1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is a typical action a playbook might perform during the incident creation process?

   • ASending a physical letter to the system administrator
   • BEnriching the incident with threat intelligence automatically
   • CDeleting the incident after creation
   • DRebooting all servers in the environment
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A SOC is experiencing a high number of incidents that are later determined to be false positives. The false positives are consuming analyst time. The SOC wants to reduce the noise without missing genuine threats. They are considering adjusting the incident creation triggers. Which approach best balances reducing false positives while maintaining detection coverage?

   • ADisable all detection rules that have a high false-positive rate
   • BManually review every alert before it becomes an incident
   • CTune the detection rules to require multiple correlated alerts before creating an incident
   • DIncrease the severity threshold for all alerts so only critical alerts create incidents
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An analyst notices that a new incident appears in the XDR console with a severity of 'High' and several associated artifacts, but no analyst manually created it. What most likely caused this incident to be created?

   • AAn automated workflow triggered by a detection rule that met the incident creation criteria
   • BA scheduled report that generated the incident as a summary of recent alerts
   • CA user manually imported an alert feed from an external source
   • DThe system automatically created the incident from a single low-severity alert without any correlation
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A SOC is required to notify the incident response team within 15 minutes of a critical incident being created. The team is distributed across different time zones and uses a chat platform. The SOC wants to ensure that the notification is sent automatically and reliably. What should be configured?

   • AA playbook that triggers on incident creation and sends a message to the chat platform
   • BA dashboard that shows critical incidents
   • CA notification rule that sends an email to the team
   • DA manual process where the on-call analyst sends a message
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   An incident has been open for several days. The assigned analyst has not made progress, and the incident is now at risk of not being resolved in a timely manner. The SOC manager wants to ensure that incidents do not remain in the same stage indefinitely. What should the manager implement?

   • AA notification rule that sends a reminder to the assigned analyst
   • BA dashboard that shows the age of incidents
   • CA manual process where managers review open incidents weekly
   • DA playbook that escalates incidents that have not changed status within a defined time period
   Reveal Solution Discussion Select an answer first