5.3 Monitor Endpoint Activities XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–27

1. 26foundation · easy

   When analyzing endpoint activity data, which pattern is most likely to indicate a security incident?

   • AA process executing a PowerShell command that downloads and runs an executable from an external IP
   • BA scheduled backup task running at its usual time
   • CA user logging in during normal business hours from a known workstation
   • DA user accessing a frequently used internal file share
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   An analyst has confirmed that a specific endpoint is running a malicious process that is actively communicating with a known command-and-control server. The analyst needs to stop the threat immediately while preserving the ability to perform further forensic analysis on the host. Which response action in XSIAM best meets this requirement?

   • ABlock the command-and-control server's IP address in the firewall and leave the endpoint running.
   • BIsolate the endpoint from the network while leaving the host powered on for continued data collection.
   • CTerminate the malicious process and then delete the associated binary from disk.
   • DReboot the endpoint to clear the malicious process from memory.
   Reveal Solution Discussion Select an answer first