1.2 Explain the Alert Prioritization Handling Process XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A SOC has a custom prioritization rule that adds 15 points to alerts from the 'Finance' asset group. An alert is generated for a Finance server with a default incident score of 70. However, the alert is a false positive that was triggered by a routine backup process. The SOC manager wants to prevent this type of alert from being prioritized in the future. What is the most effective way to handle this?

   • ARemove the custom rule for the Finance asset group.
   • BCreate a new custom rule that subtracts points from alerts triggered by the backup process.
   • CChange the default incident score threshold to a higher value.
   • DManually star the alert to mark it as a false positive.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A junior analyst has been asked to flag a set of alerts that require further investigation by the senior team. The junior analyst wants to ensure these alerts are easily identifiable in the shared queue. What should the junior analyst do?

   • AStar each alert that requires further investigation.
   • BChange the status of each alert to 'closed'.
   • CModify the incident score of each alert to a higher value.
   • DCreate a custom view that filters for the alerts and share it with the senior team.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In Palo Alto Networks XDR, what is the purpose of configuring custom prioritization rules?

   • ATo tailor alert handling to the organization's specific needs
   • BTo automatically respond to all alerts without analyst input
   • CTo increase the storage capacity for alerts
   • DTo disable all default alert scoring
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   An organization has a custom prioritization rule that adds 20 points to any alert involving the 'Executive' asset group. An alert is generated for an executive's laptop that has a default incident score of 60. What is the final incident score for this alert?

   • A80
   • B60
   • C20
   • D120
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the primary purpose of starring an alert in Palo Alto Networks XDR?

   • ATo mark the alert as false positive automatically
   • BTo permanently delete the alert from the system
   • CTo flag the alert for follow-up or escalation
   • DTo change the alert's severity level
   Reveal Solution Discussion Select an answer first