4.2 Configure Exceptions and Exclusions XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company has a network segment that is used for testing and development. The security team wants to reduce noise from this segment but is concerned about completely removing visibility. They decide to create an exclusion for the segment. What is the most significant trade-off the team should be aware of?

   • AThe exclusion will suppress alerts but still allow the events to be processed.
   • BThe exclusion will prevent the XDR from detecting malicious activity that originates from the test network.
   • CThe exclusion will automatically expire after a predefined time period.
   • DThe exclusion will increase the processing load on the XDR system.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company has a dedicated backup server that performs large data transfers to a cloud storage provider every night. The XDR system is generating alerts for these transfers because they match a data exfiltration detection rule. The security team has verified that the transfers are legitimate and wants to prevent the XDR from processing these events to reduce load on the system. What should the security team configure?

   • AA firewall rule to block the backup server's traffic to the cloud storage provider.
   • BA new detection rule that changes the data exfiltration rule to only alert on weekends.
   • CAn exclusion for the backup server's IP address and the cloud storage provider's domain.
   • DAn exception for the backup server's IP address to suppress the alerts.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A company's endpoint detection and response (XDR) deployment is generating alerts for a legacy in-house application that performs unusual but benign registry modifications. The application is critical to operations and cannot be replaced. The security team wants to ensure the XDR system does not spend resources analyzing this application's behavior. What should the security team configure?

   • AAn exception for the application's file hash to suppress alerts while still analyzing its behavior.
   • BA firewall rule to block the application's network traffic to prevent it from communicating.
   • CA policy to quarantine the application on all endpoints to prevent it from running.
   • DAn exclusion for the application's file path to prevent its events from being processed by the detection engine.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary effect of configuring an exclusion in Palo Alto Networks XDR?

   • AMatching events are stored but excluded from all reports and dashboards.
   • BMatching events are quarantined and isolated from the network.
   • CMatching events generate alerts that are automatically marked as resolved.
   • DMatching events are not processed by detection logic and no detections are generated.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is documenting the difference between exceptions and exclusions for a new team member. Which statement correctly describes the primary difference?

   • AExceptions prevent events from being processed, while exclusions suppress alerts.
   • BExceptions are used for trusted processes, while exclusions are used for known false positives.
   • CExceptions suppress alerts for specific criteria, while exclusions prevent events from being processed.
   • DExceptions are permanent, while exclusions are temporary.
   Reveal Solution Discussion Select an answer first