4.1 Manage Exception and Exclusion Configurations XSIAM-ENGINEER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In XSIAM, which of the following is a valid way to configure an exception for an event?

   • AModify the underlying log source to stop sending the event.
   • BDelete the event from the incident timeline.
   • CCreate an exception rule that matches specific event fields and values.
   • DChange the event severity to 'informational'.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security administrator is reviewing the exception and exclusion lists and finds that an exception for a specific domain is no longer needed because the domain is now blocked. What should the administrator do?

   • AKeep the exception to avoid any disruption.
   • BDisable the exception instead of deleting it.
   • CEdit the exception to change the domain to a different one.
   • DDelete the exception for the domain.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the impact of adding an exception for a specific indicator on the detection workflow in XSIAM?

   • AThe indicator will be automatically blocked at the firewall level.
   • BThe indicator will be moved to a separate quarantine list.
   • CThe indicator will be completely removed from all logs and data.
   • DAlerts for that indicator will be suppressed, but the indicator may still appear in raw logs.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company has a dynamic IP range for a cloud provider that is used by both legitimate services and malicious actors. The security team wants to reduce false positives from the legitimate services but cannot exclude the entire IP range. What is the best approach?

   • ADisable all correlation rules that involve the IP range.
   • BAdd the entire IP range to the exclusion list.
   • CCreate exceptions for the specific legitimate services' IPs and ports.
   • DCreate a new correlation rule to ignore the IP range.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst notices that a legitimate internal vulnerability scanner is triggering a high number of alerts for known CVEs. The scanner's IP is already in an exclusion list, but the alerts persist. Which type of exception or exclusion should the analyst configure to suppress these alerts while still allowing detection of other suspicious activity from that IP?

   • AAdd the scanner's IP to the exclusion list for all detection types.
   • BDisable the correlation rules that generate the alerts.
   • CAdd an exception for the specific CVE signatures triggered by the scanner.
   • DCreate a new correlation rule to ignore the scanner's traffic.
   Reveal Solution Discussion Select an answer first