5.4 Respond to Endpoint Alerts and Incidents XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   An analyst has identified a compromised endpoint that is actively communicating with a command-and-control server. To prevent further lateral movement and contain the threat, which action should the analyst take?

   • AIsolate the endpoint
   • BInitiate a malware scan
   • CUse the live terminal
   • DRetrieve files from the endpoint
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security operations center is responding to a widespread malware campaign. An analyst has identified a compromised endpoint that is actively communicating with a C2 server. The analyst needs to contain the threat, but the endpoint is running a critical business application that cannot be stopped. Which action should the analyst take?

   • ARetrieve the C2 configuration file for analysis
   • BInitiate a malware scan and wait for the results
   • CUse the live terminal to kill the C2 process
   • DIsolate the endpoint and use the live terminal to monitor the C2 communication
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A server on the network is showing signs of compromise, and the analyst suspects the attacker is using it to pivot to other systems. The analyst needs to contain the threat while preserving the ability to collect forensic evidence from the server. Which action should the analyst take?

   • AIsolate the server and then retrieve relevant log files
   • BUse the live terminal to delete suspicious files, then isolate
   • CRun a malware scan and then isolate the server
   • DRetrieve all files from the server, then isolate
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst needs to collect a suspicious executable from an endpoint for further forensic analysis in a sandbox. Which XSIAM feature should the analyst use?

   • ALive terminal
   • BMalware scan
   • CEndpoint isolation
   • DFile retrieval
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst has isolated a compromised Windows endpoint and identified a suspicious DLL file that is loaded by a legitimate application. The analyst needs to collect the DLL for malware analysis while ensuring the endpoint remains contained. Which action should the analyst take?

   • ARemove the DLL from the endpoint immediately
   • BRetrieve the file using the endpoint file retrieval feature
   • CUse the live terminal to copy the DLL to a network share
   • DRun a malware scan to confirm the DLL is malicious
   Reveal Solution Discussion Select an answer first