1.2 Explain the Alert Prioritization Handling Process XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How do featured fields in the alert view aid in prioritization?

   • AThey provide a detailed timeline of all network traffic
   • BThey automatically resolve low-priority alerts
   • CThey allow analysts to see key attributes at a glance, such as severity and status
   • DThey show the full raw log data for each alert
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   In Palo Alto Networks XDR, what happens to an alert when an analyst stars it?

   • AIt is automatically assigned to the most senior analyst
   • BIt is automatically resolved and closed
   • CIt is moved to a separate 'Starred' folder for easy access
   • DIt is highlighted in the alert list and can be filtered for quick access
   Reveal Solution Discussion Select an answer first
4. 18application · easy

   A SOC team uses a shared alert queue. A senior analyst has just finished investigating a high-severity incident and wants to ensure the rest of the team knows it is being actively worked on to prevent duplicate efforts. Which action should the analyst take in the Cortex XDR console?

   • AModify the incident score to a higher value to draw attention.
   • BChange the alert status to 'closed' to remove it from the active queue.
   • CStar the alert to mark it for tracking and escalation.
   • DCreate a new custom rule to suppress similar alerts.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An analyst is reviewing the alert queue and sees two alerts. Alert 1 has a high incident score but is not starred. Alert 2 has a moderate incident score but is starred. The analyst has time to investigate only one alert. Which alert should the analyst investigate first?

   • AAlert 2, because the star indicates it has been escalated and is therefore more important.
   • BAlert 2, because starred alerts are always higher priority than unstarred alerts.
   • CBoth alerts, because the analyst should investigate all alerts regardless of score or star.
   • DAlert 1, because the higher incident score indicates a higher risk, and the star on Alert 2 may just indicate it is being tracked, not that it is more urgent.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A SOC analyst is reviewing two alerts. Alert A has a high incident score but involves a low-value asset. Alert B has a moderate incident score but involves a domain controller. The analyst has limited time and must choose one to investigate. The analyst also notices that Alert A has been starred by a peer. What should the analyst do?

   • AInvestigate Alert B because the asset criticality of a domain controller outweighs the higher score of Alert A, and the star on Alert A may just indicate it is being tracked, not that it is more urgent.
   • BInvestigate Alert A because it has a higher incident score and is starred, indicating it is a confirmed priority.
   • CAsk the peer who starred Alert A for clarification before making a decision.
   • DInvestigate both alerts simultaneously to avoid missing any potential threats.
   Reveal Solution Discussion Select an answer first