1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is the correct order of the main incident lifecycle stages in the XDR platform?

   • ATriage, closure, investigation, creation
   • BCreation, triage, investigation, closure
   • CInvestigation, creation, closure, triage
   • DClosure, creation, triage, investigation
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   During an investigation, an analyst needs to understand the full context of an incident, including the affected assets, the user accounts involved, and any related indicators of compromise (IOCs). The analyst also needs to know the incident's current status and severity. What should the analyst use to get this information?

   • AThe notification that was sent when the incident was created
   • BThe playbook execution history
   • CThe incident's metadata and enrichment data
   • DThe raw logs from the affected endpoints
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of grouping multiple alerts into a single incident?

   • ATo provide a unified view of a potential security threat
   • BTo automatically block all affected endpoints
   • CTo reduce the storage space required for alert data
   • DTo increase the number of alerts in the system
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which type of data is considered enrichment attached to an incident?

   • AThe raw log files from the firewall
   • BThe analyst's shift schedule
   • CThe company's employee handbook
   • DThreat intelligence about the involved indicators of compromise
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An incident has been created and assigned to an analyst. The analyst has completed the initial investigation and determined that the alert was a false positive. What is the appropriate next step in the incident lifecycle?

   • AClose the incident and mark it as resolved or false positive
   • BChange the severity to critical to ensure it is not overlooked
   • CEscalate the incident to a higher tier for further analysis
   • DReopen the incident to gather more evidence
   Reveal Solution Discussion Select an answer first