4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst is investigating a series of intrusions where attackers are using a legitimate system tool (e.g., PowerShell) to download and execute a payload, but the payload file is unique each time, so file hashes are not useful. The analyst wants to detect this behavior pattern. Which approach is most effective?

   • ACreate a BIOC that detects the sequence of PowerShell spawning a child process that makes a network connection to an external IP.
   • BCreate a correlation rule that alerts on any PowerShell execution.
   • CCreate an IOC using the PowerShell executable's hash.
   • DCreate a prevention rule that blocks all PowerShell execution.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the primary goal of tuning a correlation rule?

   • ATo increase the number of alerts generated by the rule
   • BTo reduce false positives while maintaining detection of true threats
   • CTo delete the rule after it has generated a certain number of alerts
   • DTo make the rule run faster by reducing the time window
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which action is NOT a typical action for a custom prevention rule?

   • AQuarantine
   • BBlock
   • CAlert
   • DAllow
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A threat intelligence team has provided a list of SHA256 hashes for a newly discovered malware family. The team wants to ensure that any endpoint in the environment that attempts to execute a file with one of these hashes is immediately detected. What is the most efficient way to implement this in the XDR platform?

   • ACreate a single IOC with the list of hashes and set its severity to 'critical' and expiration to a future date.
   • BCreate a custom prevention rule that blocks all file executions and add the hashes as exceptions.
   • CUpload the hashes to a threat intelligence feed and wait for the XDR to automatically update.
   • DCreate a separate correlation rule for each hash, each with its own alert action.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A threat hunter wants to detect a specific attack sequence: a user receives a phishing email, then executes a downloaded file, and within 2 minutes that same host makes a connection to an external IP on port 445. The data is available in the email, process execution, and network logs. Which correlation rule logic best models this sequence?

   • AA rule that only checks for the file execution and the network connection, ignoring the email event, within a 2-minute window.
   • BA rule that triggers when the network connection occurs and the file execution is seen on any host in the environment within the last 2 minutes.
   • CA rule that correlates events from all three log sources on the same host, ordered by timestamp, with a 2-minute maximum time gap between the file execution and the network connection.
   • DA rule that triggers if any of the three event types (email, execution, network) occur on the same host within a 2-minute window, regardless of order.
   Reveal Solution Discussion Select an answer first