5.3 Monitor Endpoint Activities XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of initiating a response action like 'quarantine file' in XSIAM?

   • ATo encrypt the file with a new key
   • BTo remove the file from the endpoint and prevent it from executing
   • CTo make the file read-only for all users
   • DTo copy the file to a backup server
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a common source of endpoint activity data in XSIAM?

   • AFirewall traffic logs only
   • BCortex XDR agents installed on endpoints
   • CDNS server logs only
   • DCloud access security broker (CASB) reports
   Reveal Solution Discussion Select an answer first
4. 13application · easy

   A manager asks a security analyst to explain the value of monitoring endpoint activities in XSIAM beyond just reviewing alerts. The analyst needs to articulate the primary purpose of this monitoring capability. Which statement best describes the purpose?

   • AIt focuses exclusively on network traffic to identify external threats, ignoring local process and file activity.
   • BIt replaces the need for traditional antivirus software by automatically blocking all malicious files.
   • CIt provides a comprehensive record of endpoint behavior that can be used to detect anomalies, investigate incidents, and support response actions.
   • DIt generates alerts for every single action taken on an endpoint, ensuring no event is missed.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is reviewing endpoint activity logs and notices that a standard user account executed a series of administrative commands (e.g., 'net localgroup administrators' and 'reg add HKLM\...') in a short time window. The user has no administrative privileges. The analyst suspects privilege escalation. Which additional data source in XSIAM would be most valuable to confirm this suspicion?

   • AExamine the endpoint's firewall logs to see if any new rules were added.
   • BReview the DNS logs to see if the endpoint resolved any suspicious domains.
   • CCorrelate the process execution logs with authentication logs to see if a privileged account was used to run the commands.
   • DCheck the file integrity logs to see if any system binaries were modified during the same time window.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which statement best describes the scope of endpoint activity monitoring in XSIAM?

   • AIt covers network traffic between endpoints and the internet, but not local process activity
   • BIt covers a wide range of endpoint activities, including process execution, file access, and user logins
   • CIt covers only file integrity changes on servers, excluding workstations
   • DIt covers only activities initiated by privileged users, ignoring standard user actions
   Reveal Solution Discussion Select an answer first