5.4 Respond to Endpoint Alerts and Incidents XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   During an incident response, an analyst needs to determine whether a specific scheduled task on a Linux endpoint is malicious. The analyst wants to inspect the task's configuration and check for associated files without disrupting the endpoint's current operations. Which approach should the analyst use?

   • AIsolate the endpoint to prevent the task from running
   • BInitiate a full malware scan and wait for the report
   • CUse the live terminal to run 'crontab -l' and inspect the task
   • DRetrieve the entire /etc directory for offline analysis
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A Windows endpoint is infected with a worm that is attempting to propagate to other hosts on the network. The analyst needs to contain the worm and then verify that no other hosts are infected. Which sequence of actions should the analyst perform?

   • AUse the live terminal to kill the worm process, then isolate
   • BRetrieve the worm binary, then isolate the endpoint
   • CIsolate the infected endpoint, then run malware scans on other hosts
   • DRun malware scans on other hosts, then isolate the infected endpoint
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst is investigating a potential data exfiltration incident on a Windows endpoint. The analyst needs to collect the memory dump of a specific process for forensic analysis, but the endpoint is still running. Which action should the analyst take?

   • ARetrieve the process executable file for analysis
   • BIsolate the endpoint to prevent further exfiltration
   • CInitiate a malware scan to identify the process
   • DUse the live terminal to create a memory dump of the process
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst suspects that an endpoint has a malicious file but is unsure of its location. Which XSIAM feature should the analyst use to detect malicious files or processes on the endpoint?

   • AMalware scan
   • BFile retrieval
   • CEndpoint isolation
   • DLive terminal
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is responding to a ransomware outbreak on a single endpoint. The analyst needs to prevent the ransomware from encrypting files on other network shares while still being able to run a script to capture the ransomware's process tree. Which action should the analyst take?

   • AIsolate the endpoint, then use the live terminal to run the script
   • BRetrieve the ransomware binary, then isolate the endpoint
   • CRun the script first, then isolate the endpoint
   • DInitiate a malware scan, then isolate the endpoint
   Reveal Solution Discussion Select an answer first