1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which attribute is commonly used to correlate multiple alerts into a single incident?

   • AThe affected endpoint or user
   • BThe alert's timestamp in milliseconds
   • CThe analyst's shift schedule
   • DThe alert ID
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which event typically initiates the creation of an incident in the XDR platform?

   • AA user reports a phishing email to the security team
   • BThe system administrator reboots a critical server
   • CAn alert is generated by a detection rule and meets the incident creation criteria
   • DA security analyst manually opens a case in the ticketing system
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A SOC analyst is reviewing the incident queue and sees two separate incidents that both involve the same user account and the same malware family, but they were created 30 minutes apart. The analyst believes they are part of the same attack. What should the analyst do to consolidate these into a single incident?

   • AChange the severity of one incident to match the other so they merge automatically
   • BDelete one incident and recreate it with the same name as the other
   • CManually merge the two incidents into one
   • DWait for the system to automatically merge them after a period of inactivity
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An incident has been escalated to a senior analyst for deep investigation. The senior analyst has identified the root cause and taken containment actions. What should be done next in the incident lifecycle?

   • AEscalate the incident to a third-party vendor
   • BReopen the incident to collect more evidence
   • CChange the incident type to a problem ticket
   • DDocument the findings and close the incident
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of incident creation notifications?

   • ATo archive the incident for compliance purposes
   • BTo alert analysts so they can promptly begin triage and investigation
   • CTo automatically resolve the incident without human intervention
   • DTo update the detection rules based on the incident
   Reveal Solution Discussion Select an answer first