Online Access Free XDR-Engineer Practice Test

Which XQL query can be saved as a behavioral indicator of compromise (BIOC) rule, then converted to a custom prevention rule?

• A.dataset = xdr_data
  | filter event_type = ENUM.PROCESS and action_process_image_name = "**" and action_process_image_command_line = "-e cmd*" and action_process_image_command_line != "*cmd.exe -a /c*"
• B.dataset = xdr_data
  | filter event_type = ENUM.PROCESS and event_type = ENUM.DEVICE and
  action_process_image_name = "**"
  and action_process_image_command_line = "-e cmd*"
  and action_process_image_command_line != "*cmd.exe -a /c*"
• C.dataset = xdr_data
  | filter event_type = FILE and (event_sub_type = FILE_CREATE_NEW or event_sub_type = FILE_WRITE or event_sub_type = FILE_REMOVE or event_sub_type = FILE_RENAME) and agent_hostname = "hostname"
  | filter lowercase(action_file_path) in ("/etc/*", "/usr/local/share/*", "/usr/share/*") and action_file_extension in ("conf", "txt")
  | fields action_file_name, action_file_path, action_file_type, agent_ip_addresses, agent_hostname, action_file_path
• D.dataset = xdr_data
  | filter event_type = ENUM.DEVICE and action_process_image_name = "**"
  and action_process_image_command_line = "-e cmd*"
  and action_process_image_command_line != "*cmd.exe -a /c*"

How can a Malware profile be configured to prevent a specific executable from being uploaded to the cloud?

• A.Disable on-demand file examination for the executable
• B.Create an exclusion rule for the executable
• C.Add the executable to the allow list for executions
• D.Set PE and DLL examination for the executable to report action mode

A static endpoint group is created by adding 321 endpoints using the Upload From File feature. However, after group creation, the members count field shows 244 endpoints. What are two possible reasons why endpoints were not added to the group? (Choose two.)

• A.Endpoints added to the new group were previously added to an existing group
• B.The IP address, hostname, or alias of the endpoints must match an existing agent that has registered with the tenant
• C.Endpoints added to the group were in Disconnected or Connection Lost status when groupmembership was added
• D.Static groups have a limit of 250 endpoints when adding by file

During the deployment of a Broker VM in a high availability (HA) environment, after configuring the Broker VM FQDN, an XDR engineer must ensure agent installer availability and efficient content caching to maintain performance consistency across failovers. Which additionalconfiguration steps should the engineer take?

• A.Enable synchronized session persistence across Broker VMs and use a self-signed certificate and key
• B.Use shared SSL certificates and keys for all Broker VMs and configure a single IP address for failover
• C.Upload the-signed SSL server certificate and key and deploy a load balancer
• D.Deploy a load balancer and configure SSL termination at the load balancer

How long is data kept in the temporary hot storage cache after being queried from cold storage?

• A.24 hours, re-queried to a maximum of 7 days
• B.1 hour, re-queried to a maximum of 12 hours
• C.24 hours, re-queried to a maximum of 14 days
• D.1 hour, re-queried to a maximum of 24 hours