1.2 Explain the Alert Prioritization Handling Process XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · easy

   A SOC analyst wants to see at a glance which alerts in the queue have been escalated to a higher tier and which are still in the initial triage phase. Which featured field should the analyst add to the alert view to see this information?

   • AAlert ID
   • BSeverity
   • CStarred
   • DTimestamp
   Reveal Solution Discussion Select an answer first
2. 2application · easy

   An analyst is customizing the alert list view to quickly identify which alerts involve critical assets and which have been escalated. Which featured fields should the analyst include in the view to achieve this goal?

   • AAsset Criticality and Starred
   • BAlert ID and Timestamp
   • CSource IP and Destination IP
   • DSeverity and Status
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which of the following best describes how the incident score is used in the Palo Alto Networks XDR alert prioritization process?

   • AIt is a static value assigned by the analyst that never changes
   • BIt is a calculated value that helps analysts decide which incidents to investigate first
   • CIt is used to automatically block all associated endpoints
   • DIt is used to determine the retention period of the incident's data
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A SOC analyst wants to see the incident score and the asset criticality for each alert in the queue to help with prioritization. Which featured fields should the analyst add to the alert view?

   • AAlert ID and Timestamp
   • BSeverity and Status
   • CIncident Score and Asset Criticality
   • DSource IP and Destination IP
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company's SOC wants to ensure that any alert involving a database server in the 'Finance' asset group is automatically prioritized over alerts from other groups, regardless of the default incident score. What is the most efficient way to achieve this in Cortex XDR?

   • AManually star every alert from the Finance asset group as they appear.
   • BChange the default incident score threshold to a lower value.
   • CCreate a new alert view that filters for Finance asset group alerts.
   • DCreate a custom prioritization rule that assigns a higher score to alerts from the Finance asset group.
   Reveal Solution Discussion Select an answer first