4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   When managing custom prevention rules across endpoints, what does 'enabling' a rule do?

   • AIt creates a backup copy of the rule
   • BIt sends the rule to a sandbox for testing
   • CIt deletes the rule from the endpoint
   • DIt activates the rule so that it is enforced on the target endpoints
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security operations center (SOC) has imported a large set of IOCs from multiple sources, including some that are conflicting (e.g., one source lists an IP as malicious, another lists it as benign). The SOC wants to ensure that the most reliable IOCs are used for detection and that the impact of unreliable IOCs is minimized. What is the best practice for managing this IOC set?

   • ACreate a separate detection rule for each IOC source to isolate the alerts.
   • BReview the IOCs, assign severity and confidence levels based on the source's reliability, and disable or expire IOCs with low confidence.
   • CKeep all IOCs enabled and let the detection rules generate alerts for all of them, regardless of conflicts.
   • DDelete all IOCs from sources that have any conflicts and only keep IOCs from a single trusted source.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which element is essential for constructing a correlation rule that matches a specific event sequence?

   • AA scheduled task to run the rule once per day
   • BA severity level assigned to the rule
   • CLogical operators and field comparisons to define conditions
   • DA list of known malicious IP addresses to block
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An organization has a list of known malicious domains and a set of behavioral patterns for suspicious PowerShell activity. The security team wants to create a detection rule that triggers an alert when either a known malicious domain is accessed OR a suspicious PowerShell behavior is observed. How should the team integrate these IOCs and BIOCs into a single detection rule?

   • ACreate two separate rules: one for the IOCs and one for the BIOCs, and then manually correlate the alerts.
   • BCreate a single rule that requires both the IOC and the BIOC to match in the same event.
   • CCreate a single rule that only uses the IOCs and ignores the BIOCs.
   • DCreate a single correlation rule that uses an OR condition to match either the IOC (domain match) or the BIOC (PowerShell behavior).
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   What is the purpose of a custom prevention rule in an XDR platform?

   • ATo collect and store forensic evidence for legal proceedings
   • BTo generate a report of all endpoint activities
   • CTo block or allow specific activities based on defined criteria
   • DTo replace the need for antivirus software on endpoints
   Reveal Solution Discussion Select an answer first