4.1 Manage Exception and Exclusion Configurations XSIAM-ENGINEER Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How does an exclusion for a domain affect the response workflow in XSIAM?

   • AIncidents will be created with a lower severity, but response actions will still run.
   • BIncidents involving that domain will not be created, so no response actions will be triggered.
   • CIncidents will be created but automatically closed without investigation.
   • DIncidents will be created, but response actions will be delayed by 24 hours.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst added an exception for a specific IP address to reduce false positives. Later, the IP is observed in a new attack campaign. The analyst needs to ensure alerts for this IP are generated again. What is the most efficient way to achieve this?

   • ADisable the correlation rule that uses the IP.
   • BCreate a new exception for the IP with a different condition.
   • CEdit the existing exception to remove the IP address.
   • DDelete the IP from the exclusion list.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When configuring an exclusion for a domain in XSIAM, what is the typical scope of the exclusion?

   • AThe exclusion applies to all detection and correlation rules that reference that domain.
   • BThe exclusion applies only to the rule that was active when the exclusion was created.
   • CThe exclusion applies only to the current incident.
   • DThe exclusion applies only to the user who created it.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of configuring an exclusion for an IP address in XSIAM?

   • ATo encrypt all communication with that IP address.
   • BTo prevent false positives by excluding that IP from detection and correlation.
   • CTo prioritize alerts involving that IP address.
   • DTo block all traffic from that IP address.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst is configuring XSIAM to reduce false positives from a known internal IP that performs network scans. The analyst wants to suppress alerts for this IP but still see alerts for other IPs. What should the analyst configure?

   • ADisable the correlation rules that trigger on the IP.
   • BCreate an exception for the IP for all detection types.
   • CAdd the IP to the exclusion list.
   • DCreate a new alert rule to ignore the IP.
   Reveal Solution Discussion Select an answer first