3.3 Manage Detection Rules to Align with Provided Requirements XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security team is investigating a series of alerts where a user account is logging in at unusual hours, then attempting to access multiple sensitive systems, and then sending emails with attachments to external addresses. They want to create a detection that captures this pattern and assigns a high risk score to the user. What should they do?

   • ACreate an ASM rule that monitors for exposed email servers.
   • BCreate an indicator rule that matches on the external email addresses in the 'to' field.
   • CCreate a correlation rule that combines the login, access, and email events, and use a scoring rule to assign a high risk score to the user.
   • DCreate a scoring rule that assigns a high risk score to any user who logs in at unusual hours.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security team wants to detect when a known malicious domain is accessed from any internal host. They also want to prioritize alerts for hosts that are domain controllers or that have previously been involved in security incidents. The team has a list of 100 malicious domains and wants to avoid creating 100 separate rules. What is the most efficient way to achieve this?

   • ACreate a single indicator rule that includes all 100 domains and use a scoring rule to assign higher risk to domain controllers and previously compromised hosts.
   • BCreate a correlation rule that combines all 100 domains into a single rule.
   • CCreate an ASM rule that monitors for the domains in external DNS records.
   • DCreate a separate indicator rule for each domain and manually review alerts from critical hosts.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A security operations center (SOC) receives a threat intelligence report that includes a list of malicious file hashes and command-and-control (C2) domains. The SOC wants to automatically generate alerts whenever any of these artifacts are observed in the environment, and they want to prioritize alerts for C2 domains over file hashes. What should they do?

   • ACreate a correlation rule that triggers only when both a file hash and a C2 domain are observed together.
   • BCreate two indicator rules: one for file hashes and one for C2 domains, and use a scoring rule to assign higher risk to C2 domain alerts.
   • CCreate an ASM rule that monitors for C2 domains in external DNS records.
   • DCreate a single indicator rule that includes both file hashes and C2 domains, and assign a static risk score.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In the context of detection rules, what is the primary purpose of correlation?

   • ATo combine multiple events or signals to identify a threat that may not be evident from any single event
   • BTo replace the need for individual detection rules by using a single rule that matches all known threats
   • CTo automatically block all network traffic that matches a known indicator
   • DTo store raw logs in a centralized repository for later manual analysis
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of an Attack Surface Management (ASM) rule in XSIAM?

   • ATo manage internal network segmentation
   • BTo block all inbound traffic from the internet
   • CTo replace the need for vulnerability scanners
   • DTo monitor and manage an organization's external attack surface by detecting exposed assets or misconfigurations
   Reveal Solution Discussion Select an answer first