4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which scenario best illustrates the value of a correlation rule over a simple single-event detection rule?

   • ADetecting a single failed login attempt on one endpoint
   • BDetecting a sequence of events where a user logs in from a new location, then accesses a sensitive file, and then exfiltrates data via email
   • CDetecting a known malware hash on a single endpoint
   • DDetecting a single process execution that is known to be malicious
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In a correlation rule, what is the function of a time window?

   • ATo define the period during which events must occur to be considered part of the same pattern
   • BTo set the expiration time for the rule after which it becomes inactive
   • CTo determine how long alerts generated by the rule remain visible in the console
   • DTo specify how long the rule should wait before evaluating the events
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A SOC manager is reviewing a correlation rule that detects 'multiple failed logons followed by a successful logon' on the same host within 10 minutes. The rule is generating a high volume of alerts, and an initial review shows that most are from a legacy application that uses a service account which periodically fails authentication before succeeding. The manager wants to reduce false positives without missing real brute-force attacks. Which tuning approach is most effective?

   • AAdd an exception to the rule for the specific service account used by the legacy application.
   • BIncrease the failed logon threshold from 3 to 10 within the 10-minute window.
   • CChange the rule action from 'alert' to 'block' to prevent the successful logon after multiple failures.
   • DExtend the time window from 10 minutes to 30 minutes to capture more context.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In a custom prevention rule, what is the purpose of an exception?

   • ATo increase the severity of the alert generated by the rule
   • BTo allow specific activities that would otherwise be blocked by the rule
   • CTo delete the rule after a certain number of matches
   • DTo make the rule run more frequently
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is an indicator of compromise (IOC)?

   • AA type of firewall that inspects application-layer traffic
   • BA report that summarizes security incidents for management
   • CA piece of forensic data that suggests a system may be compromised
   • DA rule that automatically blocks all unknown traffic
   Reveal Solution Discussion Select an answer first