4.1 Create Detection Rules to Align with Requirements XDR-ENGINEER Practice Questions (Page 7)

Questions 31–32

1. 31foundation · easy

   Which of the following is an example of a custom prevention rule?

   • AA rule that collects all network traffic logs for analysis
   • BA rule that generates an alert when a user logs in from a new location
   • CA rule that changes the wallpaper on an endpoint
   • DA rule that blocks execution of a specific executable file on all endpoints
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When creating an IOC in an XDR platform, what is the purpose of setting an expiration date?

   • ATo make the IOC more accurate by requiring multiple matches
   • BTo encrypt the IOC so that only authorized users can view it
   • CTo automatically remove the IOC from active detection after a specified time
   • DTo prioritize the IOC over other IOCs in the same rule
   Reveal Solution Discussion Select an answer first