2.4 Identify and Explain Exclusions and Exceptions XDR-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In the context of XDR, what is the primary purpose of an exclusion?

   • ATo automatically respond to a threat without analyst intervention
   • BTo suppress alerts or detection logic for specific indicators or entities that are deemed benign
   • CTo prevent certain data from being collected or analyzed by the XDR platform
   • DTo permanently remove a detected threat from the environment
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security analyst creates an alert exception to suppress a false positive for a specific user's login activity. The exception is configured with the user's username and a specific source IP. After a week, the analyst notices that alerts are appearing for the same user from a different source IP. The exception is still enabled and the username matches. What is the most likely reason the exception is not suppressing the new alerts?

   • AThe exception is overridden by a higher-priority policy rule.
   • BThe exception was automatically disabled after a week.
   • CThe exception only applies to the first alert from a user.
   • DThe exception's criteria include the source IP, so alerts from a different IP do not match.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the XDR platform, what does the 'scope' of an exclusion define?

   • AThe type of indicator being excluded (e.g., file, IP)
   • BThe endpoints, user groups, or other entities to which the exclusion applies
   • CThe duration for which the exclusion is active
   • DThe specific value of the indicator (e.g., a particular file path)
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A security analyst creates a file-path exclusion for a directory where a development team stores build artifacts. After the exclusion is applied, the analyst notices that alerts for a specific malware family are no longer appearing, but the team confirms the malware is not present in the build directory. What is the most likely reason for the missing alerts?

   • AThe exclusion is blocking the malware's network traffic, not just file detections.
   • BThe exclusion is matching more broadly than intended, such as a parent directory or a wildcard pattern.
   • CThe malware family is no longer active in the environment.
   • DThe exclusion is only applied to new alerts, not existing ones.
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   In the XDR platform, how can an analyst temporarily stop an exclusion from being applied without deleting it?

   • ADelete the exclusion
   • BDisable the exclusion
   • CEdit the exclusion to change its scope
   • DCreate a new exclusion with a different type
   Reveal Solution Discussion Select an answer first