2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An organization has experienced a security incident, and the incident response team needs to collect forensic evidence. The team has identified a compromised server and needs to preserve volatile data. What is the most important action to take first?

   • ADisconnect the server from the network immediately.
   • BCapture the contents of memory from the server before powering it down.
   • CReboot the server to clear any malicious processes.
   • DCopy the hard drive to a forensic image.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An incident response team is documenting the sequence of events for a ransomware attack. They have logs from the firewall, endpoint, and email gateway. What is the most effective way to present the attack sequence to management?

   • AProvide a detailed report of each log source separately.
   • BSummarize the attack in a single paragraph without specific times.
   • CFocus only on the endpoint logs, as they are most relevant.
   • DCreate a visual timeline that integrates events from all sources.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can timeline analysis support incident response decisions?

   • ABy providing a list of all security vulnerabilities
   • BBy calculating the financial impact of the incident
   • CBy automatically sending alerts to law enforcement
   • DBy correlating events across sources to spot anomalies and inform response actions
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An analyst is reviewing a timeline of events for a potential data exfiltration incident. The timeline shows a user logging in, accessing files, and then sending an email with attachments. The analyst notices that the email was sent before the file access in the timeline. What should the analyst do first?

   • AVerify the timestamps from different sources for accuracy and consistency.
   • BConclude that the email was sent before the file access and adjust the investigation accordingly.
   • CReport the incident as a false positive because the timeline is inconsistent.
   • DIgnore the email event as it is likely a false positive.
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is building a causality chain for an incident. The evidence shows: (1) a user clicked a link in an email, (2) a browser downloaded a file, (3) the file was executed, (4) a process spawned a child process, and (5) the child process made a network connection. The analyst needs to identify the initial infection vector. Based on this chain, what is the initial vector?

   • AThe file downloaded by the browser
   • BThe email link clicked by the user
   • CThe browser used to download the file
   • DThe child process that made the network connection
   Reveal Solution Discussion Select an answer first