1.3 Explain the Incident Creation Process XDR-ANALYST Practice Questions (Page 7)

Questions 31–34

1. 31application · medium

   A security operations center (SOC) uses the XDR platform. A single endpoint triggers multiple distinct alerts within a few minutes: a suspicious PowerShell execution, a file write to a startup folder, and an outbound connection to a known malicious IP. The SOC wants these alerts to be handled as one cohesive investigation rather than separate tickets. What should the SOC rely on to achieve this?

   • AA manual process where an analyst creates a separate incident for each alert and then links them
   • BA playbook that suppresses all but the first alert so only one incident is created
   • CA notification rule that sends a single email for all alerts, which the analyst then triages as one incident
   • DThe correlation engine grouping alerts into a single incident based on common causality and shared attributes
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which condition is most likely to cause the XDR platform to create a new incident?

   • AA single low-severity alert that does not match any correlation rule
   • BMultiple related alerts that are correlated by common attributes and meet the incident threshold
   • CAn analyst manually changes the status of an alert to 'closed'
   • DA scheduled vulnerability scan completes without findings
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A new incident is created in the XDR platform. The SOC wants to ensure that the on-call analyst is immediately aware of the incident without having to constantly monitor the console. What should be configured?

   • AA dashboard that the analyst must manually refresh
   • BA scheduled report that summarizes all incidents at the end of the day
   • CAn incident creation notification that sends an alert to the on-call analyst via email or messaging
   • DA playbook that only updates the incident status
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   During which incident lifecycle stage does an analyst assess the incident's priority and assign resources?

   • AClosure
   • BCreation
   • CTriage
   • DInvestigation
   Reveal Solution Discussion Select an answer first