6.7 Use the Attack Surface Threat Response Center to Identify, Review, Assess, Research, and Remediate Emerging Threats XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–27

1. 26foundation · easy

   In the attack surface threat response center, what does the 'assess' step primarily involve?

   • AResearching the threat actor's background
   • BIsolating affected assets from the network
   • CDetermining the potential impact and severity of a threat on the organization
   • DBlocking the threat's indicators of compromise
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   An analyst is investigating a new threat that uses a legitimate remote administration tool (RAT) for malicious purposes. The threat response center shows the RAT is installed on several servers. The organization uses the same RAT for legitimate IT support. The analyst must decide whether to remediate the threat. Which research is most important before taking action?

   • AResearch the specific TTPs of the threat actor and compare them with the organization's legitimate RAT usage patterns.
   • BUninstall the RAT from all servers immediately to eliminate the threat.
   • CIgnore the alert because the RAT is a legitimate tool and cannot be used maliciously.
   • DBlock the RAT's network traffic at the firewall to prevent any malicious use.
   Reveal Solution Discussion Select an answer first