4.2 Configure Exceptions and Exclusions XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst is investigating a series of alerts that are triggered by a known software update process. The process is legitimate and occurs on a regular schedule. The analyst wants to reduce the noise from these alerts while maintaining the ability to investigate the process's activity if needed. What should the analyst do?

   • AIncrease the alert threshold for the software update process.
   • BCreate an exception for the software update process's file path.
   • CCreate an exclusion for the software update process's file path.
   • DDisable the detection rule that generates the alerts for the software update process.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security analyst is deciding whether to use an exception or an exclusion for a specific scenario. The scenario involves a known benign application that generates a high volume of alerts. The analyst wants to reduce the noise but is concerned about the impact on detection visibility. Which approach should the analyst take to minimize the impact on detection visibility?

   • AUse an exception to suppress the alerts while still processing the application's events.
   • BUse an exclusion to prevent the application's events from being processed.
   • CDisable the detection rule that generates the alerts for the application.
   • DUse both an exception and an exclusion for the application.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the impact of an exception on alert generation in XDR?

   • AAlerts are generated but automatically closed after a specified time period.
   • BAlerts are generated but only visible to administrators.
   • CAlerts are suppressed for matching detections, but the detection data remains available.
   • DAlerts are generated with reduced severity to reduce noise.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst notices that a specific internal IP scanner generates a high volume of low-severity alerts for port scanning every night. The scanner is a legitimate tool used by the network team. The analyst wants to reduce alert noise while still retaining visibility into the scanner's activity in the event log. What should the analyst configure?

   • AAn exclusion that prevents the scanner's IP address from being processed by the detection engine.
   • BA suppression rule in the firewall to block the scanner's traffic from reaching the XDR sensors.
   • CA new detection rule that reclassifies all port scanning alerts as informational severity.
   • DAn exception that suppresses alerts for the scanner's IP address while still processing the underlying events.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which of the following is a valid use case for configuring an exclusion in XDR?

   • AA user who frequently accesses cloud storage from multiple devices.
   • BA new endpoint that was just deployed and needs to be onboarded.
   • CA trusted network path between two internal servers that is known to be safe.
   • DA specific alert that was escalated to the SOC team for investigation.
   Reveal Solution Discussion Select an answer first