4.1 Manage Exception and Exclusion Configurations XSIAM-ENGINEER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security administrator is managing the exception list and notices that some entries are duplicates. What is the best practice for handling duplicate exceptions?

   • ARemove the duplicate entries to keep the list clean.
   • BEdit the duplicates to cover different conditions.
   • CKeep the duplicates to ensure the exception is applied.
   • DDisable the duplicates instead of deleting them.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A security team has an exception list that includes several domains that are no longer used by the organization. The team wants to ensure that alerts for these domains are generated again. What is the best action?

   • AKeep the exceptions to avoid any disruption.
   • BEdit the exceptions to change the domains to active ones.
   • CDisable the exceptions instead of deleting them.
   • DDelete the exceptions for the unused domains.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   Which of the following is a type of exception that can be configured in XSIAM?

   • ALog exception
   • BPolicy exception
   • CIndicator exception
   • DUser exception
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security analyst needs to suppress alerts for a specific event type that is known to be benign in their environment. The event is generated by a legitimate internal application. What is the most appropriate way to configure this in XSIAM?

   • ACreate an exception for the specific event type.
   • BDisable the correlation rule that generates the event.
   • CCreate a new indicator of compromise (IOC) for the event.
   • DAdd the application's IP to the exclusion list.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A security analyst is troubleshooting why alerts are not being generated for a specific IP address. The analyst checks the exception and exclusion lists and finds that the IP is in the exclusion list. However, the analyst believes the IP is now malicious. What is the best course of action?

   • ADisable the correlation rules that use the IP.
   • BCreate an exception for the IP to override the exclusion.
   • CLeave the exclusion in place and manually investigate the IP.
   • DRemove the IP from the exclusion list to restore alerts.
   Reveal Solution Discussion Select an answer first