4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC team has deployed a correlation rule that alerts when a user account is created and then added to the Domain Admins group within 1 hour. During a two-week validation period, the rule generated 150 alerts, but only 5 were confirmed as malicious. The team wants to reduce the false positive rate while still catching the true positives. Which tuning action is most appropriate?

   • ADisable the rule and rely on manual review of all account creation events.
   • BAdd a condition that the account creation event must originate from a non-standard administrative workstation or a known attacker tool.
   • CChange the rule action from 'alert' to 'block' to prevent the activity from occurring.
   • DIncrease the time window from 1 hour to 24 hours to capture more potential attack sequences.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What happens when a detection rule that includes a BIOC condition matches an event?

   • AThe rule triggers an alert or action as configured in the rule
   • BThe rule is disabled to prevent further matches
   • CThe event is automatically deleted from the system
   • DThe BIOC is automatically updated to a new version
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of versioning for custom prevention rules?

   • ATo track changes and allow rollback to a previous configuration if needed
   • BTo increase the rule's performance by optimizing its logic
   • CTo automatically deploy the rule to all endpoints without manual intervention
   • DTo encrypt the rule so that only authorized users can view it
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is building a correlation rule to detect a multi-stage attack: an attacker exploits a web server, then uses the compromised server to scan the internal network, and finally attempts to authenticate to a domain controller. The team wants to minimize false positives while ensuring the rule catches the full attack chain. Which rule design is most effective?

   • AA rule that triggers when any of the three stages (exploitation, scanning, authentication) occur on any host within a 1-hour window.
   • BA rule that triggers when the scanning and authentication occur on the same host, without requiring the initial exploitation.
   • CA rule that triggers when the web server exploitation and the authentication attempt occur, but ignores the scanning stage.
   • DA rule that requires all three stages to occur on the same host within a 1-hour window, with the web server exploitation as the first event.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the purpose of assigning a severity level to an IOC or BIOC?

   • ATo control whether the indicator can be edited by other analysts
   • BTo determine how often the indicator is checked against events
   • CTo specify which endpoints the indicator is deployed to
   • DTo indicate the potential impact or criticality of the indicator
   Reveal Solution Discussion Select an answer first