1.2 Explain the Alert Prioritization Handling Process XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In the Palo Alto Networks XDR alert prioritization process, what does the incident score primarily determine?

   • AThe order in which incidents are displayed in the queue, with higher-scored incidents appearing first
   • BThe amount of storage allocated to each incident's raw log data
   • CThe number of alerts that are automatically closed without analyst review
   • DThe frequency with which the incident is re-scanned for new alerts
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A SOC has a custom prioritization rule that subtracts 10 points from alerts involving the 'Guest' asset group. An alert is generated for a guest user's device with a default incident score of 45. However, the alert involves a known advanced persistent threat (APT) that the default scoring model does not account for. The SOC manager wants this alert to be investigated despite the custom rule. What is the most effective way to handle this situation?

   • AChange the default incident score threshold to a lower value so the alert is still considered high priority.
   • BModify the custom rule to exclude alerts involving known APTs.
   • CManually star the alert to override the custom rule and ensure it is investigated.
   • DIgnore the custom rule and investigate the alert based on the default score.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which of the following is a valid action when configuring a custom prioritization rule in Palo Alto Networks XDR?

   • ADeleting alerts that meet the rule's criteria
   • BSetting a condition that adds points to the incident score when the alert matches a specified criterion
   • CChanging the alert's raw log format
   • DModifying the alert's unique identifier
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which of the following is an example of a featured field in the Palo Alto Networks XDR alert view?

   • AUser's email signature
   • BOperating system version
   • CAlert ID
   • DNetwork packet capture
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   An analyst wants to customize the alert view to show the asset criticality and the incident score for each alert. This will help the analyst quickly identify which alerts involve the most important assets and have the highest risk. Which featured fields should the analyst add to the view?

   • AAlert ID and Timestamp
   • BSeverity and Status
   • CSource IP and Destination IP
   • DAsset Criticality and Incident Score
   Reveal Solution Discussion Select an answer first