An incident response team is investigating a breach that involves multiple users and devices. The team has logs from various sources, but some logs use different identifiers for the same user. This makes it difficult to correlate the data. What is the best technique to resolve this issue?

Manually map the identifiers in a spreadsheet

Use timeline reconstruction to order the events

Use session correlation to link sessions

Use entity resolution to map different identifiers to the same user

What is data stitching in the context of security analytics?

The process of backing up data to a secondary site

The process of deleting duplicate logs to save storage space

The process of combining data from multiple sources to create a unified view of an attack

The process of encrypting data at rest in a data lake

A security team is investigating a sophisticated attack that spans multiple days and involves several user accounts and IP addresses. The team has data from endpoint, network, and identity sources. They need to understand the full attack path, but the data is fragmented. What is the most effective approach?

Focus on the endpoint data as the most reliable source

Generate separate reports for each data source

Manually correlate the data using spreadsheets

Use data stitching with entity resolution and timeline reconstruction

A security analyst is investigating a potential data breach. The analyst has data from the firewall, endpoint, and cloud access logs. Each source shows a different aspect of the attack, but the analyst needs to see the complete picture. What is the best approach?

Generate separate reports for each source

Use data stitching to correlate the data from all sources

Focus on the firewall logs as the primary source

Wait for more alerts to arrive before investigating

A SOC is experiencing alert fatigue, and analysts are missing critical incidents. The SOC manager proposes alert grouping, but some analysts are concerned that grouping might hide important details. The manager needs to balance reducing noise with maintaining visibility. What is the best approach?

Implement alert grouping with the ability to drill down into individual alerts

Disable alert grouping to ensure no details are missed

Group all alerts into a single incident to minimize noise

Group alerts only by severity to simplify the process

Palo Alto NetworksCertified XDR Analyst

Domain 1Objective 4

1.4 Explain the Concepts of Alert Grouping and Data Stitching XDR-ANALYST Practice Questions (Page 4)

Part of the Alerting and Detection Processes domain, which accounts for 23% of the XDR-ANALYST exam.

30questions here

6free pages

7concepts

23%of the exam

Questions 16–20

16expert · hard
An incident response team is investigating a breach that involves multiple users and devices. The team has logs from various sources, but some logs use different identifiers for the same user. This makes it difficult to correlate the data. What is the best technique to resolve this issue?
Select an answer first
17foundation · easy
What is data stitching in the context of security analytics?
Select an answer first
18expert · hard
A security team is investigating a sophisticated attack that spans multiple days and involves several user accounts and IP addresses. The team has data from endpoint, network, and identity sources. They need to understand the full attack path, but the data is fragmented. What is the most effective approach?
Select an answer first
19application · medium
A security analyst is investigating a potential data breach. The analyst has data from the firewall, endpoint, and cloud access logs. Each source shows a different aspect of the attack, but the analyst needs to see the complete picture. What is the best approach?
Select an answer first
20expert · hard
A SOC is experiencing alert fatigue, and analysts are missing critical incidents. The SOC manager proposes alert grouping, but some analysts are concerned that grouping might hide important details. The manager needs to balance reducing noise with maintaining visibility. What is the best approach?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to XDR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Palo Alto Networks. “XDR-ANALYST” is a trademark of its owner, used for identification only.