Policy Management, Exclusions, and Tuning
This domain tests how to reduce false positives without weakening protection. Expect questions on policy precedence, exclusion scope, change control, expiry, and the security trade-offs of tuning.
Core rules and concepts
- Exclusions can be scoped by path, file hash, signer, process, or behavior depending on the module. The narrowest exclusion that resolves the issue is preferred; broad folder or drive exclusions create blind spots.
- On-access scanning, behavioral monitoring, and EDR detections may use different exclusion mechanisms. Excluding a path from file scanning does not necessarily suppress a behavioral alert.
- Every exclusion needs an owner, business justification, ticket reference, approval, and review or expiry date. Temporary troubleshooting exclusions often become permanent risks when unmanaged.
- Tuning is not the same as disabling. Prefer adding a condition, lowering severity for a known benign pattern, or suppressing a specific rule instance over turning off a module.
- Test policy and exclusion changes in a pilot group, measure the effect on detections and performance, and record the change in the configuration management system.
- High false-positive rates can cause alert fatigue and missed true positives; track suppression volume and revisit rules that generate repeated noise.
Worked example
A custom line-of-business application crashes when the endpoint scans its install directory. The administrator proposes excluding C:\ or disabling on-access scanning. Reasoning: both options remove protection for all files and are unacceptable. Instead, identify the specific signed executable and the files it writes, create a process-scoped exclusion for that executable and path, test on one pilot host, document the vendor support case, and set a 90-day review. If behavior-based blocking persists, add a targeted rule exception rather than a broad behavioral exclusion. Verify that the application still runs and that malware simulation tests are still detected outside the excluded scope.
Traps that cost marks
- Excluding entire drives, user profiles, or temp directories.
- Assuming a file-scan exclusion also suppresses behavioral or EDR alerts.
- Creating permanent exclusions without owner, justification, or review.
- Disabling a protection module to solve a single application conflict.