6.7 Use the Attack Surface Threat Response Center to Identify, Review, Assess, Research, and Remediate Emerging Threats XSIAM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A critical server is confirmed to be communicating with a known malware C2 endpoint. The threat response center shows the server has no other active alerts and is not yet showing signs of data exfiltration. The analyst needs to contain the threat while preserving the ability to collect forensic evidence. Which remediation action is most appropriate?

   • AReimage the server from a known-good backup to restore it to a clean state.
   • BPower off the server immediately to stop any further malicious activity.
   • CBlock only the specific C2 IP in the firewall and leave the server fully operational.
   • DIsolate the server from the network while keeping it powered on and preserving its memory and disk state.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   The attack surface threat response center flags a series of low-and-slow brute-force attempts against a public-facing web application. The analyst sees the source IPs are spread across multiple countries and the usernames follow a pattern consistent with a known APT group. Before deciding whether to block the IPs, what is the most valuable next step?

   • AIncrease the web application's logging level to capture more data for future analysis.
   • BBlock all the source IPs immediately because they are foreign and the pattern is suspicious.
   • CDisable the affected user accounts because the usernames match the APT's target list.
   • DResearch the APT group's TTPs to see if this pattern matches their known campaigns and whether they typically use these IPs as proxies.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An analyst is reviewing several emerging threats in the attack surface threat response center and needs to decide which to address first. What is the primary factor to consider when prioritizing threats?

   • AThe ease of remediation for each threat
   • BThe potential impact and severity of each threat on the organization's attack surface
   • CThe number of IOCs associated with each threat
   • DThe age of the threat intelligence report
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   After identifying an emerging threat in the attack surface threat response center, an analyst wants to see which assets are affected and what attack vectors are involved. Which action provides this information?

   • AReviewing the firewall rule base to see if any rules match the threat
   • BReviewing the threat details page for the specific threat
   • CRunning a packet capture on the affected network segment
   • DChecking the global threat intelligence feed for related news articles
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst is reviewing two threats in the response center: (1) a ransomware strain that has no known decryption tool and is spreading rapidly, and (2) a spyware infection on a single low-value workstation that is not spreading. The analyst must allocate limited response resources. What is the most appropriate prioritization?

   • APrioritize the ransomware because its rapid spread and lack of decryption pose a higher potential impact to the organization.
   • BDefer both threats until more information is available about their TTPs.
   • CTreat both threats equally because both are active and require immediate attention.
   • DPrioritize the spyware because it is already confirmed on a workstation and can be cleaned quickly.
   Reveal Solution Discussion Select an answer first