6.7 Use the Attack Surface Threat Response Center to Identify, Review, Assess, Research, and Remediate Emerging Threats XSIAM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   The threat response center shows a new alert for a 'fileless' attack using PowerShell on a single workstation. The analyst has limited time and must decide whether this is a priority. The workstation is a standard user's machine, and the PowerShell command is obfuscated. What is the most appropriate way to assess this threat?

   • AResearch the obfuscated PowerShell command's behavior and correlate it with known fileless attack TTPs to assess its potential impact.
   • BImmediately isolate the workstation because fileless attacks are always critical.
   • CBlock all PowerShell execution across the organization to prevent similar attacks.
   • DIgnore the alert because the workstation is a standard user's machine and fileless attacks are rare.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An analyst is tasked with identifying emerging threats in XSIAM. Which action is most appropriate for this task?

   • AReview the user access review report to identify unauthorized account changes
   • BGenerate a compliance report for the latest regulatory standards
   • CNavigate to the attack surface threat response center and review the emerging threats summary
   • DOpen the firewall log viewer and manually search for unusual port activity
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A threat card in the attack surface response center shows a 'data exfiltration' alert involving a finance department file server. The threat details include a list of outbound connections to an external IP and a set of file names that were accessed. The analyst needs to determine the scope of the breach. Which detail is most critical to review?

   • AThe threat actor's suspected motivation and whether they are known for financial crimes.
   • BThe external IP's geolocation and the ISP that hosts it.
   • CThe full list of affected assets and the specific files that were accessed or transferred.
   • DThe number of alerts generated by the firewall in the last hour.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst opens the attack surface threat response center and sees a new alert about a 'credential stuffing' campaign targeting the organization's VPN portal. The alert lists 12 affected user accounts and a known botnet C2 domain. The analyst needs to determine how urgent this is compared to other open alerts. Which action best prioritizes this threat?

   • ASearch the threat intelligence feed for the botnet's TTPs to confirm it is a known group before prioritizing.
   • BImmediately block the C2 domain across all firewalls to stop the campaign before assessing impact.
   • CReview the affected accounts' roles and the VPN's exposure to the internet, then compare the potential business impact against other open alerts.
   • DCheck the alert's timestamp and prioritize it as the newest alert in the queue.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A threat card shows a 'lateral movement' alert where a compromised workstation used SMB to access a file server. The threat details include the source workstation, the destination file server, and the specific files accessed. The analyst must determine the extent of the lateral movement. Which detail is most critical to review in the threat details?

   • AThe total number of alerts in the response center for the last 30 days.
   • BThe list of all other assets that the compromised workstation has communicated with via SMB or other protocols.
   • CThe file server's operating system version and patch level.
   • DThe threat actor's preferred lateral movement tools and techniques.
   Reveal Solution Discussion Select an answer first