4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which scenario is best detected by a BIOC rather than a traditional IOC?

   • AA connection is made to a known malicious IP address
   • BA file with a known malicious domain in its metadata is downloaded
   • CA known malware file with a specific hash is executed
   • DA process attempts to modify the Windows registry in a way that is unusual for that application
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A security engineer has created a new custom prevention rule and deployed it to a pilot group of 50 endpoints. After 24 hours, the rule has generated several false positives that are blocking a legitimate business application. The engineer needs to quickly revert the change for the entire environment while keeping the rule available for further testing. What is the most appropriate action?

   • AWait for the pilot period to end and then review the results before making any changes.
   • BModify the rule to change the action from 'block' to 'alert' and leave it enabled.
   • CDelete the rule and recreate it from scratch after the false positives are resolved.
   • DDisable the rule in the XDR platform, which stops enforcement on all endpoints but preserves the rule configuration for future edits.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a behavioral indicator of compromise (BIOC)?

   • AA list of known malicious IP addresses
   • BA pattern of behavior that may indicate malicious activity, rather than a static signature
   • CA type of firewall rule that blocks all inbound traffic
   • DA software update that patches a vulnerability
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which practice is most effective for validating a correlation rule before deploying it widely?

   • ADeploying the rule to all endpoints immediately to see what happens
   • BSetting the rule to 'disabled' and never enabling it
   • CAsking other analysts to guess whether the rule will work
   • DTesting the rule against historical data or a simulated attack scenario
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   How are IOCs typically integrated into detection rules?

   • ABy referencing the IOC in the rule's conditions so that a match triggers an alert or action
   • BBy replacing the need for any other detection logic in the rule
   • CBy storing the IOC in a separate database that is never used by rules
   • DBy automatically blocking all traffic from any IP address that is not in the IOC list
   Reveal Solution Discussion Select an answer first