2.4 Identify and Explain Exclusions and Exceptions XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Which type of exclusion would be most appropriate to prevent alerts for a known internal software update tool that is frequently flagged as suspicious?

   • AIP exclusion
   • BHash exclusion
   • CDomain exclusion
   • DPath exclusion
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   How does an exclusion affect automated response actions in XDR?

   • AIt accelerates automated response actions for the excluded indicators
   • BIt prevents automated response actions from being triggered for the excluded indicators
   • CIt only affects manual response actions, not automated ones
   • DIt has no effect on automated response actions
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security analyst creates an alert exception to suppress a false positive for a specific file hash. After creating the exception, the analyst notices that alerts for the file hash are still appearing. The exception is enabled and the hash matches exactly. What is the most likely reason the exception is not working?

   • AThe exception is only applied to new alerts, not existing ones.
   • BThe exception is overridden by a higher-priority correlation rule.
   • CThe exception is disabled by default after creation.
   • DThe exception is scoped to a different device group than the one generating the alerts.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the key difference between an exclusion and an exception in XDR?

   • AExclusions are permanent, while exceptions are temporary
   • BExclusions are created by administrators, while exceptions are created by analysts
   • CExclusions are applied to detection logic, while exceptions are applied to specific alerts or rules
   • DExclusions affect only the detection engine, while exceptions affect only the response actions
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A security operations team is reviewing their XDR configuration. They have a path-based exclusion for a directory where a legitimate backup application stores compressed archives. The team wants to ensure that if a malicious file is placed in that directory, the XDR platform still provides some visibility. What is the most appropriate approach?

   • ACreate a separate alert exception for the backup application's process.
   • BRemove the exclusion entirely to ensure full detection coverage.
   • CKeep the exclusion but enable logging for the excluded path.
   • DReplace the path exclusion with a hash exclusion for each backup file.
   Reveal Solution Discussion Select an answer first