6.8 Explain Attack Surface Rules Functionality XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team has been running an attack surface rule in 'alert' mode for two weeks and has collected data on its performance. The rule has generated 500 alerts, but only 50 were confirmed as malicious. The team wants to improve the rule's precision. What is the most effective next step?

   • AIncrease the rule's severity so analysts prioritize the alerts.
   • BAnalyze the false-positive alerts to identify common patterns, then add filters to exclude those patterns.
   • CChange the rule action from 'alert' to 'block' to prevent the false positives from causing harm.
   • DDisable the rule and rely on other detection content.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following is a possible action an attack surface rule can take?

   • ARebooting the affected server
   • BDeleting the affected user account
   • CBlocking the suspicious activity
   • DPatching the vulnerable system
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An analyst is designing an attack surface rule with the following requirement: trigger when process 'A' is observed AND (command line contains 'X' OR command line contains 'Y'), but NOT when the user is 'admin'. The analyst creates one trigger block for process 'A' and adds filters for 'X' and 'Y'. How should the 'NOT admin' condition be implemented?

   • AAdd a third filter in the same trigger block for user 'admin' with the operator set to 'NOT'.
   • BLeave the rule as is and rely on the alert review process to ignore alerts from 'admin'.
   • CCreate a separate trigger block for user 'admin' and set the rule to NOT match that block.
   • DAdd a filter for user 'admin' with AND logic, so the rule only fires when the user is 'admin'.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which activity is part of monitoring an attack surface rule's performance?

   • ADisabling the rule to save resources
   • BChanging the rule's name
   • CDeleting the rule after a week
   • DReviewing the rule's alert and match statistics
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In an attack surface rule, what is the purpose of the 'filter' component?

   • ATo narrow down the events that the rule evaluates
   • BTo determine the order in which rules are evaluated
   • CTo define the action taken when the rule matches
   • DTo specify the severity level of the alert
   Reveal Solution Discussion Select an answer first