6.7 Use the Attack Surface Threat Response Center to Identify, Review, Assess, Research, and Remediate Emerging Threats XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An analyst wants to understand the broader threat landscape behind an emerging threat, including the threat actor's tactics, techniques, and procedures (TTPs). Which type of information should the analyst research?

   • AThe list of current firewall rules
   • BThe network traffic logs for the past week
   • CThreat context, such as threat actor profiles and TTPs
   • DThe organization's asset inventory
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   The attack surface threat response center shows two emerging threats: (1) a phishing campaign targeting 50 standard users with a credential-harvesting page, and (2) a vulnerability exploit targeting a public-facing payment gateway that has no available patch. The analyst must decide which to remediate first. Which consideration should drive the decision?

   • ABoth threats should be remediated simultaneously with the same priority because they are both emerging.
   • BThe payment gateway's exposure and the lack of a patch make it the higher-priority risk despite affecting fewer assets.
   • CThe phishing campaign affects more users, so it should be remediated first regardless of the gateway's role.
   • DThe phishing campaign should be deferred because standard users are less valuable than the gateway.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   After applying a firewall rule to block a malicious C2 domain, an analyst wants to verify the remediation was effective. Which action provides the most reliable verification?

   • AReview the threat actor's TTPs to see if they are likely to change domains.
   • BAsk the network team to confirm the firewall is online and passing traffic.
   • CCheck the threat response center for new alerts involving the same domain and confirm no new traffic matches the blocked indicator.
   • DConfirm the firewall rule was saved and is in the active configuration.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst notices a sudden spike in alerts from the attack surface threat response center involving a previously unseen file hash and a pattern of internal hosts making DNS queries to a domain that was registered only 48 hours ago. What is the most appropriate way to confirm this is an emerging threat rather than a false positive?

   • AWait 24 hours to see if more alerts appear before taking any action.
   • BReview the threat details for the file hash and domain, and cross-reference them with external threat intelligence feeds.
   • CImmediately block the domain and file hash across all enforcement points.
   • DIgnore the alerts because the domain is new and new domains are often legitimate.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security operations team notices a gradual increase in alerts from the attack surface threat response center over two weeks. The alerts involve multiple different file hashes, but all share a common parent process and a similar command-line pattern. The team suspects a new campaign but is unsure if it is a single coordinated threat or multiple unrelated ones. What is the most effective way to determine this?

   • AGroup the alerts by the common parent process and command-line pattern, then research whether these are linked to a known threat actor's TTPs.
   • BTreat each file hash as a separate threat and remediate them individually.
   • CBlock all the file hashes immediately and then investigate the parent process.
   • DWait for the threat intelligence feed to publish a formal advisory before taking any action.
   Reveal Solution Discussion Select an answer first