3.2 Manage Simple Automation Rules XDR-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   Before deploying a new simple automation rule that changes incident status, the team wants to ensure it does not interfere with existing workflows. What is the best approach?

   • ARun the rule in a test environment with sample incidents.
   • BAsk another team to review the rule.
   • CReview the rule code for errors.
   • DEnable the rule and monitor for a day.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When configuring an action for a simple automation rule, what does 'updating an incident' typically involve?

   • ACreating a new incident from scratch
   • BChanging fields such as status, severity, or assignment
   • CSending the incident to an external SIEM
   • DDeleting the incident permanently
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An organization wants to use a simple automation rule to execute a script that quarantines a file on an endpoint. The script requires an argument that is only available in the alert's data. How should the rule be configured to pass this argument?

   • ACreate a separate rule for each possible argument value.
   • BUse a placeholder in the script action that references the alert's property.
   • CUse a static argument in the script action configuration.
   • DHave the script fetch the alert data from the API.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which of the following could be used as a condition in a simple automation rule?

   • AAlert severity is 'High'
   • BThe rule has been enabled for more than 30 days
   • CThe analyst's username contains 'admin'
   • DThe current time is between 2 AM and 3 AM
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of a simple automation rule in XDR?

   • ATo generate weekly reports on alert volume and response times
   • BTo automatically respond to alerts or incidents based on predefined triggers and actions
   • CTo store historical alert data for compliance and auditing purposes
   • DTo replace the need for any human analyst intervention in all security operations
   Reveal Solution Discussion Select an answer first