3.3 Manage Detection Rules to Align with Provided Requirements XSIAM-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A security analyst wants to detect a potential data exfiltration attack that involves multiple steps: a user downloading a large file, then uploading it to an external cloud storage service, and then deleting the local copy. The analyst wants to generate a single alert when all three events occur within a short time window. What should the analyst create?

   • AA correlation rule that combines the three events into a single alert.
   • BAn ASM rule that monitors for exposed cloud storage buckets.
   • CA scoring rule that assigns a high risk score to any user who downloads a large file.
   • DAn indicator rule that matches on the external cloud storage service's domain.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is an example of an Indicator of Compromise (IOC)?

   • AA sequence of commands executed by a process
   • BAn unusually high number of failed login attempts
   • CA user logging in outside of normal business hours
   • DA file hash of a known malware sample
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the primary purpose of an indicator rule in XSIAM?

   • ATo store indicators in a threat intelligence feed for external sharing
   • BTo replace all other detection rules in the environment
   • CTo trigger alerts when IOCs or BIOCs are detected in the environment
   • DTo automatically remediate any detected threat without human intervention
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A security team wants to automatically detect when a new cloud storage bucket is created with public read access, as this could expose sensitive data. They also want to prioritize alerts for buckets that contain files with names matching common sensitive data patterns (e.g., 'credential', 'backup'). Which configuration should they use?

   • AA scoring rule that assigns a risk score to all buckets and an ASM rule that alerts on any bucket creation.
   • BAn indicator rule that matches on the bucket name and a correlation rule that combines bucket creation with public access.
   • CA correlation rule that combines bucket creation events with public access logs and an indicator rule for sensitive file names.
   • DAn ASM rule that monitors for exposed buckets and a scoring rule that increases risk for buckets with sensitive file names.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which of the following is NOT a typical Indicator of Compromise (IOC)?

   • AA user's typical login time
   • BA known malware filename
   • CA malicious domain name
   • DA suspicious IP address
   Reveal Solution Discussion Select an answer first