1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC manager wants to ensure that when a high-severity incident is created, the incident commander is notified via SMS, while lower-severity incidents only send an email to the general SOC mailbox. What should be configured?

   • AA single notification rule that sends both SMS and email to everyone
   • BA dashboard that shows incidents and lets the manager decide who to notify
   • CA playbook that sends SMS only if the incident is manually escalated
   • DTwo notification rules based on incident severity
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   During triage, an analyst opens an incident and needs to quickly understand the affected hosts, users, and files, as well as the current status and severity. Where should the analyst look within the incident view?

   • AThe raw alert logs from the firewall
   • BThe incident metadata and enrichment panel
   • CThe playbook execution history
   • DThe notification email that was sent when the incident was created
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   An organization has two separate security tools that generate alerts: one for endpoint and one for network. The XDR platform is ingesting alerts from both. Currently, the same attack may generate two separate incidents because the alerts are not being correlated. The SOC wants to ensure that alerts from the same attack are grouped into a single incident. What is the most effective way to achieve this?

   • AUse a playbook to automatically close one of the duplicate incidents
   • BManually merge incidents after they are created
   • CConfigure correlation rules that group alerts based on common indicators such as source IP, user, or file hash
   • DIncrease the alert severity so that only one tool's alerts create incidents
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An organization has a detection rule that generates an alert for any outbound connection to a known malicious IP. Recently, the SOC has been overwhelmed by a high volume of alerts from a single compromised host, each creating a separate incident. What is the most effective way to reduce the number of incidents while still detecting the threat?

   • AIncrease the severity threshold so only critical alerts create incidents
   • BManually delete the duplicate incidents after they are created
   • CConfigure the detection rule to correlate alerts from the same host into a single incident
   • DDisable the detection rule to stop generating alerts
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A SOC manager wants to ensure that when a specific type of alert is detected, an incident is automatically created and assigned to a particular analyst group, and a notification is sent. What should the manager configure?

   • AA playbook that triggers on the alert and includes incident creation and assignment steps
   • BA manual process where analysts create incidents and assign them
   • CA notification rule that only sends an email to the analyst group
   • DA dashboard that displays alerts and allows analysts to claim them
   Reveal Solution Discussion Select an answer first