2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security operations center (SOC) analyst is reviewing an alert that indicates a user's credentials were used from a location that the user has never visited. The user is currently on vacation and has not logged in recently. What is the most likely identity threat?

   • ACompromised credentials
   • BBrute-force attack
   • CPrivilege escalation
   • DInsider threat
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Why are causality chains useful in incident investigation?

   • AThey help analysts see how individual events are connected to form the full attack story
   • BThey replace the need for log analysis
   • CThey automatically remediate the incident
   • DThey provide a list of all users involved in the incident
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When investigating an identity-related alert, which data source is most directly relevant?

   • ADNS query logs
   • BNetwork firewall logs
   • CAuthentication logs
   • DPhysical access logs
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   An analyst is investigating an alert that indicates a user account was used to access a sensitive database from a new device. The user's normal behavior shows access only from a corporate laptop during business hours. The analyst checks the authentication logs and finds that the login was successful with a valid password. What additional evidence would most strongly confirm that this is a compromised account?

   • AThe user accessed the database during a scheduled maintenance window.
   • BThe user recently changed their password.
   • CThe new device is a company-issued laptop that was recently reimaged.
   • DThe new device's IP address is in a different country than the user's typical location.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which element is typically included in an incident timeline?

   • ATimestamps of events and their descriptions
   • BThe cost of the incident
   • CThe list of security tools used
   • DOnly the names of affected users
   Reveal Solution Discussion Select an answer first