4.2 Configure Exceptions and Exclusions XDR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security analyst is reviewing a series of alerts triggered by a known administrative script that runs during scheduled maintenance windows. The script's behavior is well-documented and has been verified as benign. The analyst wants to reduce the noise from these alerts while maintaining the ability to see the script's activity in the logs. What should the analyst do?

   • ADisable the detection rule that generates the alerts for the entire organization.
   • BIncrease the alert threshold for all alerts to reduce the number generated.
   • CCreate an exclusion for the script's file path to prevent it from being monitored.
   • DCreate an exception that matches the script's file hash and the maintenance window time frame.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security team created an exception for a legacy application that was generating false positives. Six months later, the application was updated and its behavior changed. The team is now seeing alerts for the application again. What is the most likely reason for this?

   • AThe XDR system was restarted, which cleared the exception list.
   • BThe exception was automatically removed after a predefined time period.
   • CThe detection rule was updated to ignore exceptions for all applications.
   • DThe application's file hash changed with the update, so the exception criteria no longer match.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a recommended practice for managing exceptions and exclusions over time?

   • ADocument the reason for each exception and exclusion and review them regularly.
   • BOnly add exceptions and exclusions during major security incidents.
   • CRemove all exceptions and exclusions at the end of each month.
   • DAutomatically approve all exception and exclusion requests without review.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   In which scenario is it most appropriate to use an exclusion in XDR?

   • AA compromised endpoint that needs to be quarantined.
   • BA trusted backup process that is known to generate high volumes of benign file activity.
   • CA single alert that was investigated and found to be a false positive.
   • DA new detection rule that needs to be tested in a production environment.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team has a large number of exceptions and exclusions that were created over the past year to handle false positives from various applications and network paths. During a recent incident, the team discovered that a malicious process was able to evade detection because it was using a file path that was excluded. The team is now reviewing their exception and exclusion strategy. What is the most effective approach to prevent this from happening again?

   • ARemove all exceptions and exclusions immediately to ensure maximum visibility.
   • BConduct a regular review of all exceptions and exclusions to validate their necessity and narrow their scope.
   • CIncrease the severity threshold for all alerts to reduce the number of false positives.
   • DConvert all exceptions to exclusions to reduce the number of alerts.
   Reveal Solution Discussion Select an answer first