2.4 Identify and Explain Exclusions and Exceptions XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team is managing XDR for a global organization. They have a correlation rule that alerts when a user accesses a sensitive folder from a new location. The team wants to suppress alerts for a group of executives who frequently travel, but they still want to be alerted if an executive's account is used from a location that is not in their travel history. What is the most appropriate exception to create?

   • ACreate a policy exception that disables the correlation rule for the executive group.
   • BCreate an IP exclusion for the executives' home and office IP addresses.
   • CCreate a correlation exception that removes the executive group from the rule's user list.
   • DCreate an alert exception that suppresses the alert when the user is in the executive group and the location is in a predefined travel list.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the impact of an exception on the detection and alerting process?

   • AIt changes the detection logic for all alerts from the same rule
   • BIt permanently disables the underlying detection rule
   • CIt increases the severity of the alert
   • DIt suppresses alerts for the specific case that matches the exception criteria
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A security administrator is troubleshooting an exclusion that is not suppressing alerts as expected. The exclusion is a path-based exclusion for a directory where a legitimate application stores logs. The administrator verifies that the path is correct and the exclusion is enabled. However, alerts are still being generated for files in that directory. What is the most likely cause of this issue?

   • AThe exclusion is scoped to a different device group than the one generating the alerts.
   • BThe exclusion is only applied to new alerts, not existing ones.
   • CThe exclusion is disabled by default after creation.
   • DThe exclusion is overridden by a higher-priority correlation rule.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A security analyst notices that the XDR platform is generating alerts for a legitimate internal vulnerability scanner. The scanner's IP address is known and static. The analyst wants to suppress alerts from this specific source while still allowing the detection engine to analyze the scanner's behavior for anomalies. What is the most appropriate exception type to create?

   • AAn alert exception that suppresses alerts when the source IP matches the scanner.
   • BA correlation exception that removes the scanner from all correlation rules.
   • CA policy exception that disables the firewall rule for the scanner's traffic.
   • DAn IP exclusion that prevents the scanner's traffic from being logged.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security administrator is reviewing the XDR platform's exclusion list and notices that an exclusion created for a legacy application is no longer needed because the application was decommissioned. The administrator wants to ensure the exclusion does not continue to suppress detections. What is the most appropriate action?

   • ADisable the exclusion but keep it in the list for reference.
   • BEdit the exclusion to apply to a different application.
   • CLeave the exclusion enabled in case the application is reinstalled.
   • DDelete the exclusion from the list.
   Reveal Solution Discussion Select an answer first