1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst is reviewing an incident that contains alerts from a phishing email and a subsequent malware download on the same user's machine. The analyst wants to know if these alerts were grouped because they are causally related. What should the analyst examine?

   • AThe severity of each alert
   • BThe notification that was sent for the incident
   • CThe incident's correlation details showing the causal chain
   • DThe timestamp of each alert
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A SOC manager wants to automate the incident creation process for a specific type of alert, but also wants to ensure that the incident is not created if the alert is already part of an existing incident. What should the manager configure?

   • AA playbook that checks for existing incidents with the same correlation key before creating a new one
   • BA manual process where analysts check for existing incidents before creating new ones
   • CA notification rule that only sends an email if the alert is new
   • DA dashboard that shows all incidents and alerts
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   During an investigation, an analyst needs to see the affected user, the endpoint hostname, and the file hash associated with the incident. Where can the analyst find this information?

   • AIn the notification email
   • BIn the raw packet capture from the network
   • CIn the playbook execution log
   • DIn the incident's artifacts and enrichment data
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   How can an automated playbook influence the incident creation process in the XDR platform?

   • ABy preventing all incidents from being created
   • BBy automatically creating an incident when specific alert conditions are met
   • CBy manually assigning incidents to analysts
   • DBy deleting alerts before they are reviewed
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   How are security analysts typically notified when a new incident is created in the XDR platform?

   • AThrough an in-platform alert and an email notification
   • BThrough a message in the company's internal chat only
   • CThrough a physical alarm in the server room
   • DThrough a weekly summary report
   Reveal Solution Discussion Select an answer first