3.3 Manage Detection Rules to Align with Provided Requirements XSIAM-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An organization is overwhelmed by a high volume of low-severity alerts. The security team wants to ensure that alerts involving privileged accounts or lateral movement patterns are surfaced first, while still generating alerts for other suspicious activity. What should they configure?

   • AA correlation rule that combines all low-severity alerts into a single high-severity alert.
   • BAn indicator rule that only triggers on privileged account activity and suppresses all other alerts.
   • CA scoring rule that assigns higher risk scores to events involving privileged accounts or lateral movement patterns.
   • DAn ASM rule that monitors for exposed privileged accounts on the external attack surface.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   When creating an indicator rule in XSIAM, which of the following must be specified?

   • AThe IP address of the XSIAM server
   • BThe name of the threat actor behind the indicator
   • CThe indicator type (e.g., IP, domain, hash) and the action to take when matched
   • DThe number of days the indicator has been active
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A security team is trying to detect a stealthy attacker who uses valid credentials and performs actions that are individually benign but collectively suspicious. For example, the attacker logs in from a new device, then accesses a database, then exports data. The team wants to create a detection that minimizes false positives while still catching this behavior. They are considering using a correlation rule with a time window. What is the most important consideration to avoid false positives?

   • ASetting a short time window so that only closely-timed actions are correlated.
   • BUsing a scoring rule to assign a high risk score to any user who logs in from a new device.
   • CUsing a long time window to ensure all possible sequences are captured.
   • DCreating an indicator rule that matches on the database name.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   How do scoring rules influence detection prioritization?

   • ABy assigning higher scores to more risky entities or events, making them more likely to be investigated first
   • BBy preventing any alert from being generated for low-scoring entities
   • CBy changing the order of events in the log
   • DBy automatically deleting low-scoring events from the system
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which of the following would an Attack Surface Management (ASM) rule be most likely to detect?

   • AAn internet-facing server with an open management port
   • BAn internal database with excessive privileges
   • CA file hash matching a known malware sample
   • DA user logging in from a new device
   Reveal Solution Discussion Select an answer first