2.2 Review and Investigate Alert Evidence XSIAM-ANALYST Practice Questions (Page 7)

Questions 31–33

1. 31application · medium

   During an investigation, an analyst has collected logs from a firewall, an endpoint, and an authentication server. The analyst needs to understand the sequence of actions taken by an attacker. What is the best way to present this information?

   • ACreate a timeline that merges events from all sources in chronological order.
   • BAnalyze each log source separately and document findings in separate reports.
   • CFocus on the endpoint logs only, as they are most likely to contain the attack details.
   • DSummarize the logs in a single paragraph without specific timestamps.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   During an incident investigation, an analyst collects log files, memory dumps, and system images from affected hosts. Which practice is essential to preserve the integrity of this evidence for potential legal or disciplinary proceedings?

   • AImmediately analyzing the evidence on the original system to avoid altering it
   • BDeleting any files that appear irrelevant to the investigation to reduce clutter
   • CDocumenting who collected each item, when, and how, and ensuring the evidence is securely stored
   • DStoring copies of the evidence on the analyst's personal cloud drive for easy access
   Reveal Solution Discussion Select an answer first
3. 33application · medium

   An analyst is explaining to a junior team member how a causality chain helps in incident investigation. Which statement best describes the purpose of a causality chain?

   • AIt provides a summary of the incident for management.
   • BIt links related events to show the progression of an attack from initial vector to impact.
   • CIt identifies the user responsible for the incident.
   • DIt lists all alerts in the order they were generated by the SIEM.
   Reveal Solution Discussion Select an answer first