Question 1
An XDR platform generates an alert showing a PowerShell process spawning immediately after a Microsoft Word document opened. The PowerShell command is heavily obfuscated and connects to an external IP address.
What should be the analyst's highest priority initial action?
- AOption A:
Delete the Word document from the endpoint.
- BOption B:
Validate the alert by reviewing process lineage and command-line activity.
- COption C:
Ignore the alert if the antivirus did not trigger.
- DOption D:
Reboot the endpoint immediately.
Show answer and explanation
Correct answer: B
Before taking remediation actions, an analyst should verify whether the alert represents malicious behavior. Reviewing the process tree, parent-child relationships, and PowerShell command line helps determine if the activity is legitimate or malicious.