6.8 Explain Attack Surface Rules Functionality XSIAM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A security operations team notices that an attack surface rule designed to block suspicious registry modifications is generating a high volume of alerts for legitimate software installations. The rule is blocking legitimate activity, causing business disruption. What should the team do first to address this issue?

   • AIncrease the severity of the rule so analysts pay more attention to the alerts.
   • BChange the rule action from 'block' to 'alert' and leave the conditions unchanged.
   • CImmediately delete the rule to stop all alerts and prevent further business disruption.
   • DReview the rule's trigger conditions and filters to identify overly broad criteria, then refine them to be more specific.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What does the 'alert' action do in an attack surface rule?

   • AIt allows the activity without any further action
   • BIt generates a notification for security analysts to review
   • CIt deletes the suspicious event from the logs
   • DIt automatically blocks all traffic from the source
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is a valid operation for managing attack surface rules in the XSIAM interface?

   • ACreating a new attack surface rule
   • BConverting the rule into a firewall policy
   • CExporting the rule to a PDF report
   • DCompiling the rule into machine code
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the purpose of testing an attack surface rule with sample data?

   • ATo validate that the rule behaves as expected before deploying it
   • BTo increase the rule's priority in the evaluation order
   • CTo automatically enable the rule for all environments
   • DTo permanently delete the rule after testing
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A security team has deployed an attack surface rule that blocks suspicious file downloads. The rule has been running for a month and has blocked several legitimate downloads, causing user complaints. The team needs to reduce the false positives while maintaining the ability to block malicious downloads. The rule currently has a single trigger for 'download' events with no filters. What is the most effective approach?

   • AAnalyze the blocked legitimate downloads to identify common patterns, then add filters to exclude those patterns.
   • BIncrease the rule's severity so analysts review blocked downloads more carefully.
   • CDisable the rule and rely on user reports to identify malicious downloads.
   • DChange the rule action from 'block' to 'alert' to stop blocking legitimate downloads.
   Reveal Solution Discussion Select an answer first