5.3 Monitor Endpoint Activities XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which XSIAM feature allows an analyst to see all activities related to a specific endpoint in a chronological view?

   • AThe Endpoint Timeline
   • BThe Alert Inbox
   • CThe Firewall Monitor
   • DThe User Directory
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is reviewing endpoint activity logs and notices that a user's workstation has been running a legitimate-looking application that is making frequent outbound connections to a cloud storage service. The analyst also notices that the application is reading files from a sensitive network share. The analyst suspects data exfiltration. Which combination of data sources in XSIAM would provide the strongest evidence to confirm this suspicion?

   • AExamine the firewall logs to see if the cloud storage service is allowed through the firewall.
   • BReview the application's process execution logs to confirm it is running and then check the user's authentication logs.
   • CCorrelate file access logs (showing reads from the sensitive share) with network connection logs (showing uploads to the cloud storage service).
   • DCheck the DNS logs to see if the cloud storage service's domain is being resolved frequently.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which type of endpoint activity data is typically collected by XSIAM?

   • AOnly user password hashes
   • BOnly network packet captures
   • COnly CPU temperature readings
   • DProcess execution events, file access events, and registry modifications
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of monitoring endpoint activities in XSIAM?

   • ATo replace the need for network firewalls by blocking all inbound traffic at the endpoint
   • BTo automatically patch all software vulnerabilities on managed endpoints without analyst intervention
   • CTo enforce data loss prevention policies by encrypting all files stored on endpoints
   • DTo provide visibility into user and process actions on endpoints for detecting and investigating security threats
   Reveal Solution Discussion Select an answer first
6. 20application · easy

   An analyst needs to review endpoint activity logs for a specific time window (e.g., 2:00 PM to 3:00 PM) on a particular server to correlate with a network alert that fired during that period. The analyst is currently viewing the Endpoint Activity Logs page. What is the most efficient way to narrow down the logs?

   • AUse the time range filter to set the start and end times, and add a filter for the server's hostname.
   • BSearch for the network alert ID in the endpoint activity logs to find related events.
   • CExport all logs to a CSV file and then use a spreadsheet to filter the data.
   • DScroll through the logs manually to find the relevant time period and server.
   Reveal Solution Discussion Select an answer first