1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   Which of the following is a metadata field typically attached to an incident in the XDR platform?

   • AThe incident's severity level
   • BThe vendor's product version number
   • CThe network switch's serial number
   • DThe analyst's personal email address
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   What is the first step in the incident creation workflow in the XDR platform?

   • AThe incident is closed and documented
   • BThe incident is assigned to a security analyst
   • CThe incident is enriched with threat intelligence
   • DAn alert is detected by a detection rule
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   In the incident creation workflow, which step typically occurs after alerts are correlated and grouped?

   • AThe incident is created with associated metadata and enrichment
   • BThe analyst immediately closes the incident without investigation
   • CThe raw telemetry data is deleted from the data store
   • DThe detection rule is modified to reduce false positives
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   An analyst is investigating an incident and notices that the incident contains alerts from multiple different sources, including endpoint and network. The analyst wants to understand how these alerts were combined. What should the analyst review?

   • AThe incident's correlation and grouping details
   • BThe notification that was sent for the incident
   • CThe playbook that ran on the incident
   • DThe raw logs from each source
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A SOC wants to automate the initial triage of incidents by running a set of enrichment actions (e.g., querying threat intelligence, checking user risk) as soon as an incident is created. What should be configured?

   • AA playbook that is triggered on incident creation and performs the enrichment steps
   • BA dashboard that displays the incident and its alerts
   • CA notification rule that sends an email with the raw alerts
   • DA manual checklist that analysts must follow
   Reveal Solution Discussion Select an answer first