5.4 Respond to Endpoint Alerts and Incidents XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–14

1. 11application · medium

   A security analyst detects a suspicious process on a Windows endpoint that is actively communicating with an external command-and-control server. The analyst needs to stop the threat from spreading to other hosts while preserving the ability to run diagnostic commands on the affected machine. Which action should the analyst take first?

   • AIsolate the endpoint from the network
   • BOpen a live terminal and kill the suspicious process
   • CRetrieve the suspicious file for forensic analysis
   • DInitiate a malware scan on the endpoint
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which XSIAM action is specifically used to contain a threat by preventing an endpoint from communicating with other devices on the network?

   • ALive terminal
   • BMalware scan
   • CFile retrieval
   • DEndpoint isolation
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   An analyst needs to run a command directly on an endpoint to check for active network connections during an investigation. Which XSIAM feature allows the analyst to do this in real time?

   • AFile retrieval
   • BEndpoint isolation
   • CLive terminal
   • DMalware scan
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A macOS endpoint is suspected of being infected with malware that evaded the initial prevention controls. The analyst needs to identify any malicious files or processes on the system and then verify the findings by inspecting the running processes. Which combination of actions should the analyst perform?

   • AUse the live terminal to kill suspicious processes, then run a malware scan
   • BRetrieve all running process files, then run a malware scan
   • CIsolate the endpoint, then initiate a malware scan
   • DInitiate a malware scan, then use the live terminal to list running processes
   Reveal Solution Discussion Select an answer first