5.3 Monitor Endpoint Activities XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What does a sudden spike in failed login attempts on multiple endpoints typically suggest?

   • AA routine password expiration event
   • BA network misconfiguration
   • CA software update being installed
   • DA brute-force attack or credential stuffing attempt
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   When investigating an endpoint activity, which action helps correlate it with other data in XSIAM?

   • ASearching for related alerts or incidents involving the same endpoint or user
   • BRebooting the endpoint to clear its memory
   • CChanging the endpoint’s hostname
   • DDisabling the endpoint’s network adapter
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   An organization is deploying XSIAM and wants to ensure they can investigate a potential insider threat where an employee is suspected of copying sensitive files to a USB drive. The analyst needs to confirm that the necessary endpoint activity data is being collected. Which data source is most critical for this investigation?

   • AProcess execution logs that record the command line of all running processes.
   • BAuthentication logs that record user logon and logoff events.
   • CFile activity logs that record file access, creation, and copy operations, including the destination device.
   • DNetwork connection logs that record all outbound connections to external IP addresses.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is reviewing endpoint activity logs and notices that a process named 'svchost.exe' is running from a non-standard path (C:\Users\Public\svchost.exe) on multiple endpoints. The analyst wants to determine if this is a legitimate Windows process or a sign of compromise. Which initial analysis step in XSIAM would be most useful?

   • ASearch the internet for the process name to see if it is a known Windows component.
   • BCompare the process path and hash against known-good Windows processes and check for other indicators of compromise on the affected endpoints.
   • CImmediately isolate all affected endpoints to prevent further spread.
   • DReview the firewall logs to see if the endpoints are communicating with known malicious IP addresses.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is investigating a series of failed logon attempts on a domain controller, followed by a successful logon from a foreign IP address. The analyst wants to determine if the successful logon led to any lateral movement. Which XSIAM investigation approach would be most effective?

   • AReview the DNS logs to see if the domain controller resolved any suspicious domains after the logon.
   • BCorrelate the successful logon event with subsequent endpoint activity logs on the domain controller and other servers to identify any new processes or connections.
   • CReset the password of the compromised account to prevent further use.
   • DBlock the foreign IP address in the firewall to prevent further access.
   Reveal Solution Discussion Select an answer first