4.1 Manage Exception and Exclusion Configurations XSIAM-ENGINEER Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A security team is reviewing their XSIAM configuration after a series of false positives. They notice that a broad exclusion for a trusted domain is also suppressing alerts for a subdomain that has been compromised. What is the best course of action to balance false-positive reduction and security visibility?

   • ARemove the exclusion entirely and accept the false positives.
   • BKeep the broad exclusion and add the compromised subdomain to a separate watchlist.
   • CRemove the broad exclusion and create a more specific exception for the trusted domain's legitimate traffic.
   • DCreate a new correlation rule to detect the compromised subdomain.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security team is investigating a potential breach. They discover that an exception was added for a specific file hash that is now known to be malicious. The exception was added by a former employee. What is the most important immediate action?

   • AReview the audit logs to understand why the exception was added.
   • BContact the former employee to ask about the exception.
   • CLeave the exception in place to avoid disrupting operations.
   • DRemove the exception for the file hash immediately.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A security administrator notices that an exception list has grown large and contains outdated entries. The administrator wants to clean up the list without affecting current operations. What is the best practice for managing this exception list?

   • AReview the list periodically and remove entries that are no longer needed.
   • BKeep all entries to avoid accidentally removing a needed exception.
   • CExport the list and delete all entries.
   • DCreate a new exception list and migrate only the most recent entries.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security team is considering adding an exclusion for a large IP range used by a cloud provider to reduce false positives. However, they are concerned about the impact on detection. What is the best way to mitigate the risk of missing malicious activity?

   • AAdd the entire IP range to the exclusion list and rely on other security tools.
   • BDisable all correlation rules that involve the IP range.
   • CCreate a new correlation rule to detect malicious activity from the range.
   • DCreate exceptions for the specific services that are causing false positives.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In XSIAM, what is the primary difference between an exception and an exclusion?

   • AAn exception is a permanent rule, while an exclusion is a temporary rule that expires automatically.
   • BAn exception applies to a single user, while an exclusion applies to an entire organization.
   • CAn exception suppresses alerts for a specific indicator, while an exclusion prevents data from being ingested for a specific entity.
   • DAn exception is used for malware, while an exclusion is used for network traffic.
   Reveal Solution Discussion Select an answer first