2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which activity is part of timeline analysis for an investigation?

   • AChanging the system clock to align timestamps
   • BCorrelating events from multiple sources to identify anomalies
   • CDeleting events that seem unimportant
   • DIsolating the affected network segment
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security analyst notices that a standard user account has been added to the local administrators group on multiple workstations. The account has no prior administrative activity. Which type of identity threat does this most likely indicate?

   • APhishing attempt
   • BDenial of service
   • CBrute-force attack
   • DPrivilege escalation
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is investigating a series of alerts and has constructed a timeline of events. The timeline shows a user login, followed by a file download, then a PowerShell execution, and finally data exfiltration. However, the analyst notices that the file download occurred before the user login in the raw logs. What is the most likely explanation?

   • AThe logs are from different sources with unsynchronized clocks, causing a time discrepancy.
   • BThe file download was performed by a different user, so it is unrelated.
   • CThe PowerShell execution caused the file download, so the order is correct.
   • DThe user login is a false positive and should be ignored.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the purpose of creating a timeline during an incident investigation?

   • ATo assign blame to specific users
   • BTo understand the sequence of actions during the incident
   • CTo automatically block malicious IP addresses
   • DTo replace the need for log analysis
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which activity is part of forensic analysis of an alert?

   • ARebooting the affected systems
   • BExamining evidence to determine the root cause of the incident
   • CImmediately blocking all network traffic
   • DNotifying the public about the incident
   Reveal Solution Discussion Select an answer first