2.4 Identify and Explain Exclusions and Exceptions XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   An exception is not being applied to the intended alerts. What is a common troubleshooting step?

   • AVerify that the exception criteria match the alert attributes
   • BDisable the underlying detection rule
   • CIncrease the severity of the alert
   • DDelete the exception and recreate it
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When creating an exclusion in the XDR platform, what is the first step an analyst should take?

   • ASpecify the scope of the exclusion (e.g., all endpoints or specific groups)
   • BDefine the exclusion type (e.g., file, path, hash, IP)
   • CSave the exclusion
   • DEnter a reason for the exclusion
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which type of exception is used to suppress a specific alert that is determined to be a false positive, without disabling the underlying detection rule?

   • AAlert exception
   • BDetection exception
   • CPolicy exception
   • DCorrelation exception
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary difference between editing and deleting an exception in the XDR platform?

   • AEditing requires a reason, while deleting does not
   • BEditing is only for administrators, while deleting is for analysts
   • CEditing changes the exception's criteria, while deleting removes it permanently
   • DEditing affects only future alerts, while deleting affects past alerts
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A healthcare organization uses a legacy EMR application that creates temporary files in a subdirectory of the user profile. The files are deleted after each session. The security team has verified these files are benign and wants to create an exclusion in the XDR platform. They want to minimize the risk of excluding a real threat. What is the most appropriate scope for the exclusion?

   • AExclude the EMR application's executable hash.
   • BExclude the specific subdirectory path where the temporary files are created.
   • CExclude all temporary file extensions across the environment.
   • DExclude the entire user profile directory.
   Reveal Solution Discussion Select an answer first