3.2 Manage Simple Automation Rules XDR-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A team is testing a new simple automation rule that sends an email and updates an incident. They create a test alert that matches the conditions, but the email is not sent. The rule's logs show that the rule triggered and the incident update succeeded. What should the team check next?

   • AVerify that the email action is configured with a valid recipient and SMTP settings.
   • BCheck if the test alert was created in the correct environment.
   • CConfirm that the rule is enabled.
   • DReview the incident update action's configuration.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important to test a simple automation rule in a controlled environment before deploying it to production?

   • ATo automatically generate documentation for the rule
   • BTo increase the rule's execution speed
   • CTo permanently enable the rule in all environments
   • DTo ensure the rule behaves as expected without unintended consequences
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a valid action that can be selected when configuring a simple automation rule?

   • AReboot the XDR server
   • BSend an email notification to a security team
   • CDelete the alert from the system
   • DChange the rule's trigger conditions
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A simple automation rule is configured to trigger when an alert contains 'credential theft' in its name. The rule is not triggering for alerts that contain 'Credential Theft' (capitalized). What is the likely cause?

   • AThe alert source is different.
   • BThe rule's action is failing.
   • CThe rule is disabled.
   • DThe condition is case-sensitive.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is a common method to validate that a simple automation rule works correctly?

   • ACreate a test alert that matches the rule's conditions and observe the action
   • BReview the rule's code for syntax errors
   • CCheck the rule's execution history for past runs
   • DAsk another analyst to manually trigger the rule
   Reveal Solution Discussion Select an answer first