3.3 Manage Detection Rules to Align with Provided Requirements XSIAM-ENGINEER Practice Questions (Page 5)

Questions 21–23

1. 21expert · hard

   A large enterprise wants to monitor its external attack surface for misconfigured cloud storage buckets and exposed APIs. They also want to prioritize alerts for buckets that contain customer data (e.g., files with 'customer' in the name) over other exposed assets. The security team is concerned about the volume of alerts and wants to ensure that only critical exposures are escalated. What should they do?

   • ACreate an ASM rule to detect exposed buckets and APIs, and a scoring rule that increases risk for buckets with 'customer' in the file name.
   • BCreate a single ASM rule that alerts on all exposed buckets and APIs, and manually review each alert.
   • CCreate a scoring rule that assigns a high risk score to all exposed assets and an ASM rule that only alerts on buckets with 'customer' in the name.
   • DCreate an indicator rule that matches on the bucket names and a correlation rule that combines bucket creation with API access.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the primary difference between a Behavioral Indicator of Compromise (BIOC) and a static IOC?

   • ABIOCs are less accurate than static IOCs
   • BBIOCs are based on patterns of behavior, while static IOCs are based on specific artifacts
   • CBIOCs are only used for insider threats, while static IOCs are used for external threats
   • DBIOCs are automatically generated, while static IOCs are manually created
   Reveal Solution Discussion Select an answer first
3. 23application · medium

   A security analyst at a financial firm needs to detect when any endpoint in the environment communicates with a known malicious IP address. The analyst has a list of 50 malicious IPs from a threat intelligence feed and wants to prioritize alerts so that high-value assets (e.g., domain controllers) are flagged with a higher risk score. Which approach should the analyst take?

   • ACreate a correlation rule that combines all 50 IPs into one rule and assign a risk score based on the number of matches.
   • BCreate a single indicator rule that matches any of the 50 IPs and set a static risk score for all alerts.
   • CCreate a separate indicator rule for each IP and manually review alerts from high-value assets first.
   • DCreate an indicator rule for the IP list and use a scoring rule to assign higher risk scores when the affected entity is a high-value asset.
   Reveal Solution Discussion Select an answer first