3.2 Manage Simple Automation Rules XDR-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When creating a simple automation rule, what are the two essential components you must define?

   • AA data source and a log retention period
   • BTrigger conditions and the action to be performed
   • CA name and a schedule for the rule to run
   • DA severity level and an assigned analyst
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A simple automation rule has been running for a week. The team notices that it is sending duplicate emails for the same alert. The rule is triggered by alert creation. What is the most likely cause and solution?

   • AThe rule is enabled twice; disable one instance.
   • BThe alert source is generating duplicate alerts; ignore it.
   • CThe rule is configured to trigger on alert updates as well; change the trigger to 'on creation' only.
   • DThe email action is misconfigured; recreate the rule with a new email action.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   If a simple automation rule's action fails (e.g., email not sent), what should you check to identify the cause?

   • AThe action's configuration and any error messages in the logs
   • BThe rule's name
   • CThe alert's severity level
   • DThe number of other rules in the system
   Reveal Solution Discussion Select an answer first
5. 19application · easy

   A junior analyst asks why a simple automation rule is used instead of manually handling every alert. The rule sends an email and updates an incident when a specific pattern is detected. What is the primary benefit of this rule?

   • AIt guarantees that all alerts are resolved without human intervention.
   • BIt replaces the need for any human analysis of alerts.
   • CIt reduces manual effort by automating repetitive response actions.
   • DIt eliminates the need for incident management procedures.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A simple automation rule is not executing when an alert matches its conditions. What is the first place you should look to troubleshoot the issue?

   • AThe rule's execution logs or monitoring tools
   • BThe email server's spam filter
   • CThe alert's raw packet capture
   • DThe XDR server's hardware status
   Reveal Solution Discussion Select an answer first