3.2 Manage Simple Automation Rules XDR-ENGINEER Practice Questions (Page 5)

Questions 21–24

1. 21expert · hard

   A simple automation rule that updates an incident's severity is not working for a specific subset of alerts. The rule's conditions use 'incident severity' and 'alert source'. The administrator finds that the rule works for some alerts but not others. What is the most likely cause?

   • AThe incident severity field is not populated for those alerts.
   • BThe rule is disabled for those alerts.
   • CThe alert source is misspelled in the rule.
   • DThe rule's action is failing for those alerts.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A rule that sends an email when a critical alert is created is not sending emails. The rule is enabled and the conditions are correct. The administrator checks the logs and sees that the rule is triggered but the action status shows 'failed'. What should the administrator investigate next?

   • ACheck the email server configuration and recipient address.
   • BDisable and re-enable the rule.
   • CDelete the rule and recreate it.
   • DModify the trigger conditions to be broader.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   When configuring a condition in a simple automation rule, what does the 'operator' (e.g., equals, contains, greater than) do?

   • ASpecifies the action to be taken when the condition is met
   • BDetermines the order in which multiple rules are evaluated
   • CDefines how the alert attribute is compared to the specified value
   • DSets the severity level of the alert that triggers the rule
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the effect of disabling a simple automation rule?

   • AThe rule continues to execute but without logging
   • BThe rule's conditions are automatically modified
   • CThe rule remains in the system but does not execute
   • DThe rule is permanently deleted from the system
   Reveal Solution Discussion Select an answer first