4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   An organization has a custom prevention rule that blocks the execution of a specific file name (e.g., 'update.exe') to prevent a known malware variant. However, a legitimate software updater also uses the same file name, causing the rule to block legitimate updates. The security team needs to allow the legitimate updater while still blocking the malware. Which configuration is most appropriate?

   • AModify the rule to block the file name only when it is executed from a temporary directory.
   • BAdd an exception to the rule based on the file's digital signature or publisher, allowing the legitimate updater while blocking the unsigned or different-signed malware.
   • CDelete the rule and rely on other detection methods for the malware.
   • DChange the rule action from 'block' to 'alert' to avoid disrupting the legitimate updater.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of a correlation rule in an XDR platform?

   • ATo automatically remediate any detected threat without requiring analyst review
   • BTo aggregate and analyze events from multiple data sources to detect complex threats that span those sources
   • CTo store raw event logs in a centralized repository for later forensic analysis
   • DTo replace the need for individual detection rules by using a single rule for all threats
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is an example of an IOC?

   • AA specific SHA256 hash of a known malware file
   • BThe number of installed applications
   • CA user's login time
   • DThe version of the operating system
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A security analyst is creating a correlation rule to detect a potential data exfiltration scenario: a user downloads a large file from an internal server and then uploads it to an external cloud storage service within a short time. The analyst wants to ensure the rule is precise and does not generate alerts for normal file transfers. Which rule design is most effective?

   • AA rule that triggers when a large file is downloaded and uploaded, but does not require the same user.
   • BA rule that correlates a large file download from an internal server followed by an upload to an external cloud service by the same user within a 15-minute window.
   • CA rule that triggers on any upload to an external cloud service.
   • DA rule that triggers on any large file download from an internal server.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations team has imported a large list of IOCs from a third-party feed. The team wants to ensure that the most critical IOCs are prioritized in alerting and that stale indicators do not generate noise after a certain date. What is the best practice for managing these IOCs?

   • ASet an appropriate severity for each IOC and configure an expiration date based on the intelligence's confidence and relevance.
   • BSet all IOCs to the same severity and leave them without an expiration date.
   • CCreate a separate detection rule for each IOC to control its behavior.
   • DDelete all IOCs that are not immediately relevant and only keep the most recent ones.
   Reveal Solution Discussion Select an answer first