2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which scenario is an example of an identity-based threat that ITDR aims to detect?

   • AA software bug causing an application to crash
   • BA misconfigured firewall rule
   • CA server overheating in the data center
   • DA user's credentials being used from an unusual location
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   An analyst is examining a series of alerts that appear to be part of a single attack. The alerts include a suspicious email, a file download, and a registry modification. The analyst wants to determine the root cause of the incident. Which forensic analysis technique is most appropriate?

   • ADelete the alerts that seem less critical to reduce noise.
   • BFocus only on the registry modification, as it is the most recent event.
   • CIsolate each alert and investigate it independently without cross-referencing.
   • DCorrelate the events across the alerts to identify a common source or pattern.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization suspects a data breach and needs to preserve evidence for potential legal action. The security team has identified relevant logs, email artifacts, and system images. What is the most critical step to ensure the evidence is admissible in court?

   • AEncrypt the evidence and store it on the analyst's personal laptop.
   • BDelete any irrelevant files to reduce the volume of evidence.
   • CCopy all evidence to a shared network drive for easy access by the investigation team.
   • DDocument who collected each piece of evidence, when, and how it was handled.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An analyst is examining multiple log sources to determine how an attacker gained access. Which forensic analysis technique is being applied?

   • AChanging user passwords to prevent further access
   • BDeleting logs that are not directly related to the alert
   • CCorrelating data across logs to identify the root cause
   • DRestoring the system from a backup
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An analyst is investigating an alert that shows a user account attempting to access a high-privilege resource. The user's normal behavior shows no such access. The analyst reviews the authentication logs and finds that the user logged in from a known corporate IP address, but the login time is unusual. What should the analyst do next to confirm or dismiss the threat?

   • ACheck if the user has a history of accessing similar resources during off-hours.
   • BIgnore the alert because the IP address is known.
   • CEscalate the alert to a senior analyst without further investigation.
   • DImmediately disable the user's account to prevent further access.
   Reveal Solution Discussion Select an answer first