3.2 Manage Simple Automation Rules XDR-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · easy

   A security team wants to run a PowerShell script on an endpoint when a specific alert is detected. The script is already uploaded to the XDR platform. What action should be configured in the simple automation rule?

   • AUpdate the incident with a note to run the script.
   • BExecute the script on the affected endpoint.
   • CCreate a new alert to notify the analyst.
   • DSend an email with the script attached.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In the XDR automation rule creation interface, what does the 'trigger' section of a rule define?

   • AThe action that will be taken when the rule fires
   • BThe conditions that must be met for the rule to execute
   • CThe frequency at which the rule checks for new alerts
   • DThe list of users who can edit the rule
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   An administrator has a simple automation rule that has been running for months. Recently, the rule stopped working after a platform update. The rule's conditions and actions appear unchanged. What should the administrator do first?

   • ARecreate the rule from scratch.
   • BDisable and re-enable the rule.
   • CContact support immediately.
   • DCheck the platform release notes for changes to automation rule behavior.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A simple automation rule that updates an incident's status to 'In Progress' is not firing. The rule is enabled and the conditions match alerts that are definitely present. What should the administrator check first?

   • AConfirm that the alert source is supported by the rule engine.
   • BCheck the rule's execution logs to see if the rule was triggered and if the action failed.
   • CDisable and re-enable the rule to reset its state.
   • DVerify that the incident update action is configured with the correct incident ID field.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which lifecycle management action would you take to permanently remove a simple automation rule from the system?

   • AExport the rule
   • BEdit the rule's conditions
   • CDelete the rule
   • DDisable the rule
   Reveal Solution Discussion Select an answer first