6.4 Explain the Process of Verdict Management XSIAM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   Why are verdict decisions logged in XSIAM?

   • ATo provide an audit trail for compliance and analysis
   • BTo automatically increase the confidence of future verdicts
   • CTo enable real-time propagation of verdicts
   • DTo reduce the storage requirements of the system
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst manually overrides a verdict for a file from 'malicious' to 'benign'. Later, the same file is detected on multiple endpoints. What is the most likely reason the file was not blocked?

   • AThe override was reverted automatically after a short period.
   • BThe override was propagated, so the file was treated as benign across the platform.
   • CThe override was logged but not applied to detection rules.
   • DThe override was not propagated, so only the local endpoint had the benign verdict.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A verdict for a file is 'malicious' with high severity but low confidence. The file is a signed executable from a reputable vendor. The sandbox flagged it for behavior that could be benign. What is the best action?

   • AInvestigate the file's behavior and gather more evidence before deciding.
   • BOverride the verdict to 'benign' because the file is signed and from a reputable vendor.
   • CIgnore the verdict because the file is from a reputable vendor.
   • DBlock the file immediately because the severity is high.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of a severity rating on a verdict?

   • ATo determine the source of the verdict
   • BTo prioritize response actions based on potential impact
   • CTo track the lifecycle stage of the verdict
   • DTo indicate the likelihood the verdict is correct
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security team uses XSIAM and receives a high-confidence malicious verdict for a file from a threat intelligence feed. How should this verdict be used in the detection workflow?

   • AOnly block the file if it is also detected by the sandbox.
   • BIgnore the verdict because it is from an external feed.
   • CManually review the file on each endpoint before blocking.
   • DAutomatically block the file across all endpoints because the verdict is high confidence.
   Reveal Solution Discussion Select an answer first