6.3 Explain the Process of Creating Prevention and Detection Indicator Rules XSIAM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   In XSIAM threat intelligence management, what is the primary purpose of a prevention indicator rule?

   • ATo generate a log entry for every indicator match without taking action
   • BTo provide a visual dashboard of threat intelligence feeds
   • CTo create a new indicator from observed network traffic
   • DTo automatically block or deny traffic that matches a known malicious indicator
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is tasked with creating a new indicator rule in XSIAM. After navigating to the threat intelligence management section, what is the first step in the rule creation workflow?

   • AClick the 'Create Rule' button
   • BSet the rule's severity level
   • CSelect the indicator type and value
   • DDefine the rule action
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the key difference between a prevention action and a detection action in an indicator rule?

   • APrevention actions are used for internal threats, while detection actions are for external threats
   • BPrevention actions block or deny, while detection actions alert or log
   • CPrevention actions require manual approval, while detection actions are automatic
   • DPrevention actions are only for malware, while detection actions are for network threats
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is creating an indicator rule to detect any connection to a known malicious domain. The rule should match the domain and any subdomains. Which matching condition should be used?

   • AExact match
   • BSubstring match
   • CPrefix match
   • DRegex match
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How can you temporarily stop an indicator rule from being enforced without deleting it?

   • AChange the rule's action to 'log'
   • BEdit the rule's name
   • CDisable the rule
   • DDelete the rule
   Reveal Solution Discussion Select an answer first