2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of data is considered forensic evidence when investigating an alert?

   • AOnly data stored on the affected user's workstation
   • BOnly the alert text and severity score
   • COnly data that has been encrypted or protected
   • DLogs, artifacts, and system data related to the alert
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   An analyst is investigating a potential data breach and has constructed a timeline of events. The timeline shows that a user logged in, accessed a file share, and then exfiltrated data. However, the analyst notices that the file share access occurred before the login in the timeline. What is the most likely cause of this discrepancy?

   • AThe login event is a false positive.
   • BThe file share server and authentication server have different time settings.
   • CThe user accessed the file share without logging in.
   • DThe file share access was performed by a different user.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An analyst is constructing a causality chain for an incident. The evidence shows: (1) a user opened a malicious attachment, (2) a macro ran, (3) PowerShell executed a script, (4) the script downloaded a payload, and (5) the payload established persistence. The analyst needs to identify the initial infection vector. What is the initial vector?

   • AThe PowerShell script that executed
   • BThe malicious attachment opened by the user
   • CThe payload that established persistence
   • DThe macro that ran in the document
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   When building a causality chain from alert evidence, what is the first element an analyst should identify?

   • AThe initial infection vector
   • BThe final cleanup actions
   • CThe attacker's identity
   • DThe list of affected users
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   During an incident investigation, an analyst identifies the following events: (1) a phishing email was opened, (2) a macro executed PowerShell, (3) PowerShell downloaded a payload, (4) the payload created a scheduled task, and (5) the scheduled task ran a credential-dumping tool. The analyst needs to present the causality chain to management. Which representation is most accurate?

   • APhishing email → PowerShell → Macro → Payload download → Scheduled task → Credential dumping
   • BCredential dumping → Scheduled task → Payload download → PowerShell → Macro → Phishing email
   • CMacro → Phishing email → PowerShell → Payload download → Scheduled task → Credential dumping
   • DPhishing email → Macro → PowerShell → Payload download → Scheduled task → Credential dumping
   Reveal Solution Discussion Select an answer first