6.7 Use the Attack Surface Threat Response Center to Identify, Review, Assess, Research, and Remediate Emerging Threats XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   The threat response center shows a new alert for a 'DLL side-loading' technique on several engineering workstations. The analyst wants to understand if this is a targeted attack or a widespread commodity malware campaign. Which research action is most informative?

   • AResearch the threat actor profiles and TTPs associated with the specific DLLs and the delivery method observed.
   • BReview the engineering workstations' patch levels to see if they are outdated.
   • CIsolate the workstations immediately to prevent further spread.
   • DCheck the total number of alerts across all customers in the threat intelligence portal.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   The threat response center flags a new attack pattern targeting a legacy application that the organization cannot easily patch. The pattern matches a known exploit kit, but the organization's threat intelligence feed has not yet published a signature. The analyst needs to determine if the organization is at risk. Which research approach is most effective?

   • AResearch the exploit kit's TTPs and compare them with the organization's current controls and the legacy application's exposure.
   • BWait for the threat intelligence feed to publish a signature before assessing risk.
   • CAssume the organization is at risk because the exploit kit is known and the application is legacy.
   • DDisable the legacy application immediately to eliminate the risk.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A confirmed malware infection is found on a domain controller. The malware is beaconing to a C2 server, but the organization cannot afford to take the domain controller offline because it provides authentication for all users. The analyst must contain the threat while maintaining business operations. Which approach best balances containment and availability?

   • ABlock the C2 communication at the firewall and isolate the domain controller's outbound traffic while keeping it available for authentication.
   • BPower off the domain controller immediately to stop the malware completely.
   • CReimage the domain controller from backup during business hours to restore it to a clean state.
   • DLeave the domain controller online and only monitor the C2 traffic to gather more intelligence.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   An analyst has identified an emerging threat and wants to remediate it. Which action is an example of a remediation response?

   • ADocumenting the threat in a report
   • BBlocking the threat's indicators of compromise
   • CAssessing the threat's severity
   • DReviewing the threat's TTPs
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is an example of researching threat context for an emerging threat?

   • ABlocking the threat's command-and-control IP addresses
   • BChecking the affected assets' patch levels
   • CIsolating the affected server from the network
   • DReviewing the threat actor's known TTPs and motivations
   Reveal Solution Discussion Select an answer first