2.4 Identify and Explain Exclusions and Exceptions XDR-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst creates an alert exception to suppress a known false positive. After a week, the analyst notices that the exception is no longer being applied and alerts are appearing again. The exception appears in the list as enabled. What is the most likely cause of this issue?

   • AThe exception was automatically deleted by the system after a week.
   • BThe exception only applies to new alerts, not existing ones.
   • CThe exception's criteria no longer match the alert's current attributes.
   • DThe exception was overridden by a higher-priority policy rule.
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A large enterprise has a security operations team that manages XDR for 10,000 endpoints. The team is investigating a series of alerts for a legitimate software update tool. The tool's executable hash changes with each update, but the installation path is consistent. The team wants to suppress alerts for the tool without creating a broad security gap. They also need to ensure that if the tool's path is compromised, the exclusion does not hide the threat. What is the most appropriate approach?

   • ACreate a domain-based exclusion for the software update server.
   • BCreate a hash-based exclusion and update it after each software update.
   • CCreate a path-based exclusion for the tool's installation directory and enable logging for that path.
   • DDisable the correlation rule that generates alerts for the tool.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A security team is investigating a series of alerts related to a legitimate internal tool that communicates with an external API. The tool's IP address changes frequently, but its domain name is static. The team wants to suppress alerts for the tool's network traffic while preserving detection for other traffic. What is the most appropriate exclusion type to use?

   • AAn IP-based exclusion for the tool's current IP address.
   • BA hash-based exclusion for the tool's executable.
   • CA path-based exclusion for the tool's installation directory.
   • DA domain-based exclusion for the tool's API domain.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   An organization wants to allow a specific user to run a particular administrative tool that is normally blocked by a security policy. Which type of exception should be created?

   • APolicy exception
   • BFile exception
   • CCorrelation exception
   • DAlert exception
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   What is a recommended practice for maintaining exceptions to minimize security gaps?

   • ASet an expiration date for exceptions that are not intended to be permanent
   • BApply exceptions to all rules to ensure consistency
   • CCreate exceptions without a reason to save time
   • DAvoid documenting exceptions to keep the process fast
   Reveal Solution Discussion Select an answer first