2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   What does a causality chain represent in incident investigation?

   • AThe chronological order of system reboots
   • BA list of all alerts generated by a single user
   • CThe hierarchy of security tools in the organization
   • DThe sequence of related events that shows how an attack progressed
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst is reviewing an alert that indicates a user account has been locked out after multiple failed login attempts. The analyst checks the authentication logs and sees that the attempts came from various IP addresses. What is the most likely identity threat?

   • APrivilege escalation
   • BInsider threat
   • CBrute-force attack
   • DCompromised credentials
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary purpose of Identity Threat Detection and Response (ITDR)?

   • ATo detect and respond to threats targeting user identities and access
   • BTo replace all other security tools in the organization
   • CTo provide physical security for data centers
   • DTo manage user passwords and access requests
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   An analyst is constructing a causality chain from an alert. Which step is part of this process?

   • ALinking related events to show the progression from initial access to later actions
   • BDeleting events that are not directly related to the alert
   • CAssigning severity scores to each event
   • DIsolating the affected systems from the network
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   An analyst reviews a user's access patterns and sees a login from a new device followed by a privilege escalation. What should the analyst do to investigate this identity threat?

   • AImmediately disable the user's account without further analysis
   • BReset the user's password and close the alert
   • CIgnore the alert because the login succeeded
   • DAnalyze authentication logs and user behavior to determine if the activity is legitimate
   Reveal Solution Discussion Select an answer first