpoint Activity Logs view.
   • COpen the Alerts page and filter by the user's hostname to see all file-related alerts.
   • DUse the global search bar to search for the user's name and then manually review all results.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   In the XSIAM interface, where would an analyst typically go to view endpoint activity logs?

   • AThe user management console
   • BThe firewall policy configuration page
   • CThe Logs or Search page, selecting the endpoint data source
   • DThe cloud storage settings page
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   A security operations center (SOC) manager wants to ensure that analysts can effectively use XSIAM to monitor endpoint activities. The manager is creating a training document and needs to describe the scope of what can be monitored. Which statement accurately describes the scope of endpoint activity monitoring in XSIAM?

   • AIt covers process executions, file operations, network connections, and registry changes on managed endpoints.
   • BIt covers only activities on servers, not on user workstations.
   • CIt covers only alerts generated by the endpoint security agent, not raw activity logs.
   • DIt covers only process executions and network connections, excluding file and registry activities.
   Reveal Solution Discussion Select an answer first