6.8 Explain Attack Surface Rules Functionality XSIAM-ANALYST Practice Questions (Page 6)

Questions 26–29

1. 26application · medium

   An analyst has created an attack surface rule and wants to test it with a sample event that represents a known malicious behavior. The analyst is unsure whether the rule will trigger correctly. What is the best way to test the rule without affecting live traffic?

   • ACreate a copy of the rule with a different name and enable the copy in production.
   • BEnable the rule in production and wait for a real malicious event to occur.
   • CUse the XSIAM rule testing feature to run the sample event through the rule and observe the result.
   • DAsk a colleague to manually review the rule's logic and confirm it is correct.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security team has an attack surface rule that blocks suspicious registry modifications. The rule has been running for several weeks and has blocked some legitimate registry changes, causing application issues. The team wants to reduce false positives while maintaining the ability to block malicious registry modifications. The rule currently has a trigger for 'reg.exe' with no filters. What is the most effective tuning approach?

   • AChange the rule action from 'block' to 'alert' to stop blocking legitimate registry changes.
   • BIncrease the rule's severity so analysts review blocked registry changes more carefully.
   • CDisable the rule and rely on other detection content to identify malicious registry modifications.
   • DAnalyze the blocked legitimate registry changes to identify common patterns, then add filters to exclude those patterns.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the goal of tuning an attack surface rule?

   • ATo disable the rule permanently
   • BTo make the rule more complex
   • CTo increase the number of alerts generated
   • DTo reduce false positives and improve detection accuracy
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is building an attack surface rule with the following logic: trigger when process 'A' is observed AND (command line contains 'X' OR command line contains 'Y'). The analyst creates one trigger block for process 'A' and adds two filters: one for 'X' and one for 'Y'. What operator should be used between the two filters to achieve the desired logic?

   • AAND
   • BXOR
   • CNOT
   • DOR
   Reveal Solution Discussion Select an answer first