2.4 Identify and Explain Exclusions and Exceptions XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   An analyst wants to exclude a specific file from detection because it is a known benign executable. Which type of exclusion should they use?

   • APath exclusion
   • BDomain exclusion
   • CHash exclusion
   • DFile exclusion
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   An analyst notices that an exclusion is not suppressing alerts as expected. What is the most likely cause?

   • AThe exclusion has expired
   • BThe exclusion is applied to the wrong scope
   • CThe exclusion is too specific
   • DThe exclusion is disabled
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst needs to create an exclusion for a specific file that is known to be benign but triggers a false positive. The analyst wants to ensure the exclusion is applied only to the endpoint where the file is known to be legitimate. What is the most appropriate scope to configure when creating the exclusion?

   • AApply the exclusion to the file's hash only, without a scope.
   • BSpecify the endpoint's hostname or device group in the exclusion's scope.
   • CApply the exclusion globally to all endpoints in the environment.
   • DApply the exclusion to the file's path only, without a scope.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A security operations team is configuring XDR for a new subsidiary. The subsidiary uses a legacy application that creates files with a consistent naming pattern but in different directories across multiple servers. The team wants to suppress alerts for these files without creating a broad exclusion that could hide a real threat. They also want to ensure that if the application is compromised, the exclusion does not prevent detection of malicious files with the same naming pattern. What is the most appropriate approach?

   • ACreate a single path-based exclusion using a wildcard to cover all directories.
   • BDisable the correlation rule that generates alerts for the application's files.
   • CCreate a path-based exclusion for each directory where the application creates files.
   • DCreate a hash-based exclusion for each file the application creates.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A financial services firm deploys a proprietary trading application that writes large, frequently-updated binary files to a dedicated server. The security team has confirmed the application's behavior is benign via sandbox analysis. However, the XDR platform is generating a high volume of alerts because the binary files match a known malware hash signature. The team wants to stop the alert noise without disabling detection for the rest of the environment. What is the most appropriate action?

   • ACreate a hash-based exclusion scoped to the dedicated server's path.
   • BDisable the specific correlation rule that generates the alerts.
   • CAdd the server's IP address to a global IP exclusion list.
   • DCreate a path-based exclusion for the entire trading application directory.
   Reveal Solution Discussion Select an answer first